Privacy Policy

1. Who we are

NOY is a product of KEK I.T. Solutions, a sole proprietorship registered with the Philippine Department of Trade and Industry. In this policy, "NOY", "we" and "us" mean KEK I.T. Solutions.

We build ordering, point-of-sale, delivery and back-office software for Filipino businesses. Each business that uses NOY runs it under its own name and its own brand.

2. Who this policy is for

Three different groups of people meet NOY, and they are treated differently below.

• Customers. Anyone who orders food or goods through a shop that uses NOY, whether from a phone, from a QR code on a table, or from a self-order screen in the shop.
• Business owners and their staff. The people who run a shop on NOY: the owner who signs in to the back office, and the staff who use the counter, kitchen and self-order screens.
• Visitors to noystudios.com. Anyone reading our marketing site or asking for a demo.

3. Who is responsible for what

Under the Data Privacy Act of 2012 (Republic Act No. 10173), it matters who decides what happens to information and who merely handles it. NOY sits on both sides of that line depending on the information.

In plain terms: if you have a question about your order, the shop is the right place to ask, and they can act faster than we can. If you have a question about the software, ask us. If the shop cannot help you, write to us and we will help you reach them.

4. What we collect

4.1 When you place an order

The browser identifier is a random value generated by our database. It recognises your browser and links it to your orders, so we treat it as part of the order record. Clearing browser data removes the local identifier and can remove your access to those orders; it does not delete the server records.

A receipt image is personal information and we treat it as such. It usually shows your name, the amount, and a transaction reference. It is stored in a private area that the public cannot browse. Only the shop you paid, and NOY where we have to investigate a fault or a dispute, can open it.

4.2 If you are a business owner or a member of staff

• Owner account: the email address you sign up with and an encrypted form of your password. We never see or store your password in a readable form.
• Store details you enter: shop name, address, opening hours, contact numbers, social media links, fees and the payment accounts you want customers to send money to.
• Staff records you enter: the names of the people on your till roster and an encrypted form of each person's void PIN.
• Records of what was done: which device took an order, which device or staff member voided one, and an audit log of changes made in the back office. This exists so that a shop can answer the question "who cancelled that sale", which is a normal and necessary control over cash.
• Business records you enter: expenses, tasks and notes you record in the back office.
• Optional shop features: customer directory and credit records, staff roles, timeclock entries and inventory or supplier records where the shop enables them. The shop decides what to enter and should collect only what it needs.
• Back-office assistant: if you ask a question, the request described in section 7 is sent to DeepSeek. Avoid including personal or confidential information in the question.

4.3 If you visit noystudios.com

• Website analytics: Cloudflare Web Analytics measures visits and page performance. It does not use cookies or local storage for analytics or track people across websites.
• If you send the demo enquiry form: your name, email address, business type, message, and any business name or mobile number you choose to provide. Web3Forms delivers it to our inbox. After acceptance, we also attempt to save the enquiry in the KEK Command Center, our internal enquiry system. The forwarding service hashes your network address with a secret to limit abuse.
• Display preferences: the site remembers your colour theme in local storage as noy-color-theme and your choice to hide seasonal artwork for the browser session.
• Standard server records kept by our hosting provider, such as IP addresses and request logs, retained by them for security and abuse prevention.

5. Information limits

• No card numbers, no bank logins, no e-wallet passwords, no one-time PINs. NOY does not ask for them. Never include them in notes, messages or uploads. You pay the shop directly through your own bank or e-wallet app. NOY is not a payment processor and does not hold, move or refund your money.
• Location is used for delivery. The browser asks permission before GPS access. Customers can use the location controls or set a delivery pin on the map. Riders who enable location sharing report their position while they have an active delivery. The latest rider position replaces the previous one and is cleared when the delivery ends or the rider is removed. The customer can see the assigned rider's recent position during that delivery. Turning off sharing stops new reports.
• No contacts, photo library, camera roll or microphone. If you upload a receipt image, you choose that one file.
• No advertising profiles, and we do not sell, rent or trade personal information to anyone.
• Please leave sensitive details out of notes, messages and assistant questions. These fields are for shop operations. Do not send passwords, identity documents or unnecessary health or other sensitive information.

