Tantya Privacy Policy

Effective date: July 12, 2026

Last updated: July 12, 2026

1. Who we are

Tantya ("Tantya," "we," "us," "the App") is a free construction material quantity and quotation calculator for contractors in the Philippines, currently operated by Tantya, Based in the Philippines, as an individual — not yet a registered business entity. You can reach us at privacy@tantya.app for any question or request about this policy.

Because Tantya is not yet a registered business, some formal steps required of registered companies (e.g., registering data processing systems with the National Privacy Commission, where the applicable thresholds are met) will be completed as the operator formalizes its business structure. See Section 12 for how to raise concerns in the meantime.

Designating a Data Protection Officer / Compliance Officer for Privacy is a separate obligation from NPC registration and applies regardless of business size. Jinho Son has been designated as Compliance Officer for Privacy for Tantya and can be reached at privacy@tantya.app.

2. Scope

This policy applies to:

• Account holders — contractors and their invited team members who sign up and use Tantya to manage projects, quotations, and related records ("you," "your account").
• Your customers — the people whose names or contact details you enter into Tantya (e.g., a homeowner named on a quotation), or who submit an inquiry through your public profile page.
• Your workers — the people you register in Tantya's attendance/payroll-estimate feature.
• Site visitors — anyone who visits any Tantya page, including public quotation links (/s/...) and public contractor profiles (/p/...), whether or not they have an account.

If you are a contractor entering your customers' or workers' personal data into Tantya, you act as the data controller for that data under the DPA, and Tantya acts primarily as your data processor / service provider for it. You are responsible for having a lawful basis (e.g., your customer's or worker's consent, or your contractual relationship with them) before entering their personal data into the App. This policy describes how Tantya, as the platform operator, handles all personal data that passes through the App — including data you enter about others.

For Tantya's own processing (as opposed to what you, the contractor, choose to enter about others), our legal bases are: performing our contract with you for account and project data (DPA Section 12(b)); our legitimate interest in keeping the App secure for security/abuse-prevention logs (Section 12(f)); and, for the optional, sensitive TIN field, your consent, since it is never required to use the App (Section 13(a)).

3. Personal data we collect

3.1 Account data (about you, the registered user)

• Email address and authentication data (via our authentication provider, Supabase)
• Company name, address, phone, email, and Tax Identification Number (TIN) if you fill in your company profile — your TIN is classified as "sensitive personal information" under the DPA because it is a government-issued tax identifier; we store it like any other company-profile field, and recommend filling it in only if you intend to print it on issued quotations
• Default quotation settings (markup rate, VAT rate, validity period, terms text)
• Optional public contractor profile: bio, services offered, service areas — only if you turn on "public profile"
• Webhook URL and calendar (iCal) feed token, if you enable those integrations
• Account status flags (e.g., whether your account has been suspended for abuse — see 3.5 — or, for the operator's own internal team, an administrator role flag)

3.2 Project & customer data (about your customers, entered by you)

• Project name and customer name
• Quotation content: line items, pricing, proposal text, terms
• For shared/public quotations: the name typed in by the person who approves or declines the quotation online, and the approval/decline timestamp
• Payment records you log (amount, method, date, note) — a manual ledger only; Tantya does not process payments or touch any money
• Expense records, including optional receipt photos you upload
• Inquiries submitted through your public contractor profile's contact form: the inquirer's name, phone, and/or email, and their message — the inquirer may not be a Tantya account holder at all
• If you explicitly save a quotation revision, an immutable snapshot of that quotation (including any customer name/line items in it at that moment) is kept as version history — see Section 8 for how this affects erasure requests

3.3 Worker data (about your workers, entered by you)

• Worker name, role, pay type (daily-rate or lump-sum), daily rate
• Attendance records (dates worked, fraction of day, lump-sum amounts, notes) used to estimate labor cost totals — a display-only estimate; Tantya does not disburse wages

3.4 Files you upload

• Floor plan images/PDFs used for the digital takeoff (measurement) tool
• Receipt photos for expense tracking

Both are stored in private cloud storage and are only accessible to your project's members.

