Privacy policy

Last updated October 27, 2026. This explains what Onsuki holds, where it comes from, why, who it passes through, how long it is kept, and what you can ask to be done with it.

1. Who is responsible for it

Onsuki is software that businesses use to take bookings and payments and keep their records. It is operated by Onsuki Software Development Services, a sole proprietorship of Paulina Mariae P. Labayo registered with the Bureau of Internal Revenue of the Philippines, of 23 Luskot St., Don Manuel, Quezon City 1113, Metro Manila, Philippines ("Onsuki" or "we"). A business that uses Onsuki decides what it records about its own customers and why. For those records the business is the personal information controller under the Data Privacy Act, and Onsuki processes them on its behalf and on its instructions. For the accounts of business owners and staff, for visitors to onsuki.com, and for Onsuki's own billing of businesses, Onsuki is the controller.

Each business has its own relationship with its customers and may have its own privacy policy. If you are a customer of a business, that business is responsible for telling you how it uses your data, and its policy applies alongside this one.

2. What is collected

For business staff: your name, email address and phone number if you give them, your role, and the sign-in codes, Google sign-in or Sign in with Apple that let you in. For a business: its name, locations, contact and billing details, and its Onsuki invoices and payments.

For customers: the name, contact details and date of birth the business records, the bookings made, the orders raised, the forms and waivers signed, and the receipt images uploaded against them. Many of the people in these records are children whose details a parent or guardian gave. A business can also record health information: the answers to its own intake forms and, where it turns on charting, treatment notes, a medical summary of allergies, medications and conditions, and clinical photos. The data processing agreement covers charting.

Where a business has its own booking chat, what a visitor types to it is collected to answer them. When you write to Onsuki, we keep the message and our reply.

3. Where it comes from

From you, when you sign up, book, fill in a form or write to us. From the business you deal with, which enters and imports its own records. From Google or Apple, if you sign in with them: your name and email address. And automatically, when you use Onsuki: server logs with your IP address, browser and the pages asked for, and error reports when something breaks. Error reports carry the page address with its query values stripped out, never the contents of a booking.

If you ask a business's page to find the location nearest you, your browser uses your device's location to sort the list. Your location stays on your device and is not sent to Onsuki.

4. What it is used for

Running the bookings and the payments, and sending sign-in codes by email. Emails about bookings and payments go to the people they concern: confirmations, reminders, receipts and cancellations, and, in a business's own mobile app, some of the same messages as notifications. Business owners also get emails about their account and their Onsuki invoices. These service messages are part of using Onsuki and are sent while an account or booking is active.

Onsuki also uses data to keep the service secure and to prevent fraud and abuse, to bill businesses, to answer support requests, and to meet its legal obligations. Nothing here is sold, and no record a business keeps is used for advertising.

Onsuki relies on these grounds under the Data Privacy Act: providing the service a business signed up for, the legal obligations that apply to it, and its legitimate interest in keeping the service secure and working. For a business's customer records, the business decides the grounds and Onsuki follows its instructions.

5. Statistics

Onsuki produces aggregated, de-identified statistics that identify no person and no business, and uses them to run and improve Onsuki. Chart contents are never used for statistics.

6. Who can see it

The staff of the business the record belongs to. Separation between businesses is enforced by the database rather than by application code, so one business cannot read another's records even if the software has a bug. Onsuki's own operator can reach the data where it is needed to run the service, fix a fault or answer a support request, and does not otherwise look at it.

Onsuki discloses data where the law, a court order or a government authority requires it, or where it is needed to protect someone's safety or to act against fraud or abuse. If Onsuki merges with or is acquired by another company, or sells this service, the data may pass to the new owner, who must keep the promises on this page.

7. Who else it passes through

Onsuki runs on services that hold data on its behalf, and they may use it only to provide the service to us: Cloudflare for hosting and file storage, Neon for the database, Resend for the emails the product sends, Sentry for error reports, PayMongo for businesses that take card and wallet payments, Google Firebase for notifications in a business's own mobile app, and OpenAI for businesses that turn on the assistant or the booking chat. What staff type to the assistant, and the client names, services, bookings, dates and balances it needs to answer, are sent to OpenAI to produce the reply. What a visitor types to a business's booking chat is sent to OpenAI to produce the answer. Phone numbers, emails and notes held in your records are not sent unless a staff member types them to the assistant. Charts are sent only at a business whose owner turns on Assistant can read charts: then the parts of a client's chart needed to answer a staff member's question are sent to OpenAI as well, and photographs and files are never sent. Nothing is sold, and no record a business keeps is shared for advertising. This list is kept current; a business is told before it changes.

