Privacy Policy

1. Who we are

NOY is a product of KEK I.T. Solutions, a sole proprietorship registered with the Philippine Department of Trade and Industry. In this policy, "NOY", "we" and "us" mean KEK I.T. Solutions.

We build ordering, point-of-sale, delivery and back-office software for Filipino businesses. Each business that uses NOY runs it under its own name and its own brand.

2. Who this policy is for

Three different groups of people meet NOY, and they are treated differently below.

• Customers. Anyone who orders food or goods through a shop that uses NOY, whether from a phone, from a QR code on a table, or from a self-order screen in the shop.
• Business owners and their staff. The people who run a shop on NOY: the owner who signs in to the back office, and the staff who use the counter, kitchen and self-order screens.
• Visitors to noystudios.com. Anyone reading our marketing site or asking for a demo.

3. Who is responsible for what

Under the Data Privacy Act of 2012 (Republic Act No. 10173), it matters who decides what happens to information and who merely handles it. NOY sits on both sides of that line depending on the information.

In plain terms: if you have a question about your order, the shop is the right place to ask, and they can act faster than we can. If you have a question about the software, ask us. If the shop cannot help you, write to us and we will help you reach them.

4. What we collect

4.1 When you place an order

The browser identifier is a random value generated by our database. It is not your name, your phone number, your IP address or your device's hardware identity, and on its own it identifies nobody. If you clear your browser data, it is gone and a new one is created.

A receipt image is personal information and we treat it as such. It usually shows your name, the amount, and a transaction reference. It is stored in a private area that the public cannot browse. Only the shop you paid, and NOY where we have to investigate a fault or a dispute, can open it.

4.2 If you are a business owner or a member of staff

• Owner account: the email address you sign up with and an encrypted form of your password. We never see or store your password in a readable form.
• Store details you enter: shop name, address, opening hours, contact numbers, social media links, fees and the payment accounts you want customers to send money to.
• Staff records you enter: the names of the people on your till roster and an encrypted form of each person's void PIN.
• Records of what was done: which device took an order, which device or staff member voided one, and an audit log of changes made in the back office. This exists so that a shop can answer the question "who cancelled that sale", which is a normal and necessary control over cash.
• Business records you enter: expenses, tasks and notes you record in the back office.

4.3 If you visit noystudios.com

• Nothing, unless you write to us. The marketing site carries no advertising cookies, no analytics scripts and no third-party trackers.
• If you send the demo enquiry form: your name, email address, and whatever you write in the message. The form is delivered to our inbox through a third-party form service (see section 7).
• Standard server records kept by our hosting provider, such as IP addresses and request logs, retained by them for security and abuse prevention.

5. What we do not collect

Stated plainly, because a policy that only lists what is taken is half a policy.

• No card numbers, no bank logins, no e-wallet passwords, no one-time PINs. Nothing in NOY ever asks for them and nothing in NOY could store them. You pay the shop directly through your own bank or e-wallet app. NOY is not a payment processor and does not hold, move or refund your money.
• No location tracking. We do not read your GPS. A delivery address is one you typed.
• No contacts, photo library, camera roll or microphone. If you upload a receipt image, you choose that one file.
• No advertising profiles, and we do not sell, rent or trade personal information to anyone.
• No sensitive personal information as the Data Privacy Act defines it: we do not ask for your race, health, religion, marital status, government-issued identifier or any similar category.

6. Why we collect it, and our legal basis

7. Who else handles it

We use a small number of established service providers. They process information on our instructions and are not permitted to use it for their own purposes.

Some of this involves transferring information outside the Philippines. The Data Privacy Act permits this, and we remain accountable for the information wherever it is processed. We choose providers that offer contractual data protection commitments and industry-standard security.

We also share information in three other situations, and no others:

• With the shop you ordered from. That is the point of the software.
• Where the law requires it, such as a valid court order, subpoena or lawful request from a government authority.
• If NOY is sold or transferred to another business, in which case the information moves with it and this policy continues to apply until you are told otherwise.

8. How long we keep it

Where information is part of a shop's own financial record, the shop decides how long to keep it and we follow their instruction, subject to Philippine tax and accounting rules.

9. Your rights, and how to use them

The Data Privacy Act of 2012 gives you the following rights over your personal information. They are free to use, and using them will never be held against you.

• To be informed that your information is being collected and what it is used for. That is this document.
• To access a copy of the information we hold about you.
• To object to processing, including for direct marketing.
• To rectify anything inaccurate or out of date.
• To erasure or blocking where the information is incomplete, outdated, unlawfully obtained, or no longer needed for the purpose it was collected for.
• To data portability, meaning a copy in a commonly used electronic format.
• To damages if you suffer because your rights were violated.
• To lodge a complaint with the National Privacy Commission.

If you are not satisfied with our response, you may complain to the National Privacy Commission, 5th Floor, Delegation Building, PICC Complex, Pasay City, Metro Manila, or through privacy.gov.ph.

10. How we protect it

Stated as what the software actually does, rather than as reassurance.

• Everything travels encrypted. All connections use HTTPS.
• Every shop's data is isolated at the database level. Access rules are enforced by the database itself, not by the app, so a device belonging to one shop cannot read another shop's orders even if someone tampers with the page in their browser.
• The app cannot write directly to order records. Every change goes through a checked server-side procedure that decides prices and permissions itself, so a modified page cannot set its own price.
• Receipt images are stored privately. They are not on a public address, cannot be browsed or guessed, and are opened through short-lived links.
• Passwords and staff PINs are stored hashed, never in readable form.
• Staff devices are individually paired using single-use, time-limited codes, and the number of attempts is limited.
• We test our own access rules with an automated suite that tries to break them, and we run it before changes ship.

No system is perfectly secure, and we will not claim otherwise. We keep the amount of information we hold small precisely because that is the most reliable protection available to anyone.

11. If something goes wrong

If a personal data breach occurs that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the affected individuals within 72 hours of becoming aware of it, as required by the Data Privacy Act and its implementing rules. Where the breach concerns a shop's customer information, we will notify the shop immediately so they can act as well.

12. Children

NOY is a tool for buying food and running a business. It is not directed at children and we do not knowingly collect information from a child under 18 beyond what is unavoidable when somebody places an order. If you believe a child has given us personal information, write to us and we will delete it.

13. Cookies and local storage

There are no advertising cookies and no third-party tracking on NOY. What the app stores on your device is stored there for you, not sent to anyone for profiling:

• Your basket and your order, so that closing the page by accident does not lose it, and so the app keeps working when your signal drops.
• Your sign-in token, so a shop's till stays paired and does not ask staff for a password every morning.
• Small preferences, such as whether you last chose pick-up or delivery.

Clearing your browser's site data removes all of it. On a customer's phone that simply starts you fresh. On a shop's till it will unpair the device, and it will need to be set up again.

14. Changes to this policy

We will update this policy when what we do changes. The version number and effective date at the top always tell you which version you are reading. If a change materially affects your rights we will say so prominently on this page, and we will tell business owners directly.

15. Contact us