Privacy Policy

Last updated: 27 June 2026

This Privacy Policy explains how personal data is collected, used, disclosed, and protected when you use ChequeFlow PH at check.arcoute.com (the “Service”). We are committed to protecting your privacy in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173, the “DPA”), its Implementing Rules and Regulations (the “IRR”), and the issuances and circulars of the National Privacy Commission (NPC).

Operator & Personal Information Controller. The Service is operated by Arcoute, a sole proprietorship registered with the Department of Trade and Industry (DTI) of the Republic of the Philippines, with principal address at Candon City, Ilocos Sur 2710, Philippines (“ChequeFlow”, “we”, “us”, or “our”). For account, subscription, and billing data, Arcoute acts as the Personal Information Controller (PIC). Contact: arcouteenterprises@gmail.com.

Contents

Our role, and yours
Personal data we collect
Purposes and lawful bases
Cookies
Recipients and sub-processors
Cross-border transfers
Data retention
Security measures
Data-breach notification
Your rights as a data subject
Data about other people that you upload
Children
Changes · Contact & DPO

1. Our role, and yours

ChequeFlow plays two distinct roles under the DPA, and it matters which applies:

For data about you (the subscriber): your account, login, subscription, billing, and usage data — Arcoute is the Personal Information Controller and this Policy governs that data.
For data you enter about other people (for example, payee names and payment details you record to print cheques): you are the Personal Information Controller of that data, and Arcoute acts only as your Personal Information Processor, handling it on your documented instructions to provide the Service. You are responsible for having a lawful basis to provide that data to us and for your own privacy notices to those individuals (see section 11).

2. Personal data we collect

Account information: your name, email address, business/workspace name, role, and your password (stored only as a salted cryptographic hash — we cannot read it).
Cheque & payee records you create: payee names, amounts, dates, reference notes, and cheque metadata. We store at most the last four (4) digits of a bank account number.
Billing information: your subscription plan and status, free-trial status, payment dates, amounts, and gateway reference numbers. Card and PayPal credentials are entered directly with PayPal — we never receive or store your full card details.
Consent & agreement records: the version of the Terms and Privacy Policy you accepted, with the date/time (Asia/Manila), IP address, and browser/device (user-agent), kept as proof of your agreement under the E-Commerce Act.
Usage & security information: log, audit-trail, and device information needed to operate, secure, and troubleshoot the Service and to detect and prevent fraud or abuse.

What we deliberately do NOT collect. We never store full bank account numbers, MICR-line data, or images of blank cheques. ChequeFlow only prints details onto the official cheque leaves your own bank already issued to you.

3. Purposes and lawful bases

We process personal data only for the declared, specified, and legitimate purposes below, in a manner that is proportional to those purposes (DPA §11), and on the lawful criteria under §§12–13 of the DPA:

Purpose	Lawful basis
Create and operate your account/workspace; deliver the cheque-printing, calibration, reconciliation, and reporting features	Performance of our contract with you (DPA §12(b))
Process subscriptions and the free trial via PayPal; charge renewals; issue tax invoices	Contract performance (§12(b)) and legal obligation, e.g. BIR record-keeping (§12(c))
Send service messages (email verification, password reset, renewal reminders, receipts)	Contract performance (§12(b)) / legitimate interests (§12(f))
Secure the Service, keep audit logs, prevent and investigate fraud or abuse	Legitimate interests (§12(f)), balanced against your rights
Comply with law, tax, accounting, and lawful requests of authorities	Legal obligation (§12(c))
Optional product analytics (only if enabled) — aggregated and non-identifying	Consent (§12(a)), which you may withdraw

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you, and we do not sell your personal data.

4. Cookies

We use a single essential cookie to keep you signed in to your session (longer-lived if you choose “Keep me signed in”). We do not use third-party advertising or cross-site tracking cookies. Optional analytics, where enabled, is configured to be aggregated and non-identifying.