A payment by bank transfer, QR Ph or e-wallet is made between you and the business, through your bank or e-wallet, under their own privacy policies. Google and Apple handle their own sign-in under theirs.

8. Where it is stored

Data is stored outside the Philippines: the database in Singapore, files in Cloudflare's Asia Pacific storage, and email sent from Tokyo. Some of the services above process data in other countries, whose privacy laws may differ from the Philippines'. Each is bound to protect it, and Onsuki stays responsible for it as the Data Privacy Act requires.

9. How long it is kept

Booking and payment records are kept while the business is using Onsuki, and after that for as long as tax law requires them to exist, or as long as needed to resolve a dispute or enforce an agreement. Sign-in codes are short-lived. Error reports and server logs are kept only as long as they are useful for finding a fault. When a business leaves and asks for deletion, records are removed except those that must be retained.

10. How it is protected

Each business's records are kept apart in the database, data is encrypted in transit and at rest, and access is limited to the people who need it. No way of sending or storing data is perfectly secure, and Onsuki cannot promise that it will never be reached without permission. If a breach affects personal data, Onsuki acts as the Data Privacy Act requires: it tells the business whose records are affected, and where the duty is Onsuki's, it notifies the National Privacy Commission and the people affected.

11. Cookies

Onsuki sets its own cookies and browser storage to keep you signed in, to hold a booking or a cart while you finish it, to remember a few choices, and to note for 30 days which site sent a visitor to a business's page, so the business can see where its bookings come from.

On onsuki.com, Onsuki keeps one cookie of its own that notes how you first and last arrived: the page you landed on, the site that sent you, and the campaign tags in the link. If you sign up or book a demo call, that note is saved with it, so we can tell which of our marketing works. It holds no name or contact details and lasts 180 days.

Also on onsuki.com, and only if you press Accept on the cookie notice, Onsuki loads Google Analytics and the Meta Pixel to count visits, sign-ups and demo calls and to measure and target its own ads; an ad's click identifier in the link is then kept in the note above too. Google and Meta handle that data under their own policies. If you press Decline, neither loads. To change your answer, clear this site's cookies and the notice asks again. Onsuki's dashboard and the businesses' booking pages never carry Onsuki's own analytics or advertising cookies.

A business may add its own Google Analytics or Meta Pixel to its page. Those load only after you agree on that page, are the business's choice, and are covered by the business's own policy and Google's or Meta's. You can also block or delete cookies in your browser, though signing in and booking need Onsuki's own.

12. Children

Onsuki's own accounts for business owners and staff are for adults. A child's details are in Onsuki only because a parent, guardian or the business entered them for a booking, and the parent or guardian can exercise the child's rights below. If you believe Onsuki holds a child's data that it should not, write to privacy@onsuki.com.

13. Your rights

Under the Data Privacy Act of 2012 you have the right to be informed about how your data is used, to ask what is held about you, to have it corrected, to object to how it is used, to have it blocked or erased, to ask for a copy in a portable form, to be paid damages for harm caused by misuse, and to complain to the National Privacy Commission. Where erasure applies and no record has to be kept for tax or another legal obligation, we act on it by hand rather than through a button in the product. If a business holds the record, ask the business first, because it is their record and they decide; Onsuki will help them act on it. Requests are answered at no cost and within a reasonable time. We may ask you to confirm who you are before acting on one.

14. Other sites and services

This policy covers Onsuki. It does not cover a business's own website, a site a business links to, or services run by others that you use alongside Onsuki, such as your bank, e-wallet, Google or Apple. Their own policies apply.

15. Changes to this policy

We may update this policy as Onsuki changes. The date at the top changes when we do, and we tell business owners about a change that matters.

16. How to reach us, and where to complain

Our data protection officer handles questions and requests about personal data, including the rights above. Write to privacy@onsuki.com, or by post to the Data Protection Officer, Onsuki Software Development Services, 23 Luskot St., Don Manuel, Quezon City 1113, Metro Manila, Philippines. If you are not satisfied with the answer, you may raise it with the National Privacy Commission at privacy.gov.ph.