CvStay PH logoCvStay PHDorms near CvSU

Privacy Policy

Last updated 2026-09-17

CvStay PH ("we", "us") is the Personal Information Controller for data collected through cvstayph.vercel.app and the CvStay PH app. This policy explains what we collect, why, how long we keep it, and your rights under the Data Privacy Act of 2012 (RA 10173) and the issuances of the National Privacy Commission (NPC).

1. Data we collect

  • Account data: name, email, mobile number, role (student or landlord), and the date you last signed in.
  • Google sign-in: if you sign in with Google, we receive your name, email, and profile photo from Google. We never see your Google password.
  • Student preferences (optional): gender, hometown, budget, and what you bring (pets, computer, own foam), used only to recommend listings.
  • Landlord verification (optional): government ID, DTI or SEC certificate, BIR Certificate of Registration, Mayor's Permit. Needed only for the Verified badge.
  • Listing data: property address, barangay, map pin, photos, amenities, price, beds, rules.
  • Bookings and reviews: requests, acceptances, receipts you upload, and reviews with any proof photo.
  • Messages: in-app messages between students and landlords.
  • Device and usage logs: IP address, browser, device type, pages visited, and errors, through Vercel hosting and Vercel Web Analytics (which does not use cookies or track you across sites).
  • Admin actions: when an administrator approves, rejects, or removes something, the administrator's email and the action are recorded.

2. Why we collect it (purposes and lawful basis)

  • Contract performance: to create your account, show listings, connect you with a landlord or student, and send service messages.
  • Consent and legitimate interests: to verify landlord legitimacy, recommend listings from your preferences, and prevent fraud.
  • Legal obligation and legitimate interests: to prevent scams, abuse, and non-consensual content, and to keep an audit trail of moderation.
  • Legal obligation: to respond to complaints, subpoenas, and official requests.
  • Separate opt-in: marketing messages go only to users who explicitly opt in. We send none today.

3. Who receives your data

  • Other platform users: only what you choose to share (your public profile, listing content, the messages you send). Verification documents are never shown to other users; only the resulting badge is.
  • Our processors: Supabase (database, authentication, file storage), Vercel (hosting, analytics, scheduled jobs), Google (sign-in, if you use it), Cloudflare (bot protection on sign-in forms), Resend (email, once enabled), PayMongo (landlord subscriptions, once enabled).
  • Regulators and authorities: law enforcement, NPC, DTI, BIR, when legally required.

Some processors store data outside the Philippines. Each is bound by its own data-processing terms, which we rely on under the Act.

4. How long we keep it

  • Active accounts: for as long as you use the account.
  • Inactive accounts: after 60 days without a sign-in we email you weekly. At 90 days the account moves to a recycle bin for 45 days, then it and its data are deleted. Signing in at any point restores it. