This Privacy Policy explains how Multibook Philippines Inc. ("we", "us" or "ANTE"), a Philippine corporation and a subsidiary of Multibook Inc. (Tokyo, Japan), handles personal data in connection with ANTE, our cloud ERP service at ante.work, and our website at ante.ph. Our office is at Unit 405 Cattleya Condominium, 235 Salcedo Street, Legaspi Village, San Lorenzo, Makati City, Philippines.
It is aligned with the Data Privacy Act of 2012 (Republic Act 10173), its Implementing Rules and Regulations and the issuances of the National Privacy Commission (NPC). Where the EU General Data Protection Regulation (GDPR) applies, we aim to align with it. It also covers the Google API Services User Data Policy, including its Limited Use requirements, for the Google services you connect.
1. Our roles
Controller. We are the personal information controller for the account data of ANTE users, billing and contract data, support communications, and data collected through our website.
Requests about a workspace. Each customer organisation can set a privacy contact email and a privacy-notice URL in its workspace. ANTE shows them to that organisation's employees, applicants and customers on the careers, point-of-sale customer registration, MLM portal and facial-enrolment notices, and falls back to the organisation's company email if none is set. Requests about data in a workspace should go to the organisation first.
Processor. For the data an organisation enters into its ANTE workspace (its employees, applicants, customers, suppliers and so on), that organisation is the personal information controller and we are its personal information processor. We process that data only on the organisation's documented instructions, under the Data Processing Addendum. If you are an employee or other individual whose data sits in a customer's workspace, see Section 14.
2. What we collect
2.1 Data we control
- Account data: name, work email, username, phone number, role, a one-way (bcrypt) hash of your password, and the identifiers and email addresses of any Google, Facebook or Slack identity you link for sign-in.
- Billing and contract data: organisation and contact details, order forms and invoices. We do not integrate a payment processor and hold no card details in ANTE.
- Support communications: tickets, emails and messages you send us, and our replies.
- Trusted-device records: a hashed device token, browser user-agent and last IP address, kept so we can recognise a known device at sign-in. Device trust is valid for up to 180 days from last use.
- Service logs: web server logs (request details, IP address, user-agent) and operating-system and infrastructure monitoring logs, kept for the periods in Section 10.
- Website data: see Section 11.
2.2 Workspace data (processed for the customer)
The content depends on the modules a customer uses and what it chooses to enter. It can include:
- Employee records: names, contact details, date and place of birth, civil status, nationality, religion, blood type, height and weight, mother's maiden name, emergency contacts, and government numbers (TIN, SSS, PhilHealth, Pag-IBIG/HDMF, MP2).
- Payroll and finance data: salary, deductions, bank name and account number, leave, attendance, and the accounting, invoicing, project and CRM data the customer records.
- Clock-in and clock-out data: GPS location, address, IP address and, when the customer enables it, a photo.
- Facial attendance data, only if the customer enables facial attendance: an enrolment photo and a numeric face template for each enrolled person, and for each scan a photo, match distances, GPS coordinates, address and IP address. Face matching runs in the browser on the kiosk device. When an employee is enrolled, ANTE records their consent (the time, the version of the notice shown and the kiosk device used). A customer administrator can withdraw that consent, which deletes the face template and the enrolment photo; past scan records are kept as attendance records. Enrolments made before this feature show "consent not recorded", and the customer should re-confirm consent for them.
- Audit and activity logs: every user and administrator action, with before and after values, the actor, IP address and user-agent.
- AI request logs: the prompt and response for AI features, plus usage metadata such as model, token counts, timing and status.
Some of this is sensitive personal information under Section 3(l) of RA 10173: civil status, age or date of birth, and religion; health-related information such as blood type and medical leave details; and government-issued identification numbers (TIN, SSS, PhilHealth, Pag-IBIG). We also treat biometric data processed for facial attendance as sensitive personal information. We apply the safeguards in Section 12 to all workspace data. The customer decides what to collect and is responsible for having a lawful basis, and consent where required, for it.
3. How we use it
- To provide, secure and support the ANTE service and the features a customer has configured.
- To authenticate users, detect unfamiliar devices, and prevent abuse.
- To send service messages such as one-time codes, verification emails, approval requests and notifications.
- To answer support and sales enquiries, and to administer contracts and billing.
- To keep audit trails, investigate incidents and meet legal, tax and audit obligations.
We do not sell personal data, and we do not use it for advertising. We do not use customer workspace data to train AI models (see Section 7).
4. Legal basis
For data we control, we rely on the grounds in Section 12 of RA 10173: performance of our contract with you or your organisation, compliance with a legal obligation, our legitimate interests in operating and securing the service, and your consent for optional features such as connecting Google Calendar. Where data is sensitive personal information, Section 13 of RA 10173 applies and we process it only as that section allows, for example on the customer's instructions and consent, or as the law requires. For workspace data, the customer determines the legal basis.
