Privacy Policy
Lunaxcode POS & Business Management System
Last updated: March 2026 · Governed by Republic Act No. 10173 (Data Privacy Act of 2012), Republic of the Philippines.
1. Introduction
1.1 About This Document
This Data Security & Privacy Policy ("Policy") describes how Lunaxcode ("we," "us," "our") collects, processes, stores, protects, and handles the personal and business data of our clients ("Tenants") and their customers and employees ("Data Subjects") through the Lunaxcode POS & Business Management System ("Platform").
This Policy applies to all Lunaxcode subscription tiers — Starter, Professional, and Business — and to all branches, including franchise branches, operating under a single Tenant account.
1.2 Our Commitment
Lunaxcode Data Promise
Your business data is yours. We do not sell it, share it with advertisers, or use it for any purpose other than delivering the Platform to you.
Every client's data is logically isolated from every other client's data — mathematically enforced at the database level.
We operate in full compliance with the Republic of the Philippines Data Privacy Act of 2012 (RA 10173) and align with international standards including SOC 2 Type II and ISO 27001.
1.3 Definitions
Tenant
A business entity (salon, spa, or clinic group) that subscribes to Lunaxcode. One Tenant may have multiple owned or franchise branches.
Branch
A physical location under a Tenant — classified as owned or franchise.
Franchisee
An individual or entity operating a franchise branch under the Tenant's account. A franchisee is not a separate Tenant.
Data Subject
Any individual whose personal data is processed — including Tenant staff, customers, and franchisees.
Personal Data
Any information that can identify a natural person, directly or in combination with other data.
Sensitive Personal Data
Government IDs (SSS, TIN, PhilHealth), health/skin records, financial account details.
Processing
Any operation performed on personal data — collection, storage, use, disclosure, deletion.
Platform
The Lunaxcode POS & Business Management System, including all modules and integrations.
RLS
Row Level Security — a PostgreSQL feature that enforces data isolation at the database level.
2. Data We Collect
2.1 Tenant Business Data
Data about the Tenant's business operations collected when setting up and using the Platform:
Data Category
Details
Business Information
Business name, address, branch locations, DTI registration number, TIN, BIR Authority to Print number, OR series.
Transaction Data
POS transactions, line items, payment methods, amounts, discounts, official receipt numbers, refunds, voids.
Inventory Data
Product catalog, stock levels, purchase orders, supplier records, stock movement history.
Financial Data
Shift reports, Z-reports, petty cash entries, revenue totals, commission computations.
Configuration Data
Business settings, receipt customization, loyalty program configuration, PayMongo API keys (encrypted).
2.2 Staff (Employee) Data
Personal data of employees and staff accounts within the Tenant's organization:
Data Type
Details
Identity
Full name, photo, position, hire date, mobile number, email address.
Government IDs
SSS number, PhilHealth number, Pag-IBIG number, TIN — collected for payroll compliance only.
Attendance Records
Clock-in/clock-out timestamps, GPS coordinates at check-in, selfie photos captured during attendance.
Commission & Payroll
Commission amounts per transaction, payroll runs, payslip data, deduction amounts.
Access Credentials
Email address for account login, 4-digit POS PIN (stored as bcrypt hash — never plain text).
Schedule Data
Assigned shifts, leave requests, overtime records.
2.3 Customer Data
Personal data of the Tenant's end customers, collected during service transactions or booking:
Data Type
Details
Identity
Name, mobile number, email address, birthday, address, profile photo.
Service History
Visit history, services availed, staff who performed services, transaction amounts.
Skin Profile (Clinics)
Skin type, concerns, allergies, contraindications, current medications, pregnancy status — collected only for skin clinic tenants.
Treatment Records
Treatment session notes, before/after photos, protocol used, practitioner notes.
Loyalty Data
Points balance, tier, points history, referral activity.
Payment History
Payment methods used (not card numbers — never stored), transaction totals, gift certificate usage.
2.4 Data We Do NOT Collect
What Lunaxcode Never Stores
Credit or debit card numbers — all card payments are handled by PayMongo (PCI-DSS Level 1 compliant). Card data never touches Lunaxcode servers.
