Privacy notice
Draft of November 4, 2026
Kinora is an HR platform for Philippine businesses, operated by [LEGAL ENTITY]. This notice explains what personal data Kinora processes, why, and your rights under the Data Privacy Act of 2012 (Republic Act No. 10173).
Who is responsible for your data
- Employee records: your employer decides what is recorded about its people, and is the personal information controller. Kinora processes those records on your employer's instructions, as a personal information processor.
- Accounts on this site: Kinora is the controller of the details needed to run your account, such as your sign-in email, and of its own product usage records.
What we process
- Account: name, work email, role, and sign-in activity.
- Employment: employee number, name, contact details, date of birth, sex, civil status, emergency contact, hire and separation dates, branch, department, position, reporting line and schedule.
- Government IDs and bank details: SSS, PhilHealth, Pag-IBIG and TIN numbers, and bank account details. These are encrypted before they are stored and masked on screen by default.
- Attendance, leave and requests: attendance records, exceptions and corrections, leave balances and requests (including reasons), certificate requests and approvals.
- Payroll: attendance exports, payroll registers your employer imports, differences found when comparing them, adjustments, and payslips.
- Documents: files your employer stores, such as contracts and IDs.
- Kinora AI: questions you ask, the records looked up to answer them, and the answers.
- Feedback: messages and screenshots you send us, with the page and your role.
- Product events: records of steps completed, such as an import finishing, with counts but no names, used to measure how well Kinora works.
- Audit log: who changed or viewed sensitive records, and when.
Why, and our legal basis
We process this data to provide HR operations for your employer, to keep it secure, and to improve Kinora. The legal bases, under Sections 12 and 13 of the Act, are: the contract between Kinora and your employer, and your employment contract; your employer's legal obligations under labor and social legislation; legitimate interests, such as security and product improvement; and consent where the law requires it. [LAWYER TO CONFIRM EACH BASIS]
How long we keep it
| Data | Kept for |
|---|---|
| Personal data and documents of former employees | Deleted automatically after the period your employer sets: 90 days by default, and at least 90 days. The employment record and audit log are kept. [LAWYER TO CONFIRM AGAINST LABOR AND TAX RECORD-KEEPING RULES] |
| What was asked and answered in each AI request, as recorded by the server | 90 days. Token and cost figures are kept |
| Ask Kinora conversations | 12 months after last use. You can delete yours sooner |
| Notifications | 12 months |
| Product events | 12 months |
| Other records, including the audit log and feedback | [RETENTION PERIOD TO BE SET]. They have no automatic deletion yet |
Kinora AI
When you use Kinora AI, your question and the records needed to answer it are sent to Anthropic, our AI provider, which processes them on our behalf. Its lookups never include pay amounts, government IDs, bank details or home addresses, but anything you type yourself is sent, so please leave those out. The AI explains and prepares; it doesn't approve or file anything. Nobody at your company can read what you asked, including its owner. They can see that you used AI, and what it cost.
Who else processes data
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in and file storage | Singapore |
| Vercel | Hosting | Singapore [CONFIRM] |
| Anthropic | Kinora AI | [CONFIRM] |
| Brevo | Email delivery | [CONFIRM] |
| Cloudflare | Turnstile bot protection on sign-in, sign-up and password reset forms | [CONFIRM] |
| Sentry | Error monitoring, with personal data removed before sending | [CONFIRM] |
Some of these transfer data outside the Philippines. [LAWYER TO REVIEW]
Your rights
Under the Act you have the right to be informed, to object, to access your data, to have it corrected, to have it erased or blocked, to data portability, to damages, and to file a complaint with the National Privacy Commission. For employee records, contact your employer's HR team first, since your employer decides what is recorded.
Contact
Data protection officer: [PRIVACY CONTACT]