Privacy policy

Last updated October 21, 2026

Talaan is operated by Rocket Labs Consulting Inc. ("Rocket Labs", "we"), Unit 310 Sunrise Condominium, 226 Ortigas Ave, Greenhills, San Juan City 1502, Philippines. This policy explains what information Talaan handles and how, in line with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).

Who is responsible for what

Each business that uses Talaan (a "customer") decides what its own records contain and why. For the sales, invoice and buyer data in a customer's account, the customer is the personal information controller and Rocket Labs processes it on the customer's behalf. For the details people give us to sign up and use Talaan (name, email, login activity), Rocket Labs is the controller.

What we collect

  • Account details: business name, the names and email addresses of users, and their encrypted passwords.
  • Business registration details: registered name, TIN, branch code, RDO, VAT status and address, entered by the customer to print BIR invoices.
  • Marketplace data from stores a customer connects (Shopee, Lazada, TikTok Shop): orders, order items, returns, and settlement and fee details. Where a marketplace provides buyer details, we use only what the BIR requires on the invoice (the buyer's name and address). Talaan doesn't keep a separate copy of raw marketplace orders: each paid order becomes an invoice.
  • Usage records: logins and changes to records (the audit trail the BIR requires of computerized accounting systems).

How we use it

  • To issue BIR-compliant sales invoices, keep the customer's books, and transmit invoices to the BIR Electronic Invoicing System when that feature is enabled.
  • To run the service: logins, account emails (such as sign-up and password resets) and support.

We don't sell personal information, use it for advertising, or share marketplace data with other customers.

Marketplace access

A store is connected only when its owner approves Talaan on the marketplace's own authorization page. Talaan uses that access to read orders, returns and settlements; it doesn't change listings, prices, stock or orders. The store owner can revoke access at any time from the marketplace's seller center, or disconnect the store in Talaan.

When a store is disconnected, Talaan deletes its marketplace access immediately and stops reading its data. If access expires or is revoked in the seller center and isn't renewed, Talaan deletes it automatically after 30 days. Invoices already issued for the store's orders stay in the customer's books, as tax rules require.

Who we share it with

  • The Bureau of Internal Revenue, when the customer uses e-invoice transmission, as required by tax regulations.
  • Service providers that host or deliver the service: Hetzner Online (servers, Finland) and Amazon Web Services (email delivery, and encrypted backups stored in Sweden). They process data only to provide their service to us.
  • Authorities, when the law requires it.

How long we keep it

We keep invoices and books as long as Philippine tax rules require, and delete everything else once it's no longer needed.

  • Invoices, credit notes and books of accounts (including a buyer's name and address printed on an invoice): ten years from the end of the tax year, as the BIR requires, then deleted.
  • Marketplace access: only while a store is connected (see above).
  • Account and user details: while the account is active, then with the books.
  • Web server logs: 14 days.
  • Backups: daily copies for 90 days, monthly copies for ten years (to cover the tax-record period).

When a customer closes their account we first offer an export of their invoices and books; the records are then archived only for the tax-record period and deleted after it. Customers can ask for an export at any time.

Security

Each customer account runs on its own database. Connections are encrypted (HTTPS), marketplace access tokens are stored encrypted and passwords as salted hashes, owners and administrators must log in with a second step (an authenticator app code), server access is limited to key-based logins, and changes to records are logged. Each night every account is backed up to a separate, encrypted location that the server itself can't delete from.

If a security incident affects personal information, we follow a written incident-response procedure: we contain it, tell affected customers, and notify the National Privacy Commission within 72 hours where the Data Privacy Act requires.

Your rights

Under the Data Privacy Act you can ask to access, correct or delete your personal information, or object to its processing. For records inside a business's Talaan account, contact that business first. We answer requests within 30 days. We delete what the law doesn't require us to keep; information on issued invoices and in the books stays for the tax-record period, as the Data Privacy Act allows. To reach our Data Protection Officer, email dpo@botbros.ai.

Changes

If we change this policy we'll update the date above, and tell account owners by email about significant changes.