Privacy Policy for LokalTayo.Ph

Welcome to LokalTayo (accessible via the mobile app and at LokalTayo.Ph, collectively referred to as the "Platform", "we", "us", or "our"). We respect your privacy and are committed to protecting your personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines, its Implementing Rules and Regulations (IRR), directives of the National Privacy Commission (NPC), and mobile application security standards established by the Google Play Store and Apple App Store.

This policy discloses our data handling practices, the types of information collected, the reasons for processing, and the mechanisms available to you for managing, correcting, or permanently deleting your personal data.

1. Information We Collect

We collect data directly from you during registration, through your interactions on our marketplace, and via device permissions you grant:

• Account Registration & Identity: Mobile phone number (for SMS verification / OTP authentication), email address, encrypted password credentials, first name, last name, and optional profile avatar.
• Location & Proximity Data: With your consent, device GPS coordinates (latitude and longitude) to calculate distance to nearby local businesses and stores carrying desired products using PostGIS. You may also specify a Base City to filter regional feeds.
• Store Owner / Merchant Information: Store name, store URL slug/subdomain, physical address, city, store logo, storefront photos, and merchant payment coordination details (GCash registered name, phone number, and QR Ph code image).
• Transactions & Order Reservations: Item quantities, unit prices, total billings, pickup/delivery preferences, and buyer-uploaded payment verification screenshots (e.g., GCash transaction slips).
• Communications: Real-time buyer-seller in-app chat messages, product reviews and star ratings, and call signaling metadata for audio/video calls.

2. Legal Basis & Purposes of Data Processing

Pursuant to Section 12 of the Philippine Data Privacy Act of 2012, your personal data is processed under the lawful criteria of contractual necessity, legitimate commercial interest, compliance with legal obligations, and your explicit consent. Purposes include:

• Facilitating local product discovery and proximity-sorted inventory reservations.
• Authenticating accounts via SMS OTP and safeguarding user identity.
• Enabling store owners to review orders and verify GCash payment proof screenshots.
• Delivering notifications regarding order milestones, direct messages, and call requests.
• Preventing platform abuse, fraudulent accounts, or security vulnerabilities.

3. How We Share & Disclose Information

We do NOT sell, lease, or monetize your personal data to advertisers or third-party brokers. Disclosures are limited to:

• Between Buyers and Store Operators: When an order reservation is placed, your name, contact phone number (if required for pickup/delivery), and payment screenshot are made available to the specific store operator to fulfill the request.
• Trusted Infrastructure Partners: Supabase (database, auth, and Row Level Security), Firebase Cloud Messaging (push notification delivery), and SMS gateway providers (OTP transmission). All partners are bound by strict confidentiality and data protection agreements.
• Legal & Regulatory Compulsion: If mandated by valid court orders, subpoenas, or statutory investigations by the National Privacy Commission or Philippine law enforcement.

4. Data Storage, Security & Retention

We enforce enterprise-grade security protocols: PostgreSQL Row Level Security (RLS) policies isolate user queries so that data cannot be accessed by unauthorized parties. All network transmissions are encrypted with TLS/HTTPS. File uploads are guarded by authenticated bucket policies. Data is retained only for the duration of active account operations or as necessitated by commercial dispute resolution and Philippine taxation record rules.

5. Account Deletion & Data Erasure ("Delete Me")

6. Your Rights as a Data Subject (R.A. 10173)

Under the Philippine Data Privacy Act of 2012, you hold the following rights:

• Right to be Informed: Clear disclosure of data collection and processing methods.
• Right to Access: Requesting copies of personal records held by the platform.
• Right to Rectification: Modifying inaccurate or outdated profile information via the Me screen.
• Right to Erasure or Blocking: Permanently deleting your account and records.
• Right to File a Complaint: Lodge grievances with the National Privacy Commission at privacy.gov.ph.

7. Device Permissions (Location, Camera, Microphone)

• Location: Foreground GPS is used solely for computing distance to nearby stores. We do not track location in the background or sell location trails.
• Camera & Photos: Used to capture or upload store logos, storefront banners, and GCash payment confirmation receipts.
• Microphone: Used during peer-to-peer WebRTC voice/video calls between customers and store operators. Audio streams are not recorded.

8. Children's Privacy

LokalTayo is intended for users who are at least 18 years old. We do not knowingly collect information from minors without verified parental consent.

9. Policy Updates

We may update this policy periodically. Changes take effect upon posting with the revised "Effective Date". Material updates will be highlighted via in-app alerts.

10. Contact Us & Data Protection Officer (DPO)