Privacy Statement

1. Who is responsible

The platform operator’s legal name, address and privacy contact are still being finalized. The final notice must identify who is responsible for each processing activity. Participating businesses also have responsibilities for the customer information they use to deliver their services. Those responsibilities and any processing agreements must be documented before live onboarding.

2. Information handled in this preview

Owner registration uses an email address and password through Supabase Authentication, together with account and session information. Private business setup stores information you submit, such as business and branch names, contact details, addresses, map links, opening hours, rates, booking settings, resource descriptions, logos and photos. Uploaded images are processed for display; access is restricted to authorized users in the current private setup.

The sample directory, reservations and financial figures are fictional. Live customer receipt collection is not enabled. Owners may optionally submit relevant business registration, branch permits and professional evidence privately for GCash, Maya or QR Ph receiving-account review. Documents are restricted to the submitting business’s authorized owner access and authorized platform verification, and are not included in public business pages. GCash, Maya or QR Ph receiving details and QR files are also restricted in the current private workspace. Choosing payment at the venue does not require submitting documents here.

Your business information and optional documents

Private business setup and verification documents are protected by authenticated access, business-specific database permissions and private file storage. Other businesses cannot access your private records. Saving a private draft does not publish it.

We request business documents only when you choose to display a GCash, Maya or QR Ph receiving number or payment QR so customers can pay your business directly. If customers pay at the venue, you can skip document submission. Using a promotional QR that opens your business website does not require receiving-account verification.

Submitted registration, branch permits and applicable professional credentials are used to review the operator, the relevant establishment and authority over the receiving account. Access is restricted to the business’s authorized owner account and authorized platform verification reviewers. Support access alone does not grant access to these documents. They are not displayed on public business pages.

GCash, Maya or QR Ph receiving details and QR upload remain disabled until approval; your regular business contact number remains available. Payment goes directly to the business, and the platform does not collect, hold or transfer customer booking funds. These choices do not remove a business’s legal responsibility to hold the permits and licences required to operate.

3. Why information is used

Current uses include creating and securing owner accounts, confirming sign-in, saving private business setup, controlling access and recording relevant changes. The final notice must specify the applicable lawful basis for each purpose. Reading this notice is not blanket consent to unrelated processing or marketing.

4. Access, providers and public visibility

Supabase currently supports authentication, database records and private file storage in the development environment. Authorized account access is limited to the business and branches the person is authorized to access. The website is hosted through ChatGPT Sites. Access to this review site is restricted to its owner. No owner’s private draft becomes a public listing just because it was saved.

A final provider and data-location assessment must cover hosting, email delivery, storage, access by platform staff and any cross-border processing. Public listing fields and the publishing choice must be explained before publication. Private receipts, permits and customer lists must not be included in public listings.

Booking and support records

Booking requests include contact details, the selected service and time, a private access code and change requests. The booking service also uses a private visitor cookie and hashed request identifiers to limit automated requests. These controls are separate from advertising. Keep your access code private. Staff scheduling notes and actions include the responsible account and time. Support conversations are restricted to the business and authorized support staff. Do not submit medical records or confidential case facts.

Fictional sample bookings are kept in browser-tab session storage for up to 24 hours or until removed. Receipt files in those examples are not uploaded. Real booking records and staff activity are separate and retained under the operational retention policy, which must be finalized before public launch.

5. Cookies, maps and external links

Authentication uses cookies to maintain your session. This preview has no configured advertising or marketing analytics. Embedded Google Maps loads when you choose to show a configured map; loading it or following an external link can share connection information with that provider under its own privacy terms.

Branch maps

Embedded branch maps load only when you choose to show them. Loading a map or opening a Google Maps link connects to Google, which handles connection information under its own privacy policy. This website does not request your device’s current location to display a branch map. The business supplies its address, map pin and arrival instructions; fictional examples use clearly labelled area maps, not real venue pins.

6. Retention and security

Retention periods, deletion schedules, backup retention and account-closure procedures have not yet been finalized. Removing an image from the active gallery does not necessarily erase its stored file or history. A complete retention and deletion process must be established before launch.

Current safeguards include authenticated private access, database permission controls and private media storage. Security review, backup recovery and incident-response arrangements remain release requirements. No system can promise absolute security.

7. Your rights and privacy requests

Under applicable Philippine privacy law, rights may include being informed, access, correction, objection, erasure or blocking, data portability and filing a complaint, subject to the relevant conditions. The platform privacy contact and identity-checking process for requests must be provided before public launch; there is no operational request channel on this preview page.

For information about these rights and complaint procedures, visit the National Privacy Commission.

8. Sensitive information and changes

Do not upload clinical records, diagnoses, confidential legal case information or unrelated identity documents to this preview. Healthcare and other sensitive workflows require a separate privacy and security assessment before live use. When the service’s data handling changes, the notice must be updated and any required separate choice or consent obtained.