Privacy Policy

PeraPo (“PeraPo”, “we”, “us”) is a budgeting and remittance-planning service for Overseas Filipino Workers and their families. This policy explains exactly what personal information we collect, why we collect it, who we share it with, and what you can do about it. It applies to perapo.com, app.perapo.com, and any PeraPo mobile app (“the Service”).

We comply with the Philippines Data Privacy Act of 2012 (RA 10173). If you live in the European Economic Area or the United Kingdom, you have additional rights under the GDPR / UK GDPR, described below.

1. Information you give us

• Account details — name, email address, phone number (if you sign up via SMS OTP), country of residence, preferred currency, payday cycle.
• Household data — family group name, the names / relationships of family members you add, and co-managers you invite.
• Financial data you choose to enter — budgets, expenses, income entries, loans, savings goals, wishlist items, subscriptions, remittance plans. Nothing is fetched from your bank without your explicit action.
• Receipts & documents you upload — images, PDFs, and notes you store in the Files vault or attach to expenses.
• Family-care info (optional) — medications, appointments, emergency contacts, and health notes you enter for family members.
• Support messages — conversations with the support bot and any human agents you escalate to.
• Legal-chat messages — questions you ask the Legal AI and the responses it produces.

2. Information we collect automatically

• Authentication tokens and session cookies from Supabase Auth, required to keep you signed in.
• Basic usage analytics — pages visited, features used, errors encountered. We use this to fix bugs and improve the product.
• Device and browser info — user agent, approximate region (derived from IP for timezone and currency defaults). We do not build advertising profiles from this data.

3. What we do not collect

• We never ask for or store your bank account numbers, online-banking passwords, card numbers, or card verification codes. Stripe handles all card data for paid plans; it is never transmitted to our servers.
• We do not access your contacts, photos, microphone, or precise location. The camera is used only when you explicitly scan a receipt.
• We do not sell your personal information to anyone, ever.

4. How we use your information

• To provide the budgeting, expense tracking, OCR scanning, and remittance features.
• To send transactional emails and SMS (verification codes, billing receipts, reminders you enable).
• To detect abuse, prevent fraud, and keep the service safe for everyone.
• To improve features based on aggregated, de-identified usage patterns.
• To comply with legal obligations and respond to lawful requests.

5. Service providers who process data on our behalf

We use carefully chosen vendors. Each has its own security obligations and receives only the minimum data it needs:

• Supabase — authentication, database, and file storage. Receives: account, financial, and uploaded file data.
• Anthropic (Claude API) — receipt OCR, legal AI, and support bot. Receives: receipt images you scan, the text of legal questions you ask, and support messages you send the bot. Anthropic does not use API content to train its models.
• Stripe — subscription billing. Receives: email, billing information, and card data (card data never touches PeraPo servers).
• Xe — foreign exchange rates. Receives: only currency pairs, no user data.
• Resend — transactional email delivery. Receives: your email and the message body.
• Twilio — SMS delivery for OTP. Receives: your phone number and the OTP code.
• Sentry / Vercel Analytics — error and performance monitoring. Receives: stack traces and anonymized page-view events.
• Vercel and Railway — hosting infrastructure.

6. Where your data is stored

Data is stored in secure data centers operated by the providers above, primarily in the United States and Asia-Pacific regions. Transfers outside the Philippines are made under standard contractual protections and the service providers’ own certifications (SOC 2, ISO 27001).

7. How long we keep your data

• Active account data is kept for as long as your account is active.
• When you delete your account, we remove your personal data from our production database within 30 days. Backups are purged on a rolling 90-day cycle.
• We may retain audit logs, billing records, and abuse-prevention records for up to 7 years as required by Philippines tax and anti-fraud law.

8. Your rights

Under the Data Privacy Act and applicable foreign laws, you have the right to:

• Access the data we hold about you.
• Correct inaccurate data directly in Settings, or by request.
• Export your data (request via support).
• Delete your account and associated data.
• Object to or restrict certain processing.
• Withdraw consent at any time (this does not affect processing already done).
• Lodge a complaint with the National Privacy Commission (privacy.gov.ph) or your local data-protection authority.

9. Security

Passwords are hashed with industry-standard algorithms and never stored in plain text. Data in transit is protected by TLS. Data at rest in our primary database is encrypted. Row-Level Security policies in the database ensure one user cannot read another user’s data. Despite these measures, no online service is perfectly secure; if you suspect your account has been compromised, email security@perapo.com immediately.

10. Children

PeraPo is not directed to children under 18. We do not knowingly collect data from anyone under 18. If we learn that a child has created an account, we will delete it.

11. Cookies

We use only essential cookies required to keep you signed in and remember your preferences. We do not use third-party advertising cookies.

12. Changes to this policy

If we make material changes to this policy, we will notify you by email and post a notice in the app at least 14 days before the changes take effect.

13. Contact

Data Protection Officer: privacy@perapo.com
General support: support@perapo.com