GCash or Maya account credentials — payment links are generated via PayMongo API. We store only the PayMongo reference number and confirmation status.
Biometric fingerprint data — attendance uses PIN + selfie + GPS only. No biometric templates are captured or stored.
Plain text passwords or PINs — all credentials are hashed using bcrypt before storage.
3. Multi-Tenant Data Architecture & Isolation
3.1 How Multi-Tenancy Works
Lunaxcode operates as a multi-tenant SaaS platform. All Tenants share a single Supabase PostgreSQL database infrastructure. Data isolation between Tenants is enforced through Row Level Security (RLS) — a feature built into PostgreSQL at the database engine level.
This is the same architecture used by leading global SaaS platforms including Vercel, Linear, Notion, and GitHub. It is not a security compromise — it is the industry standard for scalable, secure SaaS.
3.2 Three-Layer Security Model
Data isolation is enforced by three independent security layers. All three layers must fail simultaneously for a breach — which is not possible in normal operation.
Layer
Protection Detail
Layer 1 JWT Authentication
Every API request carries a signed JSON Web Token (JWT) issued by Supabase Auth.
The JWT contains: userid, tenantid, branch_id, and role.
The token is cryptographically signed using a secret key held only by Supabase.
Forged or tampered tokens are rejected immediately.
Tokens expire every 1 hour — refresh tokens rotate on each use.
Layer 2 PostgreSQL RLS
Row Level Security policies live inside PostgreSQL itself — not in application code.
Every query against every table is automatically filtered to the current tenant_id.
This enforcement occurs even if application code contains a bug or is bypassed.
Example: A query for "all transactions" by Salon A returns only Salon A's rows. Salon B's data is physically invisible — not filtered in the application, but absent from the result set entirely.
RLS cannot be disabled by any API call or client request.
Layer 3 App Validation
All API routes read tenant_id exclusively from the verified JWT.
tenant_id is never accepted from the request body, URL parameters, or query strings.
A malicious actor cannot pass another tenant's ID to access their data — the server ignores any tenant_id in the request payload.
Branch-level scoping further restricts data access for Managers, Franchisees, and Staff.
3.3 Franchise Branch Isolation
Franchise branches are branches under a single Tenant account. A franchisee is given a staff account scoped to their branch only. They cannot access other branches' transactions, customers, staff records, or financial data.
Role
Data Access Scope
Tenant Owner (HQ)
Full visibility — all owned and franchise branches, consolidated reports.
Franchise Manager (HQ)
All franchise branches only — no owned branch data unless granted.
Franchisee Account
Their assigned branch only — zero access to other branches or HQ financials.
Branch Manager
Their single branch only.
Cashier / Staff
Transaction entry and own commission only.
3.4 Data Separation Guarantee
What This Means for Your Business
Salon A cannot see Salon B's customers, transactions, or staff — ever.
A franchisee cannot see another franchisee's sales or customer records.
Even if a Lunaxcode engineer ran a raw database query, they would see rows from all tenants — but those engineers are governed by strict NDAs and Supabase's SOC 2 Type II access controls.
No application bug, API misconfiguration, or user error can expose Tenant A's data to Tenant B. RLS enforces this at the database engine level.
4. Data Storage & Infrastructure
4.1 Infrastructure Providers
Provider
Role & Security
Supabase (Database + Auth + Storage)
PostgreSQL database — primary data store for all Tenant and customer data.
Supabase Auth — user authentication and JWT issuance.
Supabase Storage — encrypted file storage for receipts, product photos, before/after treatment photos, payslips, and staff selfie attendance photos.
Supabase Realtime — live dashboard updates (multi-terminal POS sync).
Certifications: SOC 2 Type II, ISO 27001.
Data center region: Southeast Asia (Singapore).
Vercel (Application Hosting)
Hosts the Next.js 16 frontend and API routes.
Edge Network serves content from the nearest region to the Philippines.
SSL/TLS enforced on all connections — no unencrypted traffic.
SLA: 99.99% uptime for frontend.
PayMongo (Payment Processing)
Processes all GCash, Maya, and credit/debit card transactions.
PCI-DSS Level 1 compliant — the highest level of card data security.
Card numbers and GCash credentials never transmitted to or stored by Lunaxcode.
Only PayMongo payment reference numbers and confirmation statuses are stored.
Semaphore PH (SMS)
Delivers SMS notifications: appointment reminders, receipts, alerts.
Philippine-based SMS provider.
Only mobile numbers and message content are transmitted — no financial data.
Resend (Email)
Delivers transactional emails: welcome, receipts, payslips, alerts.
SOC 2 Type II compliant.
No marketing emails without explicit opt-in.
4.2 Data Encryption
Data Type
Encryption Method
In Transit
All data transmitted between users and Lunaxcode is encrypted using TLS 1.2 or higher. HTTPS is enforced on all routes — no HTTP access is permitted.
At Rest
Supabase encrypts all data at rest using AES-256. Storage buckets (photos, receipts) are encrypted using AES-256.
API Keys
PayMongo and Semaphore API keys stored in tenant_settings are encrypted before storage. They are never exposed in API responses — only masked versions are shown in the UI.
Passwords & PINs
User passwords are managed by Supabase Auth (bcrypt). POS PINs are hashed using bcrypt before storage. Plain text credentials are never stored or logged.
Before/After Photos
Treatment photos are stored in a private Supabase Storage bucket. Access requires a time-limited signed URL (expires in 1 hour). Photos are never publicly accessible.
4.3 Backup & Retention
Item
Policy
Database Backups
Supabase Pro plan: daily automated backups with 7-day retention. Point-in-time recovery available.
File Storage Backups
Supabase Storage is replicated across multiple availability zones within the Singapore region.
Transaction Logs
All POS transactions, stock movements, and audit logs are append-only records. They are retained for the lifetime of the Tenant's account plus 3 years after account closure.
Attendance Photos
Selfie attendance photos are retained for 12 months then automatically deleted, unless the Tenant sets a longer retention period.
5. Data Subject Rights — RA 10173 Compliance
Lunaxcode operates in compliance with the Republic of the Philippines Data Privacy Act of 2012 (Republic Act No. 10173) and the rules and regulations issued by the National Privacy Commission (NPC). The following rights are available to all Data Subjects — including Tenant staff and end customers.
Right
How Lunaxcode Implements It
Right to Be Informed
Data Subjects are informed of what data is collected, why, and how it is used — as described in this Policy and in the in-app privacy notice shown during onboarding and customer data capture.
Right to Access
Data Subjects may request a copy of their personal data held by Lunaxcode or by their Tenant. Tenants can export customer and staff data in JSON or PDF format within 5 business days.
Right to Rectification
Data Subjects may request correction of inaccurate personal data at any time through their Tenant's account or directly through Lunaxcode support.
Right to Erasure
Data Subjects may request deletion of their personal data. Lunaxcode will anonymize or delete the requested data within 30 days, subject to legal retention requirements (e.g., BIR transaction records must be retained for 10 years under Philippine law).
Right to Object
Data Subjects may object to the processing of their personal data for marketing or non-essential purposes. Loyalty program participation and marketing SMS are opt-in only.
Right to Data Portability
Tenants may request a full export of their business data in machine-readable format (JSON/CSV) upon account closure or upon request.
Right to Lodge a Complaint
Data Subjects may lodge complaints with the National Privacy Commission (privacy.gov.ph) if they believe their rights have been violated.
5.1 How to Exercise Your Rights
Data Subjects may exercise their rights through any of the following channels:
Email: privacy@lunaxcode.com — response within 5 business days
In-app: Settings → Privacy → Data Request (for Tenant owners)
WhatsApp support: available within the Lunaxcode app
Lunaxcode will verify the identity of the requestor before processing any data access, correction, or deletion request.
