This policy explains how Mage Technologies Inc. collects, uses, shares and protects personal data in connection with Mage Accounting, as required by the Data Privacy Act of 2012 (Republic Act No. 10173, the Data Privacy Act), its Implementing Rules and Regulations as amended (the IRR), and the issuances of the National Privacy Commission (NPC).
It covers four groups of people:
- Website visitors to our public pages (such as
/and/legal), including people who use our free Excel-to-BIR tool (section 2.6); - People who ask about Mage, through the request form or by email (leads);
- Users, the people our customers give a sign-in to Mage Accounting; and
- People in our customers' books, such as their employees, suppliers and customers, whose data our customers put into Mage Accounting. For them we act on our customers' instructions (section 3).
1. Who we are and how to reach us
Personal information controller: Mage Technologies Inc., SEC Registration No. 2022100072730-20, Block 21 Lot 11 Mapagmahal St., Fiesta Communities, Brgy. Balon Anito, Mariveles, Bataan 2105.
Data Protection Officer: Mage Technologies Inc., Block 21 Lot 11 Mapagmahal St., Fiesta Communities, Brgy. Balon Anito, Mariveles, Bataan 2105 · dpo@magetechsystems.com · +63 920 472 9279.
2. What we collect, why, and on what lawful basis
2.1 Website visitors
| What | Why | Lawful basis |
|---|---|---|
| Technical data your browser sends when it loads our pages (IP address, browser type, the page requested). Our host, Cloudflare, processes this to deliver the pages and protect them from attacks. | To deliver the website and keep it secure | Our legitimate interest in running a secure website (Data Privacy Act, Section 12(f)) |
We do not use analytics, advertising, tracking pixels, social media plugins or any other third-party trackers, and our public pages set no cookies. See Cookies and Browser Storage.
2.2 Leads (the request form and emails to us)
| What | Why | Lawful basis |
|---|---|---|
| What you enter in the request form: your name, work email, company or practice, role, phone or Viber number (optional), how many companies you keep, the returns you prepare, your message, and which due-date switches you turned on (if you left them included) | To reply to your request and, if you go ahead, to set up your access | Your consent, recorded with the notice version you agreed to (Section 12(a)); and steps you ask us to take before entering into a contract (Section 12(b)) |
| A one-way code made from your connection's IP address (never the address itself) | To limit repeat and automated requests | Our legitimate interest in protecting the form from abuse (Section 12(f)) |
| Emails you send us and our replies | To answer you | Steps at your request before a contract (Section 12(b)), or our legitimate interest in answering enquiries (Section 12(f)) |
You do not have to give us these details, but we cannot reply without a name, an email address and your consent.
2.3 Users
| What | Why | Lawful basis |
|---|---|---|
| Name, email address, the companies you belong to and your role in each | To give you access to the right companies | Our contract with your organisation and, where you are the customer, with you (Section 12(b)); our and our customer's legitimate interest in controlling access (Section 12(f)) |
| Your password (stored only as a one-way scrypt hash), two-factor settings and recovery codes (stored encrypted) | To sign you in securely | Section 12(b) and 12(f) |
| Session records, including the IP address and browser type you signed in from | To keep you signed in, let you or us end sessions, and investigate misuse | Our legitimate interest in securing the Service (Section 12(f)); our duty to keep personal data secure (Section 20) |
| A record of what you do in the Service: postings, voids, closes and reopens, tax-detail decisions, filing steps, settings changes | To keep an audit trail of the books, which customers need for their own tax compliance, and to investigate problems | Our customer's legal obligations and legitimate interests, on whose behalf we keep it (Section 12(c), 12(f)) |
| Support tickets you file and their attachments (for example, screenshots) | To help you | Section 12(b) and 12(f) |
| Settings your browser keeps for you (selected company, working month, draft rows) | So the app remembers where you were | Strictly necessary for the feature you use; stored only in your browser (see Cookies and Browser Storage) |
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, and we do not profile Users.
2.4 People in our customers' books
Our customers put the following into Mage Accounting to keep their books and prepare their BIR returns: employees' names, birth dates, addresses, Taxpayer Identification Numbers (TINs), SSS, PhilHealth and Pag-IBIG numbers, pay rates, payroll and withholding figures, and previous-employer compensation; the names, TINs, addresses and email addresses of suppliers, customers and payees who are individuals; and documents customers upload (such as receipts, filing proof and registration certificates). For a customer who is an individual taxpayer (a sole proprietor or professional), its income tax returns also keep that individual's birth date, citizenship, civil status, whether they have compensation income, whether their spouse has income, and joint or separate filing; for a general professional partnership, its partners' names, TINs, addresses and shares. TINs and SSS, PhilHealth and Pag-IBIG numbers, age (from a birth date) and civil (marital) status are sensitive personal information (Data Privacy Act, Section 3(l)).