We do not sell your personal data and disclose it only to the trusted processors who help us run the Service, under confidentiality and data-protection commitments, and only as needed:

Recipient	Purpose
PayPal (PayPal Pte. Ltd. / PayPal, Inc.)	Subscription and payment processing, free-trial billing, and recurring charges
Hostinger	Cloud hosting and storage of the Service and its database
Our email/SMTP provider	Delivery of transactional emails (verification, reminders, receipts)

We may also disclose personal data where required by law, regulation, court order, or a lawful request of a competent public authority, or to establish, exercise, or defend legal claims.

6. Cross-border transfers

Some processors (for example, PayPal) may process personal data outside the Philippines. In line with the accountability principle (DPA §21 and IRR §50), Arcoute remains responsible for personal data transferred to processors or third parties — whether domestically or abroad — and uses contractual or other reasonable means to ensure a comparable level of protection while the data is being processed.

7. Data retention

We keep personal data only as long as necessary for the purposes above:

Account, cheque, and payee data: for as long as your workspace is active, and for a limited period after closure to handle disputes and legal obligations, after which it is securely deleted or anonymised.
Billing, invoice, and tax records: for the period required by Philippine tax and accounting law (generally up to ten (10) years), as mandated by the BIR.
Audit, consent, and security logs: for as long as needed for security, fraud prevention, and to evidence your agreement, then disposed of securely.

8. Security measures

We implement reasonable and appropriate organisational, physical, and technical security measures to protect personal data against natural and human-made dangers — including unauthorised access, alteration, disclosure, loss, or destruction — consistent with §§25–29 of the IRR. These include encrypted transmission (HTTPS/TLS), salted password hashing, parameterised (prepared-statement) database access, role-based access controls, audit logging, and data minimisation (we store at most the last four digits of an account number). No method of internet transmission or electronic storage is 100% secure; while we strive to protect your data, we cannot guarantee absolute security.

9. Data-breach notification

We maintain a personal-data-breach response process. Where a breach occurs that is likely to give rise to a real risk of serious harm to affected data subjects, we will notify the NPC and the affected data subjects within seventy-two (72) hours of knowledge of, or reasonable belief in, such a breach, in accordance with §20(f) of the DPA, §§38–42 of the IRR, and NPC Circular No. 16-03.

10. Your rights as a data subject

Under the DPA, you have the right to: be informed; object to processing (including for direct marketing or profiling); access your personal data and information about how it is processed; rectify inaccurate or outdated data; erase or block data under the conditions allowed by law; data portability (to obtain a copy of your data in a structured, commonly-used, machine-readable format); be indemnified for damages; and lodge a complaint with the NPC.

To exercise any right, contact our Data Protection Officer (section 14). For your protection, we may need to verify your identity before acting on a request, and we will respond within the period required by law. You may also complain to the NPC at www.privacy.gov.ph or complaints@privacy.gov.ph.

If your request concerns personal data that another ChequeFlow customer entered about you (for example, because you are their payee), that customer is the Personal Information Controller of that data; we act only as their processor, so we will refer your request to them and assist as needed (see section 11).

11. Data about other people that you upload

When you enter payee or other third-party personal data into the Service, you confirm that you have a lawful basis and the authority to do so, that you will provide any privacy notice those individuals are entitled to, and that you will handle their data in compliance with the DPA. As your processor for that data, we act only on your instructions, keep it confidential, and assist you, so far as reasonable, with data-subject requests and breach obligations relating to it.

12. Children

The Service is intended for businesses and persons at least 18 years old. We do not knowingly collect personal data from minors. If you believe a minor’s data has been provided to us, contact us and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted here with a revised “last updated” date and, where appropriate, communicated to you. The current version always governs.

14. Contact & Data Protection Officer

The proprietor of Arcoute serves as our designated Data Protection Officer (DPO). For privacy questions or to exercise your rights, contact the DPO at arcouteenterprises@gmail.com, or by mail at Arcoute, Candon City, Ilocos Sur 2710, Philippines. If you believe your data-privacy rights have been violated, you may also file a complaint with the National Privacy Commission (privacy.gov.ph).