Privacy & data notice

1. What we collect

• Account data: name, email address, optional mobile number, and password (stored as a hash by Supabase Auth).
• Listing data: vehicle details, photos, the contact number you choose to display, and the OR/CR document you upload for review.
• Usage and safety data: when a signed-in verified account reveals a contact number, when listings are reported, and administrator actions.

2. What is shown publicly

Public listings show the vehicle details, photos (up to 3), the island, the owner's display name, and sponsored status. The owner's contact number is not included in the public page source; it is released only through an audited action available to signed-in accounts with confirmed emails.

3. What is never public

OR/CR documents are stored in a private bucket. Only the owner and Sakyan administrators can access them. They are used solely to verify that a vehicle is properly registered for hire. They are never attached to public listings, search results, or shared with other users.

4. Why we process this data

• To operate the directory and let renters reach vehicle owners.
• To review and moderate listings, including for-hire documents.
• To prevent spam, fraud, and abuse, and to keep an audit trail of admin actions.
• To respond to reports and legal requests.

5. Consent

When you create an account you consent to us processing your account data. When you publish a listing you separately consent to displaying your contact number and vehicle photos publicly. You can remove a listing at any time; the number stops being displayed with it.

6. Your rights under RA 10173

Under the Philippine Data Privacy Act of 2012 you have the right to be informed, to object, to access, to rectify, to erase or block, to damages, and to data portability. To exercise these rights, email privacy@sakyan.ph from the address on your account. We may need to verify your identity before acting.

7. Retention

Account and listing records are kept while the account is active. Removed listings are retained for a reasonable period for moderation and audit purposes. OR/CR documents are deleted from storage when the listing is deleted, unless we must retain them for an ongoing investigation or legal obligation.

8. Security

Access is enforced at the database level: contact numbers, private documents, reports, and audit logs are protected by row-level security. Contact reveals are rate-limited. Suspicious activity is surfaced to administrators. No system is perfectly secure, so please use a unique password and verify details in person.

9. Local development note

This prototype runs on Supabase Local. In local development, confirmation and reset emails are captured by a local mail viewer rather than sent over the internet. Data stays on the machine running the local stack.

10. Contact

Data protection questions: privacy@sakyan.ph.