For this data, the customer is the personal information controller and decides why and how it is processed (usually because the Tax Code and social security laws require it: Section 13(b)). Mage is the customer's personal information processor: we process it only on the customer's instructions, under a written agreement (Section 14; IRR Sections 43 to 45). See our Data Processing Addendum. If you are one of these people and want to exercise your rights, contact the business that keeps your records; if you contact us, we will pass your request to that business and help it respond.
2.5 What we do not do
We do not sell personal data, use it for advertising, or share it with anyone except as described in section 4. We do not use customers' data to train artificial intelligence models.
2.6 The free Excel-to-BIR tool
Our free Excel-to-BIR tool works entirely in your web browser. When you add a spreadsheet, the tool reads it on your device, works out the figures there and lets you download the results. The spreadsheet, the details you type on the page (such as your name, TIN and address) and the files the tool makes are not sent to us or to anyone else, and we do not store them. The tool does not save them in your browser's storage either: they stay in the open page until you close it, reload it or choose Clear everything. Its own terms are the Free Tool Terms of Use.
Using the tool needs no account. Loading its page and program code is an ordinary website visit: our host, Cloudflare, processes the technical data described in section 2.1 to deliver the page and keep it secure, and nothing else. Those requests carry none of your spreadsheet's contents.
Your spreadsheets may contain personal data about your customers and suppliers, such as the names, addresses and TINs of individuals. Because that data never reaches us, Mage does not collect or otherwise process it, and is neither its controller nor its processor. You remain responsible for it under the Data Privacy Act, including for the files you download and the device you use.
3. How we use personal data
We use personal data only for the purposes stated in section 2, and for these related purposes:
- securing the Service, detecting and investigating misuse, and keeping backups;
- complying with the law and lawful orders of courts and government agencies (including BIR under Section 5(B) of the National Internal Revenue Code), and establishing, exercising or defending legal claims (Section 13(f)); and
- billing our customers and keeping our own books of accounts as the tax laws require.
Our error monitoring records only the type of error, the route pattern and the app version. It records no personal data.
4. Who we share it with
Mage staff. Only staff who need it for their work see personal data, and they are bound by confidentiality. Staff who help a customer through support access do so view-only by default, must give a reason, and every session is shown to the customer's owners and admins (see the Terms of Service, section 9).
Our processors. These companies process personal data for us:
| Processor | What it does | Data | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosts the website and Mage Accounting (Workers, D1 databases, R2 file storage), keeps our backups, delivers pages, sends sign-in and statement-of-account emails, and forwards email sent to our addresses (Email Routing) | All the data in this policy | Cloudflare's global network; stored outside the Philippines |
| Google LLC | Runs the mailbox that receives what is sent to our addresses (support@magetechsystems.com, dpo@magetechsystems.com, legal@magetechsystems.com) and that we reply from | Emails you send us, our replies, and anything attached | Google's data centres, outside the Philippines |
| Anthropic, PBC | Runs the Claude AI model behind the AI features: Magica, the in-app assistant, and workbook conversion | Questions asked to Magica with the screen they were asked on, images a user attaches to a question (such as screenshots, or photos of receipts and invoices with the names, TINs and amounts on them), and the parts of the company’s books Magica reads to answer them (such as report figures, transactions and contact names, read with the asking user’s own access), and the cells of workbooks a user converts, only for that request | Anthropic's data centres, outside the Philippines |
The full, current list is in Sub-processors.
Authorities. We disclose personal data to courts, BIR, the NPC or other government agencies only when the law or a lawful order requires it. Where customer data is concerned, we tell the customer first unless the law prohibits it.
If our business changes hands, personal data may pass to the new owner, who must continue to protect it as this policy describes.
5. Transfers outside the Philippines
Our processors store and process personal data outside the Philippines. Under Section 21 of the Data Privacy Act and Section 50 of the IRR, we remain responsible for it. We use processors that commit by contract to protect personal data and that hold independent security certifications (for Cloudflare, SOC 2 Type II and ISO/IEC 27001), and we transfer only what is needed to run the Service. We do not use the model contractual clauses in NPC Advisory 2024-01.
