01Who we are
Kaha is a voice-first point of sale and inventory app for small stores in the Philippines. In this policy “Kaha”, “we” and “us” mean the team that builds and runs the Kaha app and this website. We are the personal information controller for the data described here.
This policy covers the Kaha Android app, this website and the beta program. It is written to meet the Philippine Data Privacy Act of 2012 (Republic Act 10173).
02What stays on your phone
Kaha is local-first. Your store lives in a database on your phone, and the app works without a connection. This stays on your phone unless you choose to send it:
- Your store: products, prices, stock, sales, utang records, customers’ names you type, reminders, receipts and settings.
- Photos: product photos you take or pick.
- Your PIN: the hash is kept in the phone’s secure storage and never leaves it. We cannot see or reset it.
- Your own OpenAI key, if you use one: kept in the phone’s secure storage and sent only to OpenAI.
- Problem reports: saved on the phone. They go nowhere until you press send and pick where.
Kaha has no ads, no ad trackers and no analytics SDKs. We do not sell your data.
03What leaves your phone, and when
Voice
When you hold the mic, your phone’s speech recognizer (on most Android phones, Google’s) turns what you say into text. Depending on the phone and the language pack installed, that audio may be processed by Google. Kaha does not record or store your voice.
Kaha AI
Kaha AI is optional. When you ask it something, Kaha sends OpenAI:
- what you said or typed and the conversation so far,
- the results of store lookups Kaha runs to answer you (for example today’s sales or a product’s stock), and
- a photo, only when you attach one.
It goes directly from your phone to OpenAI with your own key, or through Kaha’s service when you sign in with Google to use Kaha’s hosted AI. We ask OpenAI not to store it (store: false), and under OpenAI’s API terms it is not used to train their models. Kaha AI only answers about your store and the app.
Hosted AI account
If you use Kaha’s hosted AI, we keep your Google account email and ID, your time zone, your plan, and a usage record for each turn (the time, how many credits it cost and token counts). We do not keep the text of your conversations on our servers; threads stay on your phone.
Backups
Kaha writes a snapshot of your store when the app goes to the background. On Android, Auto Backup can copy that snapshot to your own Google account. That copy is yours and is handled by Google. You can also save a copy yourself through the share sheet.
This website
- Beta list: the email you enter, where on the site you entered it, and your browser’s user agent.
- Help and bug reports: your message, the kind of message, and the name and email if you leave them.
- The live demo: what you type runs in your browser. If you use the mic there, your browser’s speech service handles it.
The site sets no cookies and has no analytics.
04Who processes data for us
| Provider | What for | Data |
|---|---|---|
| OpenAI | Answering Kaha AI questions and reading photos | Your message, store lookup results, photos you attach |
| Supabase | Hosted AI accounts, beta list, help messages | Email and account ID, usage records, messages you send us |
| Sign-in, speech recognition, Auto Backup | Your Google account details, speech audio, your backup copy |
05How long we keep it
- Your store data: on your phone until you delete it or uninstall the app. We do not hold a copy.
- Hosted AI account and usage: until you ask us to delete your account.
- Beta list emails and help messages: until you ask us to delete them, or until the beta ends.
06Your choices and rights
Under the Data Privacy Act you can ask to know what we hold about you, correct it, object to its use, and have it deleted or blocked. In practice:
- Delete your store: More → Backup and data → Clear all store data. This removes everything on the phone.
- Turn AI off: don’t add a key and don’t sign in; Kaha works fully without it.
- Delete what we hold: send a request from the Support page from the email you used and we will delete your hosted account, beta list entry and messages.
You can also complain to the National Privacy Commission of the Philippines.
07How we protect it
Data in transit uses HTTPS. The tables that hold beta list and support messages cannot be read from the public internet, and the credit and usage records can only be changed by our server. On your phone, the PIN and any AI key sit in the operating system’s secure storage. No system is perfectly safe, so keep your phone’s own lock on and keep a backup copy of your store.
08Age
Kaha is built for people running a store. It is not meant for children under 13 and we do not knowingly collect their data.
09Changes to this policy
When we change this policy we will update the date at the top. If a change affects what you have agreed to, we will say so in the app before it applies.
10Contact
Questions, requests or complaints about privacy: use the Support page. See also the Terms.