Iskana Privacy Policy

Version 1.0 Effective date: October 13, 2026 Last updated: October 13, 2026

1. Introduction

Iskana ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect when you use the Iskana mobile application ("App") and the website iskana.app, how we use it, who we share it with, and your rights as a data subject under Philippine law.

This Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations ("IRR"), as administered by the National Privacy Commission ("NPC") of the Philippines.

If you are a grocery store or supermarket using the Grocerwise business platform, please refer to the separate Grocerwise Privacy Policy at grocerwise.ph/privacy.

2. Who This Policy Applies To

This Privacy Policy applies to everyone who uses the Iskana mobile app or the account pages on iskana.app.

3. Personal Information We Collect

3.1 Information you provide

3.2 Information collected automatically

We do not use analytics or advertising tools, and we do not track which screens you view.

3.3 Location information

Finding nearby stores. When you tap Find nearby stores, the App reads your device's location once and sends those coordinates directly to Grocerwise, the store platform that provides Iskana's store and product information (see Section 6.2), to get a list of nearby stores. The request identifies you only by a random code, not by your name or email. Grocerwise uses the coordinates to answer that request and does not store them. Iskana's own servers never receive your location.

Downloading products near stores (optional, off by default; currently on iPhone only). If you turn this on in Profile → Location and allow "Always" location access, the App sends your current coordinates to Grocerwise to find the nearest participating stores (up to 20). It then asks your phone's operating system to tell it when you come within about 2 kilometres of one of them. It checks again, and sends your coordinates again, when you open the App after moving about 5 kilometres. When you come near a store, the App downloads that store's product list from Grocerwise, so scanning works even with a weak signal. That download does not include your coordinates, but it does tell Grocerwise, under your random code, that your device asked for that store's list at that time. Iskana's servers record only whether this setting is on or off. Your phone keeps the last position it used, so it can tell when you have moved.

You may turn off location access at any time in your device settings, or turn off "Download products near stores" in Profile → Location, which stops the monitoring and deletes the stored position from your phone. You can always choose a store manually instead.

3.4 Receipt photos

When you submit a receipt photo for Points verification, the image is uploaded to our servers and sent to our AI provider, which reads the total, the store name and the date printed on the receipt. Receipt photos are:

• Deleted automatically ninety (90) days after upload, or straight away if you delete your Account;
• Used only to verify your trip for Points: to check the total and the store against your trip, to detect duplicate or altered receipts, and, if a trip is flagged or the photo could not be read, for review by authorised Iskana staff. Every staff view is logged; and
• Not shared with the store or with Grocerwise. They are stored by our storage provider (Cloudflare) and read by our AI provider (OpenAI), both acting only on our instructions.

The details read from the receipt (total, store name, date, and how closely they matched your trip) stay with the trip in your history until you delete your Account.

Please photograph only the receipt. Anything printed on it, such as a member name or the last digits of a card, is part of the image we store and send to our AI provider.

3.5 Reading a barcode from a photo

If a barcode cannot be scanned, you can type its digits or choose a photo of it from your phone. A photo you choose is read on your phone: the digits are taken either from the barcode's bars or, when those cannot be read, from the barcode number printed beside them, and the image is never uploaded to us or to anyone else. Only those digits are sent, in the same price lookup a camera scan makes (Section 6.2). We do not keep the photo, and we never look at any other photo in your library.

3.6 Information we do not collect

• Payment card or bank details. There are no in-app purchases yet; when Iskana Pro goes on sale, payment will be handled entirely by Apple or Google
• Bank account or e-wallet transaction data
• Contacts, or other data from your device beyond what you explicitly submit. The App uses the camera to scan barcodes and photograph receipts. It opens your photo library only when you choose a photo to read a barcode from (Section 3.5); it never browses your photos, and that photo is not uploaded
• Audio recordings
• Advertising identifiers

4. How We Use Your Personal Information

We do not use your personal information for advertising, and we do not sell it.

5. AI Processing

The App uses an AI service provided by OpenAI for one feature:

We ask for your permission before your first receipt photo is read, and nothing is sent to OpenAI without it. You can withdraw it at any time in Profile → Privacy; receipts then can't be verified, and everything else keeps working. We do not send your name, email, account ID or location to OpenAI, except anything printed on the receipt itself. OpenAI does not use data sent through its API to train its models, and it may keep requests for up to thirty (30) days to monitor for abuse before deleting them.

Other AI features (product information, spending insights, the Iska companion) are not yet available. We will update this section before any of them launches.

6. Information We Share

We do not sell your personal information. We share it only as follows.

6.1 Service providers

Providers may process data only to provide their services to us.

6.2 Grocerwise

Iskana gets its store, product and price information from Grocerwise, a separate grocery store platform operated by the same owner as Iskana. Grocerwise has its own database, its own customers — the stores themselves — and its own privacy policy, and it uses what we send it for its own purpose: giving stores statistics about shopping at their branches. Because one person operates both, Iskana and Grocerwise are a single personal information controller under the DPA, so your information is not passing to a different company. If that ownership ever changes, we will update this Policy before it does. To provide the App, the App and our servers send Grocerwise:

• your location when you search for nearby stores or turn on near-store downloads (Section 3.3), which Grocerwise does not store;
• the store names you search for, the barcodes you scan and the store you are in;
• requests for a store's product list; and
• a report of each trip: the store, when it started and finished, whether it was finished, the number of items, how many you typed in by hand, the total, and any barcodes you scanned while offline.