6. How long we keep it
| Data | How long |
|---|---|
| Users' account details (name, email, role, password hash, two-factor data, and which version of the Terms of Service they accepted and when) | While the person has access to at least one company, then deleted within 30 days of removal, except the audit trail entries below |
| Sign-in sessions | Until they expire (7 days; 1 hour for a staff support session) or are ended sooner |
| Password reset links | 30 minutes, single use |
| Audit trail of actions in the books, and the support access log | While the customer's subscription lasts plus the period the customer needs for its own books |
| Support tickets and attachments of customers | 2 years after the ticket is closed and last updated |
| Customer data (books, payroll, contacts, uploads) | For the subscription; then as set out in the Data Processing Addendum (export window, then deletion) |
| Leads (request form details) | 12 months after you send them, then erased automatically; sooner if you ask. A record that a request was made, and which notice version was agreed, is kept without your details |
| The one-way code made from your IP address | Cleared within three days |
| Emails in our mailbox | Until you ask us to delete them |
| Daily backups (all of the above) | 90 days. The 7 newest backups are always kept, even if older than 90 days, so that a backup always exists |
| Database point-in-time recovery kept by Cloudflare (D1 Time Travel) | 30 days |
| Error monitoring (no personal data) | 90 days |
| Conversations with Magica, the in-app assistant | 90 days after the conversation's last message, or sooner when the user deletes it; only the user who asked sees them. Images attached to a question are not kept, only a note that there were some; what Magica wrote from them in its answer (such as a name, TIN or amount it read, or an entry it prepared) is kept with the conversation |
| Monthly AI allowance (Mana) counts: a user id, a month and a number | 12 months |
| AI cost records: per company and day, the AI model used, how much text it processed (token counts) and what it cost; nothing that was asked or converted | About 400 days |
| Our own billing records and invoices | The periods the tax laws require |
When data reaches the end of its period, we delete it or anonymise it so that it no longer identifies anyone. Data in backups is deleted when those backups expire. If a backup is ever restored, we re-apply deletions made since the backup was taken.
7. How we protect it
Our security measures include (Data Privacy Act, Section 20; NPC Circular 2023-06):
- all connections encrypted in transit (HTTPS), and data encrypted at rest by our host;
- passwords stored only as scrypt hashes; two-factor secrets stored encrypted;
- two-factor sign-in with an authenticator app and recovery codes, available to every User, and required for owners, admins and Mage staff when the platform setting is on, which it will be before any customer is onboarded;
- sessions held on the server, which we or you can end at once; password reset links that expire in 30 minutes and sign the User out everywhere;
- each request checked against the User's live company membership and role, so access ends as soon as it is removed, and each company's data kept separate from every other company's;
- a separate administration portal for Mage staff, with its own sign-ins;
- support access by staff that needs a reason, is view-only by default and is visible to the customer;
- an audit trail of postings, voids, closes, filing steps and staff actions, including every backup download;
- daily backups with integrity checks, kept 90 days; and
- uploaded files limited to safe types and sizes and never run as code.
No system is perfectly secure. If you believe your account or data is at risk, contact us at once.
8. Your rights
Under Sections 16 to 18 of the Data Privacy Act you have the right to:
- be informed whether and how your personal data is processed;
- access your personal data and get a copy;
- object to processing, including processing based on legitimate interest, and withdraw consent where consent is the basis;
- have it corrected if it is wrong or incomplete;
- have it erased or blocked where it is no longer needed, was unlawfully obtained, or you withdraw consent and no other basis applies;
- data portability: get it in a commonly used electronic format; and
- be compensated for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of your personal data.
These rights pass to your lawful heirs and assigns in the cases Section 17 provides.
How to exercise them. Email our DPO at dpo@magetechsystems.com, saying which right you are exercising. We may need to confirm your identity before acting. We will respond within 15 working days, free of charge unless a request is clearly unfounded or excessive. If you are a User, some rights (such as correcting your name) can also be exercised through your company's owner, who can ask us to make the change. If your data is in a customer's books (section 2.4), we will pass your request to that customer.
Some requests may be limited by law: for example, a customer may need to keep payroll records the tax laws require, and we cannot erase entries from a posted audit trail while the customer must keep it.
9. Complaints
Please tell us first, so we can try to put things right. You also have the right to lodge a complaint with the National Privacy Commission (privacy.gov.ph). Under the NPC's rules of procedure (NPC Circular 2021-01), the NPC generally expects you to have raised the matter with us first and given us a chance to respond.
10. Personal data breaches
If a personal data breach occurs that is likely to give rise to a real risk of serious harm, we will notify the NPC and the affected people within 72 hours of becoming aware of it, as required by Section 20(f) of the Data Privacy Act, Section 38 of the IRR and NPC Circular 16-03 (or the circular that replaces it). Where the breach concerns customer data, we notify the customer without delay so it can meet its own obligations (see the Data Processing Addendum).
11. Children
Mage Accounting is a business service for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 18 except where a customer records a minor as an employee or payee in its books, which the customer is responsible for.
12. Changes to this policy
We will publish any change at /legal/privacy with a new version date and, for material changes, tell Users by email or in the Service before the change takes effect. Where consent is the basis for processing, we will ask for it again if the change requires it.
13. Version
Version 18 October 2026 · in effect from 18 October 2026. Section 2.6, on the free Excel-to-BIR tool, was added on 8 October 2026. Previous versions are available on request.