3.5 Security & abuse-prevention logs (about all visitors, including you)

• For every request to the site: IP address, approximate location (country/region/city, derived from your IP by our hosting provider), the page path requested, browser user-agent string, and referring page — logged for every visit, whether normal or blocked
• For requests we automatically identify as malicious (e.g., attempts to probe for known vulnerabilities), we additionally record why the request was blocked
• For the AI material-estimate feature specifically, we log your account, IP, and approximate location to enforce a daily usage limit and prevent abuse of our paid AI provider account

3.6 What we do NOT collect

• We do not use advertising trackers or sell your data to advertisers.
• We do not process payments — the payment/expense features are manual record-keeping only.
• We do not scrape or republish government pricing data; material prices in the App are either our own researched reference values or values you enter yourself.

4. How we use your data

5. Who we share data with

We do not sell personal data. We share it only with the service providers that make Tantya work, and only to the extent needed:

• Supabase (database, authentication, and file storage provider) — stores essentially all data described in Section 3.
• Vercel (hosting provider) — serves the App and supplies the approximate-location headers used in Section 3.5.
• Anthropic (AI provider) — receives the free-text description you type into the AI material-estimate feature and processes it to generate a response. Avoid typing your customer's personal data into that feature if you can.
• Third parties you configure yourself — if you turn on a webhook URL or add a "buy now, pay later" checkout link, quotation data or a link is sent to the third-party endpoint or service you configured. We do not control, and are not responsible for, how that third party handles data once it leaves Tantya.

These providers may process or store data outside the Philippines. By using Tantya you acknowledge this cross-border transfer. Consistent with the Accountability Principle under the DPA and its IRR, we remain accountable for personal data we transfer to our service providers, and we rely on those providers' own data protection terms and security commitments to require a comparable level of protection.

We may also disclose data if required by Philippine law or a valid legal order, or to protect the security of the App (e.g., sharing abuse logs with our hosting/security providers).

6. Data retention

We keep personal data for as long as your account is active, plus a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. Security/abuse logs (Section 3.5) do not yet have an automated deletion schedule and are currently kept indefinitely pending a formal retention policy — we intend to introduce a fixed automatic-deletion window for these logs and will update this section when we do. If you delete a project or your account, associated records are removed except where we are required to keep them (e.g., financial records for tax purposes), where already-shared public/quotation data has left our systems, or where a saved quotation revision snapshot (Section 3.2) preserves it as immutable version history short of deleting the whole project.

7. Security measures

We rely on our infrastructure providers' security controls (encryption in transit and at rest, access controls) and apply our own: row-level access control so only project members can see a project's data, admin-only access to security logs, automated blocking of common attack patterns, and account suspension for detected abuse. No system is 100% secure. If a breach involves sensitive personal information (such as your TIN) or data that could be used for identity fraud, and poses a real risk of serious harm, we will notify the NPC and affected users within 72 hours of becoming aware, per NPC Circular 16-03. For other breaches, we will notify affected users without undue delay.

8. Your rights under the Data Privacy Act

As a data subject, you have the right to:

1. Be informed that your personal data is being processed (this policy).
2. Access your personal data.
3. Object to processing, including processing for a new purpose.
4. Correct inaccurate or outdated data.
5. Erasure or blocking of your data, subject to our legal retention obligations. Note: a quotation revision you explicitly saved is kept as an immutable historical snapshot (Section 3.2) and can only be removed by deleting the entire project, not by editing or deleting a single revision.
6. Data portability — receive your data in an electronic format.
7. Damages for harm caused by inaccurate, unlawful, or unauthorized processing.
8. File a complaint with the National Privacy Commission (NPC), the Philippines' data protection authority — privacy.gov.ph.

To exercise any of these rights over your own account data, contact us at privacy@tantya.app. If you are a customer or worker whose data was entered by a contractor using Tantya, please contact that contractor first, since they control that data; we will assist them in fulfilling your request.

9. Children's privacy

Tantya is a business tool for construction contractors and is not directed at children. We do not knowingly collect personal data from anyone under 18.

10. Cookies and local storage

Tantya uses browser local storage and a service worker to let you keep working offline and to remember your session and language preference. We do not use third-party advertising cookies.

11. Changes to this policy

We may update this policy as the App evolves. We will post the updated version here with a new "Last updated" date, and for material changes, we will make reasonable efforts to notify account holders in-app.

12. Contact us

Questions, requests, or complaints about this policy: privacy@tantya.app

National Privacy Commission (Philippines): https://privacy.gov.ph