Privacy Policy

Walit is operated by Eight Summer LLC ("Walit", "we", "us"). This Privacy Policy explains how we collect, use, share, and protect information when you use our payment tracking and business management platform.

1. Who This Policy Covers

Walit is used by two groups of people, and this policy covers both:

• Businesses that sign up for Walit to track payments, customers, and finances.
• Customers of those businesses who open a payment link, upload a receipt, or whose details a business records in Walit.

If you are a customer of a business that uses Walit, that business controls the information it records about you. We process it on the business's behalf to provide the service. For questions about how your information is used, or to request a correction or deletion, contact the business first. You can also reach us at privacy@walit.io and we will help route your request.

2. Information We Collect

2.1 Information You Provide

• Account information: Name, email address, phone number, and password. If you sign in with Google, we receive your name and email from Google.
• Business information: Business name, address, business type, and the payment details you choose to show your customers (for example your GCash number or bank account details).
• Transaction records: Payment amounts, dates, statuses, invoices, and payment receipts uploaded by you or your customers.
• Customer information: Names, contact details, and payment history of your customers, as entered by you or by them through your payment links.
• Imported files: Files you upload for processing, such as marketplace order exports or receipt images.

2.2 Information Collected Automatically

• Device information: IP address, browser type, operating system, and device identifiers.
• Usage data: Pages viewed, features used, and interaction patterns. See Section 5.2 for what our analytics provider does and does not receive.
• Cookies: We use cookies that are necessary to keep you signed in and to secure your session, and our analytics provider stores an identifier in your browser so we can tell repeat visits apart. We do not use third-party advertising cookies, and we do not track you across other websites.

3. How We Use Your Information

• Provide, maintain, and improve the service
• Store and organize your payment records, customer records, and business finances
• Send payment reminders and notifications you or your customers have requested
• Read receipts and imported documents to extract payment details (see Section 4)
• Respond to support requests
• Detect, prevent, and address fraud, abuse, security issues, and technical problems
• Comply with legal obligations and enforce our Terms of Service
• Send product updates and marketing communications, which you can opt out of at any time

4. AI-Assisted Processing

Some features use artificial intelligence to save you manual typing. When a receipt image or an imported file (such as a marketplace order export) is uploaded, we send it to our AI provider, Anthropic, to extract details like the amount, date, and reference number, and to run automated checks against fraud. Our AI provider processes this data only to return the result and does not use it to train its models. Extracted results are always visible to you in your dashboard, and anything that does not pass the automated checks is held for your manual review.

5. How We Share Your Information

We never sell your data or your customers' data. We share information only in these cases:

5.1 Service Providers

We work with third-party providers who perform services on our behalf: cloud hosting and data storage, subscription billing (Stripe), email delivery, SMS delivery, AI document extraction (Anthropic), and product analytics (PostHog). These providers may only use your information to provide their service to us.

5.2 Product Analytics

We use PostHog to understand how Walit is used, so we can find where people get stuck and fix it. PostHog processes this data on servers in the United States. We send it no personal information at all, yours included:

• No names, no email addresses: You appear to our analytics as a random identifier and nothing else. Not your name, not your email address, not your phone number, not even your business name. Working out which merchant an identifier belongs to requires a look-up in our own database, which stays with us.
• What we do send: That random identifier, the kind of business you run, your country, your subscription plan, and a record of actions taken in Walit, such as creating an account, finishing setup, creating a payment link, or recording a payment.
• Nothing about your customers: No customer names, contact details, or payment history reach our analytics provider.
• No amounts: We do not send payment or revenue figures. Our analytics can tell us that a payment was recorded, never how much it was for.
• No private links: Payment, statement, invoice, and receipt pages are reachable through a secret link. We remove that secret from every web address before it is sent, so a link to your customer's payment page cannot escape through our analytics.
• No IP addresses: Our analytics provider is configured to discard the IP address your browser connects from. We already know which country your business is in, because you told us when you signed up, so there is nothing for it to add.
• No screen recording: We do not record your screen or your session, and we do not automatically capture what you click or type.

5.3 Legal Requirements

We may disclose information if required by law, court order, or a lawful request by a government authority, or to protect our rights, property, or the safety of our users.

5.4 Business Transfers

If Walit is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

6. Data Security

• All data is encrypted in transit (TLS) and at rest
• Personal information such as names and contact details is protected with an additional layer of field-level encryption in our database
• Access controls limit who inside our team can view data, and access is logged
• Walit never stores your customers' card numbers or e-wallet credentials, because payments happen outside Walit through your own accounts

No method of transmission or storage is 100% secure. We work hard to protect your information, but we cannot guarantee absolute security.

7. Data Retention and Account Deletion

We retain your information for as long as your account is active and as needed to provide the service, comply with legal obligations (such as record-keeping requirements), resolve disputes, and enforce our agreements.

You can delete your account at any time from Settings under Security. Deletion works like this:

• 30-day grace period: Your account is scheduled for deletion 30 days out. You keep full access during this time and can cancel the deletion at any point before that date. We email you when deletion is scheduled and again once it is complete.
• What we erase: On that date we permanently erase your personal details, including your name, email address, phone number, and any recovery or authentication data. This cannot be undone, and your email address becomes free to register again.
• What we keep: We retain transaction and billing records where the law requires us to, for example tax, accounting, and anti-money-laundering record-keeping. These records are no longer linked to your identity. Retention periods differ by country, and we keep these records only for as long as the applicable law requires.
• Your business: If you are the sole owner of a business, it is closed along with your account. If your business has other members, you will be asked to transfer ownership before you can delete.
• Your subscription: Any paid subscription stops renewing when you request deletion. You keep access for the period you have already paid for, and partial periods are not refunded.

If you only want to pause, you can deactivate your account instead. Deactivation is reversible and keeps your data.

8. Your Rights and Choices

Walit is built for businesses in the Philippines and we honor the rights granted by the Data Privacy Act of 2012 (Republic Act No. 10173), along with equivalent rights under other applicable laws:

• Access: Download a copy of the personal information we hold about you yourself from Settings under Security, or request a copy from us
• Correction: Update or correct inaccurate information
• Deletion: Delete your account yourself from Settings under Security, or request deletion of your information. See section 7 for how this works and what we are required to retain
• Portability: The same self-serve download provides your data in machine-readable JSON and CSV formats
• Objection: Object to certain processing, including direct marketing
• Complaint: Lodge a complaint with the National Privacy Commission or your local data protection authority

To exercise any of these rights, email us at privacy@walit.io.

9. International Data Transfers

Your information may be stored and processed on servers located outside your country of residence. Wherever your data is processed, we apply the safeguards described in this policy and require the same of our service providers.

10. Children's Privacy

Walit is not intended for individuals under the age of 18, and we do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us immediately.

11. Third-Party Links

The platform may contain links to third-party websites or services. We are not responsible for their privacy practices, and we encourage you to review their policies before providing any information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the "Last updated" date, and for material changes we will notify you by email or in the app. Your continued use of Walit after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us: