Draft — review by counsel before launch. This document is a working draft for our Philippine pilot. Items in [square brackets] are placeholders to be completed by our legal team, and the final version may change.
Your privacy matters to us — and to Mingming, who guards her nap spot fiercely 🐱 This Privacy Notice explains how [Registered company name] ("Swipaw", "we", "us") processes personal data when you use the Swipaw apps, website and related services (the "Platform"), in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).
In short: we collect what we need to run a safe pet marketplace, we never sell your data, ID documents and payout details are encrypted and seen only by our review team, your exact address stays hidden until a booking is confirmed, and you can access, export, correct or delete your data at any time.
1. Who we are#
- Personal information controller: [Registered company name], [Registered office address], NPC registration no. [NPC registration no., if required].
- Data Protection Officer (DPO): [DPO name]. Reach our DPO at [email protected] (subject: "Data Privacy") or through our contact form.
2. The personal data we collect#
Information you give us#
- Account: name, e-mail address, mobile number, password (stored only as a one-way hash), the sign-in providers you link (Google, Facebook, Apple) and your confirmation that you are 18 or older.
- Profile and preferences: display name, photo, the answers you give in the sign-up journey (your buddy, what you are here for, how far to look), notification settings and your city and province.
- Pets: photos and videos, breed, sex, birthdate, size, personality, health notes, vaccination records and pedigree papers.
- Location: the approximate location used for distance features (shown to others only as your city, or as a point moved a few hundred metres away from you), and your exact address if you add one — kept private until a booking with you is confirmed.
- Verification (KYC): images of your government ID (front and back), a selfie holding the ID, your legal name, birthdate, ID type, ID expiry, the last four digits of the ID number and your address (with optional proof). Stud owners add vaccination cards; businesses and shelters add their registration and permit documents.
- Bookings and payments: requests, offers, bookings, reviews, refunds and disputes; payout account holder name, channel and account number.
- Messages and support: chat messages and attachments, support tickets, contact-form messages, and questions typed into the "Ask Swipaw 🐾" chatbot (stored as normalised text, without your identity).
- Community: posts, comments, events, lost & found reports and sightings (a sighting may include the name and number you choose to share), memorial tributes, donations (amount, frequency, message and whether you give anonymously) and adoption applications.
Information collected automatically#
- Device and usage: a random device ID, app version, platform, IP address, push-notification tokens, your active sessions, security events (sign-ins, failed attempts, rate limits) and how features are used — for example, how many guests go on to sign up.
- Cookies and local storage: see section 10.
Information from others#
- Sign-in providers: your name, e-mail and profile photo, according to your settings with them.
- Xendit, our payment partner: payment status and a masked description of the payment method.
- Other users: reports, reviews and referrals that mention you.
Government-issued identifiers in your ID documents are sensitive personal information under RA 10173. We process them only for verification, with your consent and where the law requires it, and protect them with the extra safeguards in section 6.
3. Why we use your data, and on what basis#
| Purpose | Data used | Lawful basis (RA 10173, Sections 12 and 13) |
|---|---|---|
| Create, run and secure your account | Account, device and security data | Performance of our contract with you; our legitimate interest in keeping the Platform secure |
| Show profiles, the swipe deck, matches and search results | Profile, pet and approximate location data | Contract |
| Verify identity and award trust badges | KYC data | Your consent; compliance with law (including verifying sellers in an online marketplace); preventing fraud |
| Take payments, hold escrow, pay out, refund and issue receipts | Booking and payment data | Contract; legal obligations under tax and accounting laws |
| Chat, notifications and customer support | Messages, tickets, push tokens, contact details | Contract; legitimate interest |
| Keep the community safe: reports, moderation, fraud prevention and audit logs | The data involved in the report or incident | Legitimate interest; legal obligations |
| Lost & found alerts to people nearby | Report details and approximate location | Your request when you post the alert |
| Marketing e-mails and the weekly digest | E-mail address and preferences | Your consent — withdraw it at any time |
| Analytics and product improvement | Pseudonymous usage data | Legitimate interest |
| Legal claims and requests from authorities | Whatever the matter requires | Legal obligation; establishing, exercising or defending legal claims |
4. Who can see your data#
- Other users see your public profile: display name, photo, badges, city-level location, your pets and your reviews — never your e-mail, phone number or exact address. The other party to a confirmed booking sees the address and details needed to deliver that booking.
- Foundations you donate to see your name and message, or "Anonymous" if you choose. Shelters and owners see the adoption applications you send them.
- Service providers who work for us, only on our instructions and under data-sharing or outsourcing agreements: payment processing (Xendit), cloud hosting (DigitalOcean), file storage (Amazon Web Services), e-mail delivery (our SMTP provider), SMS one-time codes (Semaphore or Twilio), push notifications (Expo and the Apple and Google push services), and the sign-in providers you choose.
- Authorities, when the law, a court order or a lawful government request requires it, or to protect someone's life, safety or property — including an animal's.
- A successor company, if Swipaw is merged or acquired; we will tell you before your data becomes subject to a different privacy notice.
We never sell your personal data or share it for third-party advertising.
5. Transfers outside the Philippines#
Some of our service providers store or process data outside the Philippines (for example in Singapore or the United States). We remain responsible for your data under Section 21 of RA 10173 and require these providers, by contract, to protect it to a standard comparable to Philippine law.
6. How we protect your data#
- Connections to the Platform are encrypted (TLS), and stored data is encrypted at rest.
- Chat messages, KYC details and payout account numbers get an extra layer of application-level encryption (AES-256-GCM); only a masked account number is ever shown.
- Files live in a private storage bucket and are served through short-lived signed links (at most 15 minutes; 120 seconds for KYC images, which reviewers see watermarked). Location data is stripped from public photos.
- Passwords are stored only as one-way hashes. Staff accounts must use two-factor authentication, and staff access follows the least-privilege principle.
- Viewing sensitive data is recorded in an audit log. Staff can open a chat only when a report or dispute references it, and that access is logged too.
- If a personal data breach is likely to put you at real risk, we will notify you and the NPC within 72 hours of knowing about it, as NPC rules require.
7. How long we keep it#
| Data | How long we keep it |
|---|---|
| Account and profile | While your account is active. When you delete your account, it is hidden right away and anonymised after 14 days (you can restore it before then). |
| KYC documents | While needed to verify you and run your account. Rejected submissions are deleted after 90 days; documents of deleted accounts are deleted with the account, unless an open dispute, investigation or legal claim requires them. |
| Chat messages | For as long as the conversation is needed to provide the service and resolve disputes [retention period to be confirmed by counsel]. |
| Bookings, payments, payouts and receipts | As long as Philippine tax and accounting laws require [proposed: 10 years — counsel to confirm], without your profile details once your account is anonymised. |
| Support tickets and contact-form messages | Up to 3 years after the ticket is closed [proposed — counsel to confirm]. |
| Security and audit logs | Up to 2 years, longer if an investigation needs them [proposed — counsel to confirm]. |
| Chatbot questions | Kept as normalised text with no link to your identity. |
| Marketing preferences | Until you change them or delete your account. |
8. Your rights as a data subject#
Under RA 10173 you have the right to be informed, to access your data, to object to processing, to have it corrected, to have it erased or blocked, to data portability, to claim damages, and to file a complaint with the National Privacy Commission.
- See and export your data: request a copy from Settings → Privacy & data → Download your data. You can ask once every 24 hours; the download link we send is valid for 15 minutes.
- Correct it: edit your profile and pets at any time, or ask us to fix something you cannot change yourself.
- Delete it: use Settings → Privacy & data → Delete my account (with a 14-day grace period), or ask our DPO to erase or block specific data.
- Withdraw consent or object: change your notification and marketing settings, or write to our DPO. Withdrawing consent does not affect processing that already happened.
We respond to requests as quickly as we can and within the period NPC rules require. We may need to confirm your identity first. If you are not satisfied with our answer, you can file a complaint with the National Privacy Commission (https://privacy.gov.ph (opens in a new tab)).
9. Children#
Swipaw is for adults 18 and older. We do not knowingly collect personal data from minors. If you believe a minor has created an account, tell us at [email protected] and we will delete it.
10. Cookies and similar technologies#
We use only what the Platform needs to work and to stay secure — no advertising or cross-site tracking cookies.
| Name | What it does | How long |
|---|---|---|
sw_access (cookie) | Keeps you signed in | 15 minutes |
sw_refresh (cookie) | Renews your sign-in securely | Up to 30 days (12 hours for staff accounts) |
sw_csrf (cookie) | Protects your actions against cross-site request forgery | As long as your sign-in |
sw_oauth (cookie) | Protects sign-in with Google, Facebook or Apple | 10 minutes |
| Theme (local storage) | Remembers light or dark mode | Until you clear it |
| Device ID (local storage) | Security rate limits, guest analytics and remembering banners you dismissed | Until you clear it |
| Sign-up progress and return page (local and session storage) | Lets you resume the sign-up journey and returns you to the page you wanted after signing in | Until you finish, or the tab closes |
Blocking these cookies in your browser will stop sign-in from working.
11. Notifications and marketing#
You choose which categories reach you by push, e-mail or in-app notification, and quiet hours hold pushes until morning (urgent lost-pet and security alerts may still come through). We send marketing only if you opt in, and every marketing e-mail has an unsubscribe link. Notices about your account and payments always stay in your in-app inbox.
12. Automated processing#
The swipe deck and search use your filters, location and activity to rank results. The chatbot matches your question to our FAQ. Messages that look like they share contact details get a gentle automatic warning. These features do not make decisions with legal or similarly significant effects about you — identity verification and dispute decisions are always made by people.
13. Changes to this notice#
We will update this notice when our practices or the law change, and tell you in the app or by e-mail before a material change takes effect. The date at the top shows the latest version.
14. Contact us#
Questions, requests or concerns? Write to our Data Protection Officer at [email protected] (subject: "Data Privacy"), use our contact form, or send mail to [Registered office address]. Salamat for trusting us with your data — and with your buddy! 🐾