None of this includes your name, email or Iskana account ID. Instead, it carries a random code that Grocerwise uses to limit request rates and to count how many different and returning shoppers a store has. Grocerwise shows stores only anonymous trip statistics and never shows them your code. Grocerwise also sees your device's IP address when the App contacts it directly.

When you delete your Account, we tell Grocerwise to remove your code from every trip it holds. The trip statistics remain, with nothing linking them to you. If you discard a trip, Grocerwise still knows a trip was started.

6.3 Aggregated and anonymized data

We may share aggregated, anonymized or de-identified data (for example, "the average basket size for shoppers in Cebu City is ₱850") with third parties for research or business purposes. This data cannot be used to identify you, and is separate from the trip reports described in Section 6.2.

6.4 Legal requirements

We may disclose personal information if required by law, court order, or government authority.

6.5 Business transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity under equivalent privacy protections, and you will be notified.

7. Storage on Your Device

The App stores on your phone: your basic profile (name, email, plan), the trip in progress and any trip updates waiting for a connection, your settings, store product lists you have downloaded, and, if near-store downloads are on, the last location used to choose nearby stores. Sign-in tokens are kept in your phone's secure storage (iOS Keychain / Android Keystore).

This data is not accessible to other apps. Signing out removes everything except downloaded store product lists, which contain no personal data. Uninstalling the App, or clearing its data in your device settings, removes everything.

The iskana.app website does not use cookies or keep you signed in.

8. Cross-Border Data Transfers

Iskana is operated from the Philippines. Some of our service providers process data in other countries, including the United States. We ensure that cross-border transfers comply with the DPA and NPC Circular No. 16-01.

9. Data Retention

When you delete your Account — in the App (Profile → Delete account) or at iskana.app/delete-account — we immediately delete your account, trips, receipt details, Points and budgets, delete your receipt photos, and ask Grocerwise to remove your random code from its trip records. This is completed within thirty (30) days at the latest.

Some records remain after deletion: a log of any actions Iskana staff took on your account (without your name or email), kept for security and accountability; our record of trip reports already sent to Grocerwise, which carry only the random code; anonymous trip statistics held by Grocerwise; crash reports held by Sentry until they expire; our hosting providers' access logs, which record the IP address your device connected from and which those providers delete on their own schedule rather than ours; and copies in our encrypted backups for up to twelve (12) months until those backups are overwritten. Backups are used only to restore our systems after a failure; they are not used to reactivate your Account or for any other purpose.

10. Data Security

We protect your personal information using the following measures:

• All data transmitted between the App, the website and our servers is encrypted using TLS/HTTPS
• Passwords are stored only as Argon2id hashes — we cannot see your password
• Sign-in uses short-lived access tokens and refresh tokens that change on every use, kept in your phone's secure storage (iOS Keychain / Android Keystore)
• Receipt photos are stored in a private cloud bucket — not publicly accessible. Staff can open a receipt only through a link that expires after five minutes, and every view is logged
• Role-based access controls restrict who at Iskana can access your data
• Dependency updates and security reviews
• Fraud monitoring for Points abuse

If we detect a personal data breach that is likely to cause harm, we will notify the NPC within seventy-two (72) hours and notify you without undue delay.

11. Age Restriction and Children's Privacy

The App is intended solely for users 18 years of age and older. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. We ask you to confirm that you are 18 or older when you create an Account. If we learn that we have collected personal information from someone under 18, we will delete it and close the Account promptly. If you believe a child has provided us with personal information, contact us at support@iskana.app.

12. Your Rights Under the Data Privacy Act

As a data subject, you have the following rights under the DPA:

To exercise any of these rights, contact:

Email: support@iskana.app Subject line: "Data Privacy Request — Iskana"

We will respond within fifteen (15) working days. We may verify your identity before processing your request.

13. Data Protection Officer

Iskana has designated a Data Protection Officer (DPO) to oversee compliance with the DPA.

Data Protection Officer Iskana Email: support@iskana.app

14. Third-Party Links and Services

The App and website may include links to third-party websites or services, such as store websites. This Privacy Policy does not apply to those third-party services. We encourage you to review their privacy policies before providing any personal information.

15. Changes to This Policy

We may update this Privacy Policy as the App evolves. We will notify you of material changes through the App or by email at least fourteen (14) days before changes take effect. The current version of this Policy is always available in the App under Profile → Privacy and at iskana.app/privacy.

16. Contact Us

If you have questions or concerns about this Privacy Policy or how we handle your personal information:

Iskana Email: support@iskana.app Website: iskana.app/privacy National Privacy Commission: www.privacy.gov.ph

This Privacy Policy was last updated on October 13, 2026. Version 1.0.