Law Enforcement & Legal Requests

Swipaw is where Filipino pet lovers find playdates, studs, pet hotels and groomers, and keeping that community safe sometimes means working with the authorities 🐾 These guidelines tell police, prosecutors, courts, regulators and lawyers how to reach us, what we can provide and which legal instrument each kind of data needs. They also show our members that their messages and records leave Swipaw only when the law truly requires it.

In short: Send legal process to [email protected] with its legal basis. Message content needs a court warrant (walang warrant, walang message content); account and connection records need a warrant or a request that a law expressly allows. We preserve data when asked and keep that confidential, aim to answer within 72 hours, act fast in emergencies with our Data Protection Officer's approval, tell members unless the law or a court forbids it, and route foreign requests through the Department of Justice.

1. About these guidelines#

1. Swipaw is operated by Parada Technologies Inc. (SEC registration no. (to be published)), a Philippine corporation with its registered office at 24 Sheridan Towers North, Buayang Bato, Mandaluyong City, Metro Manila 1550, Philippines ("Swipaw", "we", "us"). These guidelines (the "Guidelines") cover requests to disclose or preserve data about Swipaw members, or to remove content, made by Philippine law-enforcement agencies, prosecutors, courts and regulators (each an "Authority"), by foreign authorities and by private parties.
2. We treat Swipaw as a service provider under the Cybercrime Prevention Act of 2012 (Republic Act No. 10175) and process members' personal data as a personal information controller under the Data Privacy Act of 2012 (RA 10173). We disclose personal data only on a legal basis set out here, and only what that basis requires.
3. These Guidelines work with our Terms of Service, Privacy Notice and Community Guidelines. They waive no objection, privilege or right that we or our members have; where a law or court order requires something different, the law or the order prevails.
4. This channel is for legal process: members report content through the Report option where the app shows it or at [email protected], and ask for their own data under the Privacy Notice.

2. How to send a request#

1. Send warrants, orders, subpoenas, preservation requests and removal notices to [email protected], ideally from an official government address, as a signed document on official letterhead or the issuing court's form. Court processes may also be served at our registered office; e-mail a copy too so we can start at once. We reply with a reference number.
2. A request should state: (a) the Authority, and the requesting officer's full name, rank or position, badge or ID number, official e-mail and telephone number; (b) the case or docket number and the offence or matter under investigation; (c) the legal basis, with a copy of the warrant, order or subpoena, or the provision of law relied on; (d) each account concerned, by profile link, @handle, registered e-mail or mobile number, or a listing, booking or payment-acknowledgement number; (e) the data sought and the period it covers, as narrowly as the case allows; and (f) any deadline, and whether a law or court bars us from telling the member, with the basis.
3. We verify every request, for example by calling the issuing office on its published numbers. We may ask for missing details, a narrower scope, information about the case, or a written undertaking that the data will be used only for the stated purpose, as the National Privacy Commission's advisory on requests from government agencies (NPC Advisory No. 2026-002) contemplates.
4. We do not act on requests made only by telephone, social media, in-app chat or support ticket, or sent from a personal e-mail account. Emergencies follow section 7.

3. What we hold, and what we don't#

1. Depending on how a member uses Swipaw, we may hold the following (the first three terms are used as in RA 10175 and its implementing rules):

2. When a member deletes their account, we anonymise it 14 days later and wipe the message content they sent, unless a legal hold (our record that data must be kept for a legal reason) covers it. A sealed, encrypted record of the account's identity details, sessions, IP addresses and message metadata, never message content, is kept for 6 months and can be opened only through the process in section 8.
3. Payments. Members pay on the hosted checkout of Xendit Philippines, Inc. ("Xendit"), so we never hold full card numbers, card security codes or e-wallet and bank log-in details. Under Payment Protection, Xendit collects each payment into the provider's Xendit sub-account and holds it there until the service is done, splitting off our commission at release; orders to freeze or seize funds should therefore also be served on Xendit. If an order covers a member's earnings, we can also hold that member's payouts while it is in force.
4. What we do not hold. Content of a conversation that closed more than 180 days earlier, or of a message its sender deleted soon after sending, unless a legal hold came first; full ID numbers, and ID and selfie images more than 30 days after approval; GPS and other photo metadata, which we strip on upload; a location history, since the app reads device location only with permission while it is open and we keep only the latest saved point; voice or video calls, which Swipaw does not carry; and anything members exchange outside Swipaw.

