Privacy Policy

Plain-language summary

We are Regalo. We help local shops in Zamboanga City run digital loyalty cards. To do this, we keep your email, your name, the shops you visit, and the rewards you earn. We do not sell your data. We do not share it with advertisers. You can delete your account anytime and your data goes with it within 7 days.

This Privacy Policy explains the details. If anything is unclear, email hello@regaloapp.ph and we will explain in plain English, Tagalog, or Chavacano.

1. Who we are

Regalo is operated by Aaron Fernandez Rufer, sole proprietor, with office at FRZ District, Baliwasan Grande, Zamboanga City, Philippines. We are the data controller responsible for your personal information under the Philippines Data Privacy Act of 2012 (Republic Act 10173).

For privacy questions, contact us at hello@regaloapp.ph. We respond within 5 business days.

2. What we collect

When you create a Regalo account, we collect:

• Email address (required, for login and notifications)
• Full name (required, so shop owners know who they served)
• Phone number (optional, for account recovery)
• Language preference (required, for app interface)

When you use Regalo, we automatically collect:

• Which shops you visit and when (each scan creates a record)
• Stamps you earn, vouchers you claim, rewards you redeem
• Reviews and ratings you submit
• Approximate location only when you actively use the Map feature (your phone asks permission first)

We do NOT collect:

• Your contacts, photos, messages, or call history
• Background location (we never track where you are when the app is closed)
• Payment information (Regalo never processes payments; you pay shops in cash, GCash, or however you usually do)
• Health, biometric, or other sensitive personal information as defined by the NPC

3. Why we collect it

We use your data only for these purposes:

• Provide the loyalty service (track your stamps, deliver your rewards)
• Show you relevant shops, vouchers, and notifications
• Prevent fraud (detect impossible stamp patterns, block disposable email signups)
• Improve the app based on usage patterns (always anonymized)
• Respond to your questions and support requests
• Comply with Philippine law when required by a valid court order or NPC directive

4. Who we share with

Shop owners (vendors) you visit see your first name and visit count. They do NOT see your email, phone, or full name. This is the only sharing that happens automatically.

We share with third-party service providers only as needed to run the service:

• Supabase (database and authentication, hosted in Singapore)
• Cloudflare (content delivery and security)
• Google Maps (only loads when you open the Map feature)
• Email delivery service (only when we send you account-related emails)

We do NOT share with advertisers. We do NOT sell your data. We do NOT use your data for advertising profiling.

We share with law enforcement only when required by a valid Philippine court order, subpoena, or NPC directive. We will notify you unless legally prohibited.

5. How long we keep it

• Account data (email, name): as long as your account is active
• Stamp and voucher history: as long as your account is active, or 2 years from your last activity, whichever is longer
• Reviews you posted: kept until you delete them or your account
• Fraud detection logs: 2 years (for security and dispute resolution)
• Anonymized usage statistics: indefinitely (no personal data, used to improve the app)

When you delete your account, your personal data is permanently removed within 7 days. Anonymized statistics may remain.

6. Your rights under Philippine law

Under the Data Privacy Act of 2012, you have the right to:

• Be informed about how we use your data (this policy)
• Access the personal data we hold about you (email us to request a copy)
• Object to processing for any specific purpose
• Correct inaccurate or outdated information
• Erase or block data that is no longer needed
• Data portability (receive your data in a machine-readable format)
• File a complaint with the National Privacy Commission
• Damages for inaccurate, false, unlawfully obtained, or unauthorized use of your personal data

To exercise any of these rights, email hello@regaloapp.ph. We respond within 5 business days.

If you are not satisfied with our response, you may file a complaint with the National Privacy Commission at privacy.gov.ph.

7. How we protect your data

We use industry-standard security measures:

• All data is encrypted in transit (HTTPS)
• Passwords are hashed (we cannot see your password)
• Database access is restricted by role-based access control
• We log all administrative actions for audit purposes
• Regular security reviews

Despite our efforts, no system is 100 percent secure. If we discover a data breach affecting your personal data, we will notify you within 72 hours and report it to the NPC as required by law.

8. Children

Regalo is not directed at children under 13. We do not knowingly collect data from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please email hello@regaloapp.ph and we will delete it promptly.

Users aged 13 to 17 may use Regalo with parental consent.

9. International data transfer

Your data may be stored on servers located outside the Philippines, primarily in Singapore (our database provider) and other locations our hosting providers operate in. We ensure adequate protection by using providers that comply with international data protection standards.

10. Changes to this policy

If we make significant changes to this policy, we will notify you by email and through an in-app notification at least 30 days before the changes take effect. Continued use of Regalo after the changes means you accept the new policy.

Minor clarifications (typos, formatting) may be made without notification.

11. Contact us

For any privacy concern, question, or to exercise your rights:

• Aaron Fernandez Rufer
• Regalo, Sole Proprietor
• FRZ District, Baliwasan Grande
• Zamboanga City, Philippines
• Email: hello@regaloapp.ph