6. How We Use & Share Data
6.1 How Lunaxcode Uses Data
Purpose
Description
Platform Delivery
To operate the POS, inventory, appointment, payroll, and all other modules as subscribed by the Tenant.
BIR Compliance
To generate BIR-formatted Official Receipts, sales summaries, and tax reports on behalf of the Tenant. Data is used only within the Tenant's account — not aggregated across tenants.
SMS & Email Notifications
To send appointment reminders, digital receipts, low-stock alerts, and system notifications. Marketing messages are only sent with explicit opt-in.
Support
To diagnose and resolve technical issues reported by Tenants. Support access to Tenant data is logged and requires explicit Tenant permission.
Security
To detect and prevent unauthorized access, fraud, and abuse of the Platform.
Product Improvement
Aggregated, anonymized usage patterns (e.g., most-used features) may be used to improve the Platform. No individual Tenant data or customer data is used without explicit consent.
6.2 Data Sharing — What We Share and With Whom
Recipient
What Is Shared & Why
PayMongo
Transaction amounts and customer mobile numbers are shared to generate payment links. No card numbers or account credentials are ever shared with Lunaxcode from PayMongo.
Semaphore PH
Customer or staff mobile numbers and message content are transmitted for SMS delivery only.
Resend
Customer or staff email addresses and email content are transmitted for email delivery only.
Supabase
All Platform data is stored on Supabase infrastructure. Supabase processes data as a data processor under Lunaxcode's instruction, governed by their DPA and SOC 2 obligations.
Google Gemini (Phase 3)
Aggregated, anonymized business metrics (sales trends, inventory patterns) may be sent to Google Gemini API for AI insights generation. No customer names, IDs, or contact details are transmitted to Gemini.
Law Enforcement
Lunaxcode may disclose data when required by valid Philippine court order, subpoena, or NPC directive. Tenants will be notified unless legally prohibited from doing so.
6.3 What Lunaxcode Does NOT Do
We Will Never:
Sell your business data, customer lists, or employee records to any third party.
Share your data with advertisers or allow third-party advertising targeting.
Use one Tenant's data to train AI models without explicit written consent.
Access your account or data without your permission, except for security incident response.
Retain data beyond the periods specified in this Policy.
7. Security Controls & Audit
7.1 Access Controls
Control
Description
Role-Based Access Control
Five access levels (Owner, Manager, Cashier, Staff, View-only) enforce the principle of least privilege. Each role can only access the data and functions required for their job.
Branch Scoping
Branch Managers and Franchisees are scoped to their assigned branch at the database level — not just the UI.
Session Management
JWT tokens expire every 1 hour. Refresh tokens rotate on each use. Simultaneous sessions are tracked and can be revoked by the Owner.
POS PIN
Cashier POS access requires a 4-digit PIN, hashed with bcrypt. PINs can be reset by the Owner or Manager at any time.
Failed Login
Repeated failed login attempts trigger a temporary lockout. Owners are notified of suspicious access patterns.
7.2 Audit Logging
Lunaxcode maintains an append-only audit log for all security-sensitive operations:
Every void transaction — logged with cashier ID, timestamp, reason, and manager who approved
Every manual stock adjustment — logged with staff ID, quantity change, reason
Every discount above threshold — logged with approving manager
Every staff login and clock-in — logged with timestamp and GPS coordinates
Every data export request — logged with requestor ID and timestamp
Every settings change (PayMongo keys, OR series, loyalty config) — logged with user and timestamp
Audit logs cannot be deleted or modified by any Tenant user, including the Owner. They are retained for the lifetime of the account plus 3 years.
7.3 Infrastructure Security Certifications
Standard
Coverage
SOC 2 Type II
Supabase holds SOC 2 Type II certification — independently audited security, availability, and confidentiality controls. Audit reports available at supabase.com/security.
ISO 27001
Supabase is ISO 27001 certified — the international standard for information security management systems.
PCI-DSS Level 1
PayMongo holds PCI-DSS Level 1 certification — the highest level of payment card data security compliance.
HTTPS / TLS
All connections to Lunaxcode are encrypted using TLS 1.2 or higher. Managed by Vercel with automatic certificate renewal.
AES-256 Encryption
All data at rest in Supabase (database and storage) is encrypted using AES-256.
7.4 Incident Response
In the event of a data security incident affecting personal data:
Lunaxcode will investigate and contain the incident within 24 hours of detection.
Affected Tenants will be notified within 72 hours of confirmation — in compliance with NPC Circular 16-03.
A written incident report will be submitted to the National Privacy Commission within the required timeframe.
Affected Data Subjects will be notified if their personal data was compromised, including the nature of the breach and recommended actions.
8. Tenant Responsibilities
Lunaxcode provides a secure platform. However, Tenants share responsibility for the protection of data within their account. By subscribing to Lunaxcode, Tenants agree to:
Responsibility
Expected Action
Access Management
Assign appropriate roles to staff. Remove access immediately when staff leave. Do not share login credentials between multiple people.
PIN Security
Ensure POS PINs are not shared publicly. Reset PINs when a staff member with POS access leaves the organization.
Customer Consent
Obtain appropriate consent from customers before capturing personal data, especially sensitive data such as skin profiles, treatment records, and before/after photos.
Data Accuracy
Maintain accurate employee records including government ID numbers used for payroll compliance.
Incident Reporting
Report suspected unauthorized access or data breaches to Lunaxcode immediately at privacy@lunaxcode.com.
Device Security
Ensure POS devices (tablets, laptops) are password-protected and not left unattended while logged into the Lunaxcode POS.
Franchisee Access
Ensure franchisee accounts are deactivated immediately upon contract termination. Franchisees' access is scoped to their branch — but Tenant Owners are responsible for managing their accounts.
9. Data Processing Agreement (DPA) Summary
For Tenants who require a formal Data Processing Agreement — particularly those subject to enterprise compliance requirements or audit requirements — Lunaxcode provides a signed DPA upon request. The DPA governs the relationship between Lunaxcode (as Data Processor) and the Tenant (as Data Controller) under RA 10173.
9.1 DPA Key Terms
Term
Description
Data Controller
The Tenant — the business entity that determines the purpose and means of processing personal data.
Data Processor
Lunaxcode — processes personal data on behalf of the Tenant as instructed by the subscription and this Policy.
Processing Purpose
Delivery of POS, inventory, appointment, payroll, and related business management services as subscribed.
Data Retention
Lunaxcode retains Tenant data for the duration of the active subscription plus 90 days after account closure, unless an earlier deletion is requested. BIR-related transaction records are retained for 10 years as required by Philippine tax law.
Sub-Processors
Supabase, PayMongo, Semaphore PH, Resend, Vercel. All sub-processors are bound by data processing agreements and security standards.
Data Transfer
Data is stored in Supabase's Singapore data center (Southeast Asia region). No cross-border transfers to jurisdictions with lower data protection standards without appropriate safeguards.
To request a signed DPA, email privacy@lunaxcode.com with subject: "DPA Request — [Your Business Name]"
10. Policy Updates & Contact
10.1 Policy Updates
Lunaxcode may update this Policy from time to time to reflect changes in technology, legal requirements, or business practices. When material changes are made:
Tenants will be notified by email at least 14 days before the changes take effect.
A notification will appear in the Lunaxcode dashboard.
Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.
Previous versions of this Policy are available upon request.
10.2 Contact Information
Data Privacy Officer
Lunaxcode (Sole Proprietor)
privacy@lunaxcode.com
WhatsApp Support
Available in-app (Settings → Help)
Response Time
Within 5 business days for privacy requests
NPC Contact
National Privacy Commission — privacy.gov.ph | complaints@privacy.gov.ph
10.3 Revision History
Version
Changes
v1.0 — March 2026
Initial policy — covers multi-tenant architecture, 3-layer RLS security, RA 10173 compliance, franchise branch model, infrastructure certifications.
This document is confidential and intended for Lunaxcode clients and prospective clients only. © 2026 Lunaxcode. All rights reserved.
Version 1.0 · Last updated July 16, 2026