4. Which instrument reaches which data#

1. The 1987 Constitution protects the privacy of communication (Article III, Section 3), so we disclose content data only under a court warrant, either a Warrant to Disclose Computer Data ("WDCD") or a Warrant to Search, Seize and Examine Computer Data ("WSSECD") under the Rule on Cybercrime Warrants (A.M. No. 17-11-03-SC), or under another court order that expressly covers content. The one exception is content a law requires us to report on our own initiative, such as child sexual abuse or exploitation material (section 6).
2. Under Section 14 of RA 10175, an Authority also needs a court warrant to require us to disclose subscriber information or traffic data for a cybercrime investigation, including one for cyber-libel.
3. Each instrument reaches only the data shown:

4. Regulators acting under their own laws, such as the National Privacy Commission, the Department of Trade and Industry or the Bureau of Internal Revenue, receive what that law empowers them to require, within the same limit on content data.
5. Interception. We have no standing facility to intercept communications in real time. On a Warrant to Intercept Computer Data ("WICD") we work with the officers named in it to give the technical help it requires, as far as our systems allow; please contact us as soon as it issues.
6. A Warrant to Examine Computer Data ("WECD") covers a device already in an Authority's custody; records on our own systems still need a WDCD or WSSECD.
7. Our data is hosted in Singapore (DigitalOcean sgp1, AWS ap-southeast-1) and MongoDB Atlas. We accept the warrants and orders of Philippine courts for the data we control there.
8. We do not run broad searches across members who are not identified in a request, such as everyone in an area or everyone who used a word, except where a law requires it.

5. Preservation requests#

1. Under Section 13 of RA 10175 and the Rule on Cybercrime Warrants, a law-enforcement Authority may order us to preserve data without a court order. We preserve the content data identified for six months from receipt of the order, and for six months more on a one-time extension order. Once preserved data is used as evidence, a copy of its transmittal to the prosecutor keeps it preserved until the case ends.
2. Subscriber information and traffic data are kept for at least six months from each transaction, as Section 13 requires (section 3), and a preservation order holds them for the period above.
3. For a preservation order under RA 11930 or RA 11862, we hold the data covered for one year, and longer when the Authority extends it as those laws allow.
4. Our deletion, anonymisation and retention jobs skip held data, including when the member deletes their account. Preservation discloses nothing: preserved data is released only under section 4.
5. We keep the order and our compliance confidential and do not tell the member while it is in force.
6. When the period ends without a further order, the hold lapses and the data is deleted on our normal schedule (Privacy Notice, section 7).

6. Child safety, trafficking and other illegal content#

1. Our Terms and Community Guidelines prohibit child trafficking, child sexual abuse or exploitation material and the sexual exploitation of children, as RA 11862 requires.
2. Send removal notices to [email protected] with links to the content. On notice from an Authority, or any notice that identifies the content, we remove or block child sexual abuse or exploitation material, other online sexual abuse or exploitation of children and trafficking content within 24 hours of receipt, and put the evidence and the account behind it under a legal hold (RA 11930; RA 11862).
3. We report such content, with the facts we hold, to the DOJ Office of Cybercrime, the PNP or the NBI within three days of removal, as RA 11930 and RA 11862 require, well inside the seven days that RA 9775 and the implementing rules of RA 10175 allow. On an Authority's request we furnish the particulars we hold of members who sent, received or accessed the material.
4. Intimate images shared without consent are removed on report, and we share them with anyone, Authorities included, only under a court order, as the Anti-Photo and Video Voyeurism Act of 2009 (RA 9995) requires.
5. Takedown orders of a court, or of the Department of Trade and Industry under the Internet Transactions Act of 2023 (RA 11967), are carried out promptly, subject to any right to be heard the law gives. We report suspected animal cruelty and illegal animal trade to the Bureau of Animal Industry or the PNP and preserve the evidence.

