PRIVACY POLICY

1. Basic Identifiers: Full legal name, email address, mobile telephone number, date of birth, and residential address;

2. Authentication Credentials: A one-way hash of your password (hashed with bcrypt; we never store your password in readable form). Where you choose social login, we do not store your social media password or the provider's OAuth tokens; we retain only the provider name (Google, Facebook, or Apple), the provider-issued user ID, and your email address to link your account;

3. Profile Photo: Profile photograph uploaded by you or retrieved from your social login provider with your consent.

1. Government-issued identification documents (e.g., PhilSys National ID, passport, SSS/UMID, PhilHealth, or postal ID);

2. Driver's license, front and back (number, expiry, issuing authority);

3. A proof of billing / address document;

4. A selfie photograph (a facial image, typically taken while holding your physical identity document). A facial image is treated as Sensitive Personal Information under the DPA and is handled under heightened security controls.

1. Booking references, vehicle selection, rental dates and times, pickup/drop-off location preferences;

2. Reservation fees, balance payments, applied discount and promo codes, affiliate referral data;

3. Booking status history and audit trail (e.g., creation, payment confirmation, operator approval, pickup, return);

4. Walk-in customer information recorded on your behalf by an operator (name, phone, email) where applicable.

1. Payment gateway transaction identifiers and references;

2. Payment method type (e.g., card, e-wallet, QR Ph, online banking);

3. Payment status, amount, and timestamp;

4. For manual or bank-transfer payments, the sender's account name, the transaction reference, and any proof-of-payment image you upload;

5. Billing addresses where provided.

1. Text messages exchanged between users within booking conversations and vehicle inquiry threads;

2. Files and images attached to messages (up to 20 MB per file; images are automatically compressed for delivery);

3. Message timestamps, read receipts, and message status metadata;

4. Customer support correspondence and dispute records.

1. Device identifiers, IP addresses, browser type and version, operating system;

2. Usage data: pages viewed, access times, navigation patterns, vehicle search queries and filters applied;

3. Approximate geolocation (city/region) derived from your IP address, including via Cloudflare edge headers or a fallback IP-geolocation lookup (see Section IV);

4. Precise geolocation (device GPS or browser location), collected only when you actively use a "near me" / "use my location" feature and grant permission, to show nearby vehicles, prefill your city, and set delivery pickup points (see Sections II.H and III.C). You may decline or revoke this permission at any time;

5. HTTP session cookies used for authentication (see Section II.G below);

6. Performance and error monitoring data collected by the New Relic Browser Agent (see Section IV.B).

1. Push Notification Token: A device registration token issued by Firebase Cloud Messaging ("FCM") upon your consent to receive push notifications. This token enables delivery of booking updates, payment confirmations, and operator messages to your device;

2. Device Information: Mobile device model, operating system version, and app version for compatibility and debugging purposes;

3. App Interaction Data: In-app navigation and interaction events, network request metadata, and crash reports collected by the New Relic mobile agent for stability and performance monitoring;

4. Precise Location (optional): With your permission, your device's GPS location, used only while you use a "near me" or delivery-location feature to find nearby vehicles and set pickup points. You may decline or revoke this in your device settings at any time;

5. Over-the-Air Updates: To keep the app current, it may download signed update bundles from our update service; this transmits only the app's current version, not personal data.

1. Creating and managing your account, authenticating your identity, and maintaining platform security;

2. Conducting KYC and identity verification to prevent fraud and protect all platform users;

3. Processing, confirming, and managing vehicle rental bookings;

4. Facilitating payment transactions through our payment gateways (Xendit, PayRex, or PayMate);

5. Enabling real-time communication between customers and operators;

6. Sending transactional notifications (booking confirmations, payment receipts, status updates) via email and push notification;

7. Maintaining booking audit trails for dispute resolution;

8. Compliance with the DPA, Bureau of Internal Revenue requirements, and other applicable Philippine law.

1. Platform performance monitoring and error diagnosis using New Relic APM and Browser Agent;

2. Detection and prevention of fraudulent, abusive, or illegal activity;

3. Security incident investigation and response.

1. Sending promotional communications, special offers, and marketing messages;

2. Delivering push notifications to your mobile device via Firebase;

3. Accessing your device's precise location to show nearby vehicles and set delivery pickup points;

4. Market research, surveys, and user experience studies;

5. Personalized vehicle recommendations and content.

1. Transport Layer Security (TLS 1.2/1.3) encryption for all data in transit;

2. Encryption at rest for all stored data including KYC documents and selfie images;

3. HttpOnly, Secure-flagged authentication cookies, not accessible to client-side scripts;

4. Short-lived JWT access tokens with automated refresh token rotation;

5. API rate limiting on all authentication endpoints to mitigate brute-force attacks;

6. HMAC-SHA256 authentication for internal service-to-service communication;

7. Automated malware/virus scanning (ClamAV) of files uploaded to the Platform;

8. Regular security assessments and dependency auditing;

9. Intrusion detection systems and real-time monitoring via New Relic.

1. Role-based access controls and the principle of least privilege for all system access;

2. Confidentiality and data processing agreements with all personnel and contractors;

3. Mandatory data protection awareness training;

4. Documented incident response and breach notification procedures in accordance with NPC Circular 16-03.

1. Notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, where feasible, as required by NPC Circular 16-03;

2. Notify affected data subjects within thirty (30) calendar days from the discovery of the breach, providing: a description of the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to be taken to address the breach;

3. Maintain a record of all breaches, including those not required to be notified, for audit and regulatory purposes.