Privacy Policy

1. Roles: Personal Information Controller and Processor

Depending on the processing activity, INTEGR8 may act as a Personal Information Controller (PIC), for example for customer account, billing, sales, support, security, and website data, and/or as a Personal Information Processor (PIP) when processing personal data contained in Customer Data on the customer's documented instructions.

Where the customer determines the purposes and means of processing personal data in its Neo database, the customer remains responsible for its own obligations as PIC.

2. Personal Data We May Collect

• Account and identity data: name, username, email, telephone number, company, role, and account identifiers.
• Business and billing data: company information, subscription, invoices, payment status, transaction references, and billing contact details.
• Customer Data: accounting records, customer/supplier information, employee/user information, invoices, receipts, attachments, inventory and transaction data uploaded to Neo.
• Technical and usage data: IP address, device/browser information, login events, audit logs, feature usage, diagnostics, and security events.
• Support and communications data: inquiries, tickets, correspondence, training/support records, and feedback.
• OCR/AI content: documents, images, prompts, extracted fields, and related metadata submitted to applicable features.
• Payment data: payment method category and transaction metadata received from payment processors; sensitive payment credentials may be collected directly by the payment processor rather than INTEGR8.

3. Purposes of Processing

• Create and administer accounts and subscriptions.
• Provide accounting, inventory, reporting, OCR, AI, automation, payment, and other subscribed functionality.
• Authenticate users, enforce permissions, prevent fraud, investigate security events, and maintain audit trails.
• Process and reconcile payments and manage subscriptions.
• Provide support, implementation, training, notices, and service communications.
• Maintain, troubleshoot, secure, analyze, and improve Neo.
• Comply with legal, regulatory, tax, accounting, security, and lawful government requirements.
• Send marketing communications where permitted, subject to applicable consent and opt-out requirements.

4. Lawful Bases

INTEGR8 processes personal data only where a lawful basis exists under applicable Philippine privacy law, which may include consent, performance of a contract, compliance with legal obligations, protection of lawful rights and interests, and other bases permitted by law. Sensitive personal information will be processed only where an applicable legal basis and safeguards exist.

5. PayMongo and Payment Processing

When PayMongo or another payment processor is used, payment information required to complete the transaction may be provided directly to that processor. The processor may independently process personal data under its own privacy notice and regulatory obligations.

INTEGR8 may receive limited payment and reconciliation information from the processor. Customers should review the applicable payment processor's privacy notice before completing payment.

PayMongo Privacy Policy

6. OCR, AI and Automated Processing

Documents or data submitted to OCR or AI-assisted features may be transmitted to approved technology providers solely as necessary to provide those functions, subject to contractual safeguards. Neo may generate extracted fields, classifications, suggestions, or confidence scores. Material decisions and accounting/tax postings should remain subject to authorized human review.

Any use of personal data for a purpose beyond providing the requested OCR or AI function requires a lawful basis and applicable notices and safeguards. This policy does not grant blanket consent to use Customer Data to train third-party models.

7. Sharing and Disclosure

INTEGR8 may disclose personal data to authorized personnel and service providers such as cloud hosting, security, communications, support, OCR/AI, analytics, and payment providers, only to the extent reasonably necessary for the stated purposes. INTEGR8 may also disclose information when required by law, lawful government process, or to protect legal rights and system security.

INTEGR8 does not sell personal data.

8. Cross-Border Processing

Some service providers or infrastructure may process or store data outside the Philippines. Where cross-border processing occurs, INTEGR8 will implement appropriate contractual, organizational, and technical safeguards consistent with applicable Philippine data protection requirements.

9. Data Retention and Deletion

Personal data will be retained only for as long as necessary for the purposes for which it was collected, the applicable customer agreement, legitimate business and security needs, and legal/regulatory retention requirements.

If a company workspace remains inactive for six (6) months, or the account is terminated, company data may be permanently deleted from active systems. Subscription expiry may suspend access until renewal. Export needed records before account closure or the inactivity period expires; contact support for assistance with access or export. Backups are for operational recovery and do not guarantee continued customer access or restoration. Records required for legal, tax, billing, dispute-resolution or security purposes may be retained as necessary, subject to applicable law. Backup copies are removed or overwritten under applicable backup rotation procedures.

10. Security

INTEGR8 uses reasonable administrative, physical, and technical safeguards designed to protect personal data against accidental or unlawful destruction, alteration, disclosure, loss, misuse, and unauthorized access. Safeguards may include access controls, authentication, logging, encryption where appropriate, backups, vulnerability management, and incident-response procedures.

11. Personal Data Breaches

INTEGR8 will investigate suspected personal data breaches and comply with applicable notification and reporting obligations. Where INTEGR8 acts as a PIP, it will notify the relevant customer/PIC in accordance with applicable law and contractual obligations.

12. Data Subject Rights

Subject to applicable law and valid exceptions, data subjects may exercise rights including the right to be informed, object, access, correct/rectify, erase or block, obtain data portability where applicable, lodge a complaint, and claim damages as provided by law.

Send privacy requests to INTEGR8 using the privacy contact below, identifying the account and the right you wish to exercise. We may verify your identity and authority before acting. Where we process records on a customer’s instructions, we may refer or coordinate the request with that customer. You may withdraw consent for processing that relies on consent without affecting prior lawful processing, and may complain to the National Privacy Commission.

National Privacy Commission: data subject rights

13. Cookies, Analytics and Similar Technologies

Neo and its public website may use cookies, local storage, logs, analytics, or similar technologies for authentication, security, preferences, performance, and analytics. Where legally required, users will be given appropriate notice and choices.

14. Children's Data

Neo is intended for business use and is not directed to children. Customers must not knowingly use Neo to collect children's personal data unless they have a lawful basis, appropriate notices/consents, and safeguards required by applicable law.

15. Privacy Policy Changes

INTEGR8 may update this Privacy Policy when its processing practices, service providers, products, or legal obligations change. Material changes will be communicated by reasonable means and the effective date will be updated.