privacy policy

this privacy policy describes how cravelyscout (“we”, “our”, or “us”) collects, uses, discloses, and protects information about you when you use the service. we handle personal data in accordance with the data privacy act of 2012 (ra 10173) and its implementing rules and regulations.

we collect only what is necessary to run the service:

• account: your email address and a securely hashed password
• business: business name, business type, description, physical address, geographic coordinates (latitude and longitude), hours of operation, menu items and prices, photos, payment methods, features, and any awards you choose to publish
• usage: aggregated page views and menu views of your public store page, used to power your owner analytics
• technical: ip address (for rate limiting and security), browser and device information (for debugging via sentry, only when errors occur)

• to provide the service, including displaying your business on the public directory
• to send transactional emails (account verification, security alerts, service updates)
• to prevent abuse and enforce our terms of service
• to improve the service based on aggregated usage patterns
• to comply with legal obligations under philippine law

we do not sell your personal data. we share limited data only with:

• service providers acting as our data processors - supabase (database, authentication, hosting), upstash (rate limiting), sentry (error tracking), and vercel (hosting infrastructure). each is engaged under agreements consistent with the data privacy act.
• public visitors of the directory - your published business information (name, menu, hours, location, contact details) is intentionally public once you publish your listing.
• authorities - when required by valid philippine legal process (court order, subpoena, or lawful government request).

as a data subject you have the right to:

• be informed of how your personal data is processed
• object to the processing of your personal data
• access your personal data we hold
• correct or rectify inaccuracies in your data
• erase or block your data where legally permitted
• data portability - obtain your data in a machine-readable format
• file a complaint with the national privacy commission

to exercise any of these rights, email cravelyscout@gmail.com. we will respond within a reasonable time frame consistent with the data privacy act.

• encryption in transit (https for all traffic)
• encryption at rest for stored data
• row-level security on our database, so owners can only access their own records
• authentication tokens with rotation and secure storage
• regular reviews of access controls

we retain your data for as long as your account is active. if you close your account, we will delete your personal data within ninety (90) days, except where retention is required by law or necessary to resolve disputes. anonymized, aggregated analytics may be retained indefinitely.

we use only essential cookies:

• authentication cookies (sb-*) to keep you signed in
• theme preference (light or dark mode)

we do not use tracking cookies, advertising pixels, or third-party marketing analytics.

some of our service providers process data on servers located outside the philippines (typically in the united states or the european union). we require these providers to maintain a level of data protection at least equivalent to that required by the data privacy act.

cravelyscout is intended for use by adults (18 and older) or by adults acting on behalf of a registered food business. we do not knowingly collect personal data from anyone under 18.

we may update this policy from time to time. material changes will be communicated by email or in-app at least thirty (30) days before they take effect.

for questions about this policy or to exercise your rights under the data privacy act:

• email: cravelyscout@gmail.com
• national privacy commission (independent authority): privacy.gov.ph