Privacy Policy

Freelance Prime (“we”, “us”) is the controller of the personal data you provide when you use the Service. For privacy questions or to exercise your rights, contact our Data Protection Officer at dpo@freelanceprime.online or support@freelanceprime.online. We process personal data in accordance with the Philippines Data Privacy Act of 2012 (RA 10173) and the rules of the National Privacy Commission (NPC), and, where applicable, the EU GDPR and California CCPA/CPRA.

We collect:

• Personal data: your name, email address, profile details (role, bio, skills, links), and country/timezone.
• Payment details you choose to save so they can appear on invoices you send, which can include an account holder and bank name, a BSB and account number, a PayID, an IBAN, a SWIFT/BIC, a sort code or routing number, and payment handles (e.g. PayPal/Wise usernames).
• Business data you enter: clients, projects, invoices, tasks, and obligation records, which may include sensitive personal information of third parties that you provide.
• Subscription data we receive from our payment provider when you subscribe: a customer and subscription reference, your plan, your renewal and end dates, and your card’s brand and last four digits. We never receive or store your full card number.
• Technical data: device, browser, IP-based country, and usage logs.

We do not intentionally collect government ID numbers; please do not upload them unless a feature explicitly requests it.

We process personal data on these bases: (a) performance of our contract with you, to provide the Service; (b) your consent, e.g. for newsletters or optional features; (c) compliance with legal obligations; and (d) our legitimate interests in securing, maintaining, and improving the Service, balanced against your rights. You may withdraw consent at any time without affecting prior processing.

To create and operate your account, provide and personalize features, calculate estimates and reminders, process and generate invoices, provide support, secure the Service and prevent abuse, comply with law, and (only where you have opted in) send product updates. We do not use your business records for advertising and we do not sell your personal information.

We do not sell or rent your personal information. We share data only with service providers (subprocessors) that help us run the Service, under appropriate data-protection agreements. They are:

• Supabase: database, authentication and file storage.
• Vercel: hosting and privacy-friendly page analytics.
• Google: the AI features that generate optional drafts, and the web fonts used by invoice templates.
• Lemon Squeezy: payments.
• Cloudflare: the Turnstile challenge that protects our signup, login, password and contact forms from bots. It sees your IP address and browser signals.
• Our email automation provider: it receives the recipient address, subject and body of account, billing and report emails.
• An exchange-rate service: it supplies the currency conversion rates shown in the app.

Lemon Squeezy is our merchant of record: when you subscribe you complete the purchase on their hosted checkout, they process your payment details, they issue the receipt and handle any sales tax or VAT, and they send us a subscription record that we store, including the full event payload they send us. We may also disclose data where required by law or to protect rights and safety. A current list of subprocessors is available on request.

Your data may be processed in countries other than your own. Where personal data is transferred across borders, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms recognized under the GDPR and the NPC’s cross-border rules to ensure a comparable level of protection.

We keep personal data only for as long as needed to provide the Service and to meet legal, tax, or accounting requirements, after which it is securely deleted or anonymized using industry-standard methods. You can delete most records yourself at any time; deleting your account triggers deletion or anonymization of your personal data, subject to limited legally required retention. One record is kept deliberately: the log of payment events received from our payment provider stays, with your account reference removed, because it is what stops a repeated payment notification from being processed twice.

We apply technical and organizational measures including encryption in transit, row-level access controls, authentication safeguards (including optional multi-factor authentication), and rate limiting. No system is perfectly secure, but we work to protect your data and to detect and respond to incidents.

We use strictly necessary cookies for authentication and security, and minimal preference cookies (such as your theme and detected country) to operate the Service. Cloudflare’s bot challenge sets its own cookie on the pages that use it, and our payment provider’s hosted checkout sets its own cookies while you are on it. We use privacy-friendly page analytics that do not build a profile of you across sites, and we do not use third-party advertising trackers. You can control cookies in your browser; disabling necessary cookies may break core functionality.

Subject to applicable law, you have the right to be informed; to access a copy of your data; to rectify inaccurate data; to erase, block, or suspend processing; to data portability in a structured, machine-readable format; to object to or restrict certain processing (including automated profiling); and, for California residents, to opt out of any “sale” or “sharing” of personal information and to non-discrimination for exercising your rights. Under RA 10173 you also have a right to damages for harm from unlawful processing. To exercise any right, email dpo@freelanceprime.online.

If a personal data breach is likely to result in serious harm, we are committed to notifying the relevant supervisory authority (such as the NPC or applicable EU authority) and affected users without undue delay and, where required, within 72 hours of becoming aware of it.

The Service is not intended for anyone under 18, and we do not knowingly collect their personal data. If you believe a minor has provided us data, contact us and we will delete it.

You may lodge a complaint with the National Privacy Commission (privacy.gov.ph) or your local data-protection authority. We may update this Policy and will revise the “Last updated” date and give notice of material changes. For any privacy request, contact dpo@freelanceprime.online.