7. Emergencies#

1. If an Authority tells us in writing that a person faces an imminent risk of death or serious physical injury, and that information we hold can help prevent it, we may disclose the minimum needed without a warrant: usually identity and contact details, recent sign-in records and the location or service address we hold, never content data.
2. Write to [email protected] with EMERGENCY at the start of the subject line, stating who is at risk, the nature and immediacy of the danger, how our information will help and how to reach the officer at once. We treat these as our first priority.
3. Our DPO approves each emergency disclosure, and we record the request, the decision, our reasons and what we disclosed. We may ask for the formal instrument afterwards.
4. The same applies when the PNP, the NBI or a deputised animal welfare enforcement officer shows that an animal faces imminent serious harm, such as cruelty in progress or a pet being mistreated during a booking; officers should send their deputation order or ID with the request (Animal Welfare Act, RA 8485, as amended by RA 10631).
5. These disclosures rest on the grounds the Data Privacy Act gives for protecting life and health, public order and safety and the functions of public authorities (Sections 12 and 13). If someone is in danger right now, call 911 first.

8. How we review and answer#

1. Each request is logged in a restricted register that only a small group of authorised staff can open, with a due time 72 hours after receipt.
2. We check that the request is authentic, that the instrument is valid and covers the data sought, and that the disclosure is proportionate to its purpose. If a request is incomplete, unclear or broader than its legal basis, we contact the officer within the 72 hours to resolve it; a request with no legal basis is declined, with our reasons.
3. No data is released until our DPO, or a senior officer acting in the DPO's place, approves the disclosure. Every export, and every opening of a deleted account's sealed record, is written to our audit log before any data is read, and we keep the register and the audit log for at least 5 years.
4. We aim to answer every valid request from an Authority within 72 hours of receipt. Under a WDCD we produce the data within the 72 hours that Section 14 of RA 10175 and the Rule on Cybercrime Warrants require.
5. We produce data electronically, in an encrypted file whose password we send separately, with a list of its files and their SHA-256 hash values. On request we add a certification or affidavit of our records custodian so the records can be authenticated under the Rules on Electronic Evidence (A.M. No. 01-7-01-SC).
6. We do not charge Philippine Authorities for answering requests.

9. Telling our members#

1. Once we have answered, we tell each member concerned by e-mail that an Authority asked for their data, which Authority asked, and whether we disclosed all, part or none of what it sought, so they can seek legal advice.
2. We do not tell them when a law or court order prohibits it, when the request is a preservation order still in force (Section 13 of RA 10175), or when the Authority shows that notice would endanger someone's life or safety, lead to evidence being destroyed or alert a suspect in a child-exploitation or trafficking case. If that reason later ends, we may tell the member then.
3. Please say in the request whether notice is prohibited and why; otherwise clause 1 applies.

10. Requests from outside the Philippines#

1. Foreign authorities should request mutual legal assistance, under a treaty or the Budapest Convention on Cybercrime, through the Philippine Department of Justice, whose Office of Cybercrime is the central authority for international cooperation on cybercrime (RA 10175, Sections 22 and 23). We act on the Philippine warrant, order or request that results.
2. On a direct written request from a foreign law-enforcement agency, we may preserve the data concerned for up to 90 days while the formal request is made, and we disclose nothing until it arrives. Emergencies under section 7 may be raised with us directly, and we may involve the PNP.

11. Civil cases and private parties#

1. Lawyers, litigants, insurers and other private parties cannot obtain a member's data by asking. We produce subscriber information (section 3) only under a subpoena or order of a Philippine court (Rules of Court, Rule 21) or of a tribunal a law empowers to issue one, and content data only on a court order that expressly covers it. In a cybercrime case, such as a cyber-libel complaint over a review, identity records need the warrant described in section 4.
2. Unless the court orders otherwise, we tell the member before we produce, so they can object, and we produce by the date the subpoena sets. We may ask the court to quash or narrow a subpoena that is unreasonable, oppressive or irrelevant, or whose reasonable production cost has not been advanced.
3. Members need no subpoena for their own data. Under the Data Privacy Act any member may download most of it in the app or ask our DPO at [email protected] for a copy, and the DPO answers within 30 working days (Privacy Notice, section 8). A member in a dispute may share their own records with their lawyer.
4. Members in a dispute with another member about a booking or payment should first use our dispute and complaints process (Payments, Held Payments & Refunds Policy and Complaints).

12. Changes and contact#

1. We update these Guidelines when the law or our services change; the version and date above show the text in force.
2. Legal process: [email protected], or Parada Technologies Inc., 24 Sheridan Towers North, Buayang Bato, Mandaluyong City, Metro Manila 1550, Philippines. Privacy questions: [email protected]. Everything else: [email protected].