Privacy Policy

Who is responsible for your data

When a company signs up and loads its employees, that company is the personal information controller for its people’s records. Greenlit acts as its personal information processor — we hold and process that data on the company’s instructions, to run the Service.

For the account holder’s own details (name, work email, login) and for visitors to our marketing pages, Greenlit is the controller.

What we collect

• Account data: company name, your name, work email, hashed password, role.
• Employee records your company enters: names, contact details, job and manager information, birthday and address, and — where your company chooses to record them — government identifiers used for statutory reporting (SSS, PhilHealth, Pag-IBIG, TIN).
• Operational data: leave requests and balances, expense and cash-advance claims, loan records, attendance entries, payroll runs and payslip snapshots, approval decisions and the audit trail attached to them.
• Approver data: the email address and decision of a person who approves or rejects a request from a one-click link, even if they have no account.
• Technical data: IP address, browser type, and log timestamps, kept for security and debugging.

We do not use third-party advertising trackers, and we do not sell personal data to anyone.

Why we process it

• To provide the Service your company signed up for.
• To send transactional email — approval requests, invites, password resets.
• To keep the Service secure and to investigate abuse or errors.
• To meet our own legal and accounting obligations.

Statutory calculations (contributions, withholding) are run from rate tables your company or its payroll team loads and verifies. Greenlit does not provide tax or legal advice.

Who we share it with

We share personal data only with:

• Infrastructure providers that run the Service on our behalf, under confidentiality terms: Vercel (application hosting), Neon (database), and Resend (email delivery).
• Your own company — its administrators and the approvers in a request’s chain see the records relevant to their role.
• Authorities, where we are legally required to, or to protect the rights and safety of users.

Where it is stored

Data is stored on our providers’ infrastructure, which may be located outside the Philippines. Where data is transferred abroad, we rely on the providers’ contractual safeguards and process it consistently with the Data Privacy Act.

How long we keep it

While your company’s account is active, we keep its data so the Service works. Employee records are designed to outlive an employee leaving, because payroll and leave history have to. If your company closes its account, we delete or irreversibly anonymise its data within 90 days, except where we must keep specific records longer to meet a legal obligation.

Security

Passwords are hashed with bcrypt and never stored in the clear. Sessions are signed, encrypted cookies. Traffic is served over HTTPS. Access to production data is limited to what is needed to operate the Service. See the Security page for more.

Your rights

Under the Data Privacy Act you may ask to access, correct, or object to the processing of your personal data, and in some cases to have it erased or ported. If your data was entered by your employer, we will refer your request to them as the controller and support them in answering it. To make a request, contact us at the address below.

Children

The Service is for workplace use by adults and is not directed at children.

Changes

If we change this policy in a way that materially affects you, we will notify account holders by email before it takes effect. The “last updated” date above always reflects the current version.

Contact

Data Protection Officer, Greenlit — privacy@greenlithr.com. You also have the right to lodge a complaint with the National Privacy Commission (privacy.gov.ph).