5. Google user data
ANTE uses two Google services: Google Sign-In and Google Calendar. We request no other Google scopes. Calendar is optional and applies only if you connect it from your ANTE workspace and consent on Google's own screen.
5.1 Google Sign-In (openid, email, profile)
- Why: to let you sign in to ANTE with your Google account instead of a separate password.
- What we receive: your Google account ID, name, profile picture URL and email address.
- How we store it: linked to your ANTE user record so later sign-ins resolve to the same account.
- Retention: until you unlink the identity or the account is deleted.
5.2 Google Calendar (https://www.googleapis.com/auth/calendar, https://www.googleapis.com/auth/calendar.events)
- Why: to sync ANTE items such as meetings, interviews, leave and project milestones with your Google Calendar, and to reflect events you create in Google Calendar.
- What we access: read and write access to events on the calendar you authorise. We request offline access so that syncing continues between your visits.
- What we store: OAuth tokens, encrypted at rest with AES-256, and a mirror of synced events: title, description, location, start and end times and attendees, with the sync state for each.
- Retention and revocation: only while the connection is active. When you disconnect under My Profile → Connections, ANTE calls Google's revoke endpoint, deletes the stored tokens, unlinks the Google identity, and deletes the mirrored events and sync state immediately. You can also remove ANTE at myaccount.google.com/permissions. See Data deletion.
5.3 Limited Use
ANTE's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, ANTE does not:
- Use Google user data to develop, improve or train generalised or non-personalised AI or machine-learning models.
- Transfer or sell Google user data to third parties for advertising, data brokerage or marketing purposes.
- Allow humans to read Google user data, except (a) with your explicit consent for a specific support request, (b) for security investigations or to comply with applicable law, or (c) where the data is aggregated and anonymised.
6. Facebook and Slack sign-in
If you sign in with Facebook, we request the email and
public_profile permissions, and use them to identify and link your
account. If you sign in with Slack, we request openid, email
and profile for the same purpose. Separately, a customer's administrator
may connect a Slack workspace, in which case a bot sends that customer's ANTE
notifications as direct messages, or may connect a Facebook Page and Messenger to the
CRM module. Those integrations exchange only the data the customer's configuration
requires, and the provider's own terms apply.
7. AI processing
AI features include reading receipts and documents (images and PDFs are sent), parsing bank statements, mapping import columns and accounts, importing journals, suggesting reimbursement coding and descriptions, drafting features such as meeting minutes and screening questions, and the Ante AI assistant and support help. These are processed by:
- MiniMax, our system AI provider for the Pro plan's AI features. MiniMax is a provider outside the Philippines, so using these features involves a cross-border transfer (Section 9).
- A provider the customer chooses. A customer can configure its own key for OpenAI, Google Gemini, Anthropic Claude, xAI Grok or MiniMax. Content then goes to that provider under the customer's own agreement with it.
We do not use customer data to train AI models. We keep prompts and responses in our request logs for 90 days and then erase the content. Usage metadata (model, token counts, timing, status) is kept for service statistics. Only the content needed for the request is sent. For import column matching we send column headers and a few sample cells in which identification numbers, email addresses, phone numbers and amounts are masked with placeholder characters; calendar dates and plain words are kept so the columns can be recognised.
Other users in your company cannot see your conversations with the Ante AI assistant. Because AI requests are logged, Multibook support can view the logged content for troubleshooting and security during the 90-day period, under Section 12.
8. Push notifications and email
Browser and mobile push notifications are delivered through Google Firebase Cloud Messaging. The notification title, body text and in-app link pass through Firebase. You can turn push notifications off in your browser or device settings. System email (one-time codes, verification and notifications) is sent through Amazon Web Services Simple Email Service in Singapore. A customer that configures its own SMTP server sends its email through that server instead.
9. Subprocessors, hosting and international transfers
Customer data is stored in Singapore (DigitalOcean, region sgp1), with Cloudflare for DNS, CDN and web application firewall, Vercel for the web front-end, Amazon Web Services for system email, Google for sign-in, calendar and push notifications, and MiniMax for system AI. We also use Slack (Salesforce) for internal security alerts: one-time codes for high-risk actions (for example payroll unposting, or deleting all journal entries or the chart of accounts) are issued to Multibook's internal security channel and include the requesting user's name, email and company. Customers may also enable Slack, Facebook, the Multibook ERP connector, their own AI provider or their own SMTP server. The current list and what each provider does is on our Trust Center. We give 30 days' notice of new subprocessors that process workspace data, as set out in the Data Processing Addendum.
Customer Personal Data is stored in Singapore. In transit it passes through Cloudflare's global network, and some subprocessors (including Cloudflare, Google for push notifications, and our AI subprocessor) process data outside the Philippines. We engage subprocessors under written terms (a signed agreement or the provider's published service terms) that address confidentiality and security, and we assess each one before use. We remain responsible to you for their processing, as RA 10173 requires. Transfers to our AI subprocessor occur only when an AI feature that uses the system provider is used.