6. Why we collect it, and our legal basis

7. Who else handles it

The services below receive information for the purposes described. Where a provider also processes information for its own purposes, its terms and privacy notice apply to that processing.

Some of this involves transferring information outside the Philippines. The Data Privacy Act permits this, and we remain accountable for the information wherever it is processed. We choose providers that offer contractual data protection commitments and industry-standard security.

We also share information in three other situations, and no others:

• With the shop you ordered from. That is the point of the software.
• Where the law requires it, such as a valid court order, subpoena or lawful request from a government authority.
• If NOY is sold or transferred to another business, in which case the information moves with it and this policy continues to apply until you are told otherwise.

8. How long we keep it

Where information is part of a shop's own financial record, the shop decides how long to keep it and we follow their instruction, subject to Philippine tax and accounting rules.

9. Your rights, and how to use them

The Data Privacy Act of 2012 gives you the following rights over your personal information. They are free to use, and using them will never be held against you.

• To be informed that your information is being collected and what it is used for. That is this document.
• To access a copy of the information we hold about you.
• To object to processing, including for direct marketing.
• To rectify anything inaccurate or out of date.
• To erasure or blocking where the information is incomplete, outdated, unlawfully obtained, or no longer needed for the purpose it was collected for.
• To data portability, meaning a copy in a commonly used electronic format.
• To damages if you suffer because your rights were violated.
• To lodge a complaint with the National Privacy Commission.

If you are not satisfied with our response, you may complain to the National Privacy Commission, 5th Floor, Delegation Building, PICC Complex, Pasay City, Metro Manila, or through privacy.gov.ph.

10. How we protect it

Stated as what the software actually does, rather than as reassurance.

• Everything travels encrypted. All connections use HTTPS.
• Every shop's data is isolated at the database level. Access rules are enforced by the database itself, not by the app, so a device belonging to one shop cannot read another shop's orders even if someone tampers with the page in their browser.
• The app cannot write directly to order records. Every change goes through a checked server-side procedure that decides prices and permissions itself, so a modified page cannot set its own price.
• Receipt images are stored privately. They are not on a public address, cannot be browsed or guessed, and are opened through short-lived links.
• Passwords and staff PINs are stored hashed, never in readable form.
• Staff devices are individually paired using single-use, time-limited codes, and the number of attempts is limited.
• We test our own access rules with an automated suite that tries to break them, and we run it before changes ship.

No system is perfectly secure, and we will not claim otherwise. We keep the amount of information we hold small precisely because that is the most reliable protection available to anyone.

11. If something goes wrong

If a personal data breach occurs that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the affected individuals within 72 hours of becoming aware of it, as required by the Data Privacy Act and its implementing rules. Where the breach concerns a shop's customer information, we will notify the shop immediately so they can act as well.

12. Children

NOY is a tool for buying food and running a business. It is not directed at children and we do not offer child accounts or ask for a date of birth. If a child needs to order, a parent or guardian should place the order and provide their own contact details. If you believe a child has supplied personal information, contact us using section 9 so we and the shop can assess and handle the request.

13. Cookies and local storage

NOY does not place advertising cookies. The app stores the following on your device to run the service:

• Your basket and your order, so that closing the page by accident does not lose it, and so the app keeps working when your signal drops.
• Your sign-in token, so a shop's till stays paired and does not ask staff for a password every morning.
• Small preferences, such as whether you last chose pick-up or delivery.

The marketing site also stores the display preferences described in section 4.3. Its Cloudflare analytics does not use cookies or local storage. Embedded maps use the providers described in section 7.

Clearing site data removes information stored in that browser, not records held by NOY or the shop. On a customer's phone it can remove access to an existing order. On a shop's till it unpairs the device and can lose unsent orders. Staff should sync and check with the owner before clearing anything.

14. Changes to this policy

We will update this policy when what we do changes. The version number and effective date at the top always tell you which version you are reading. If a change materially affects your rights we will say so prominently on this page, and we will tell business owners directly.

15. Contact us