Skip to content
← Back to Home
Data Privacy

Privacy Policy & Data Protection

Last updated: September 2026

ZupCore is committed to protecting your personal data, financial records, and privacy. This Privacy Policy details our practices regarding the collection, processing, protection, and retention of your information in strict accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA).

1. Information We Collect

We collect user-provided information necessary to deliver tracking calculations, compensation vouchers, and payroll functions, including:

  • Personal details: Full legal name, email address, role, and organization affiliations.
  • Financial & tracking records: Self-reported salary, hourly rates, income entries, currency conversions, and attendance dates.
  • Technical and authentication metrics: IP address, user agent, session timestamps, and encrypted two-factor authentication secrets.

2. How We Process Your Data

Your data is processed strictly for the following tracking and estimation purposes:

  • Computing statutory deduction estimates under prevailing SSS, PhilHealth, and Pag-IBIG matrices.
  • Generating verifiable Proof of Income vouchers with cryptographic checksums based on your self-reported inputs.
  • Facilitating micro-agency payroll batches and distributing digital employee payslips.
  • Enforcing session security, fraud prevention, and brute-force defenses via Rack::Attack.

3. Data Security & Storage Standards

We maintain rigorous technical and administrative safeguards to protect your personal information against unauthorized disclosure, alteration, or destruction:

  • Cryptographic database storage with UUID primary keys and encrypted attributes.
  • Subdomain host isolation ensuring client and administrative authentication domains remain strictly segregated.
  • Strict Content Security Policy (CSP) with per-request cryptographic nonces and HTTPS-only cookie attributes.

4. No Sale or Third-Party Monetization

ZupCore does not sell, rent, monetize, or trade your personal data, earnings history, or financial records to third-party advertisers, data brokers, or external marketing entities under any circumstances.

5. Rights of Data Subjects (RA 10173)

Under the Philippine Data Privacy Act of 2012, you possess clear rights as a data subject, including the right to be informed, the right to access your personal data, the right to rectify inaccuracies, and the right to erasure or blocking of your data. You may exercise these rights at any time through your client portal settings or by contacting our data protection officer.

6. Changes & Contact Inquiries

We may update this Privacy Policy from time to time to reflect statutory or technological changes. If you have questions regarding data handling or wish to file a privacy inquiry, please contact [email protected].