10. Retention
- Workspace data: kept while the subscription is active. Deleted within 30 days of termination or of the customer's written request, and removed from backups within a further 30 days. Export is available on request before deletion.
- Backups: daily, kept for 30 days.
- Billing and invoice records: kept 5 years, as the National Internal Revenue Code Section 235, as amended by the Ease of Paying Taxes Act (RA 11976), requires. They are kept longer if a tax case is pending.
- Audit and activity logs: kept for up to 24 months from each event. They are append-only for security and accountability, are not deleted when a workspace is deleted, and are erased once they reach 24 months.
- AI prompts and responses: 90 days, then erased. Usage metadata is kept.
- Web server logs: about 12 months. Operating-system authentication logs: at least 3 months. Infrastructure monitoring logs: 30 days.
- Google Calendar data and tokens: deleted immediately when you disconnect.
- Account data: while your account is active, and deleted with the workspace as above unless a legal obligation requires us to keep it.
- Support tickets and messages: resolved or closed tickets are deleted automatically 30 days after they are closed. Open tickets are kept while the workspace is active and are deleted with the workspace. A requester can also delete their own ticket. Email correspondence outside the ticket system, including sales enquiries from prospective customers, is kept only as long as needed to handle the enquiry and manage the relationship.
A customer's own statutory records, such as payroll and accounting records, are its responsibility to retain. It should export them before termination.
11. Our website
The ante.ph website runs no analytics or tracking, and ANTE's own code sets no cookies on ante.ph or ante.work. Our network provider (Cloudflare) may set a strictly necessary security cookie when it needs to check that traffic is legitimate. If you sign in through Google, Facebook or Slack, those providers set their own cookies on their own domains. The website loads fonts from Google Fonts, which means Google receives your IP address when a page loads. We do not use advertising pixels. See the Cookie policy.
12. Security
- Data is encrypted in transit using TLS 1.2 or later, and database volumes and backups are encrypted at rest.
- Passwords are stored only as one-way bcrypt hashes. Credentials, API keys and OAuth tokens are encrypted at the field level with AES-256.
- Access to production systems is limited to a designated engineer, over a private network, and is logged. Databases are not reachable from the internet.
- Sign-in is protected by account lockout (5 failed sign-ins within 15 minutes lock the account for 30 minutes), an email one-time code for new devices, and per-company idle timeouts.
Who at Multibook can access your data
We do not access workspace data without the customer's request or prior approval, except where strictly necessary to keep the service running or secure. Multibook support may open a customer user's session ("log in as") from our internal developer panel only at the customer's request or with its prior approval. Doing so requires a one-time code issued to Multibook's internal security channel, and the access is recorded in the audit log. Customer administrators have their own audited "Log in as this user" feature. See the Customer Data Access Policy.
More detail is on our Trust Center and in the security documentation.
13. Personal data breaches
If a personal data breach affects personal data we control and the law requires it, we notify the National Privacy Commission and the affected individuals within 72 hours of knowledge or of the reasonable belief that a breach requiring notification occurred, as NPC Circular 16-03 provides. If a breach affects workspace data we process for a customer, we notify that customer without undue delay and within 48 hours of becoming aware of it, so it can meet its own obligations, as the Data Processing Addendum provides.
14. Your rights
Under RA 10173, you have the right to:
- be informed whether and how your personal data is processed;
- object to processing, and withdraw consent where processing is based on it;
- access your personal data;
- have inaccurate data corrected;
- have data suspended, withdrawn, blocked, removed or destroyed in the cases the law provides (erasure or blocking);
- data portability, meaning to obtain your data in an electronic, structured and commonly used format;
- claim compensation for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of your data; and
- lodge a complaint with the National Privacy Commission (privacy.gov.ph).
Where ANTE uses AI to produce a suggestion (for example expense coding or a draft), a person reviews it before it is relied on. We do not make decisions about you based solely on automated processing.
Where the GDPR applies to you, you also have the rights it gives, including restriction of processing and the right to complain to your supervisory authority.
Employees and other individuals in a customer's workspace. For data in a customer's workspace, your employer or the relevant organisation is the controller. Please contact it first. If you write to us, we will pass your request to that customer and help it respond.
To exercise a right over data we control, email privacy@ante.work. We may need to verify your identity first. We respond within 30 days.
15. Children
ANTE is a workplace tool for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.
16. Changes to this policy
We will post changes on this page and update the "Last updated" date. For material changes, including any change in how we use Google user data, we will email workspace administrators at least 30 days before the change takes effect.
17. Data Protection Officer and contact
Our Data Protection Officer handles questions about this policy and requests to exercise your rights: privacy@ante.work.
Data Protection Officer, Multibook Philippines Inc., privacy@ante.work, Unit 405 Cattleya Condominium, 235 Salcedo Street, Legaspi Village, San Lorenzo, Makati City, Philippines.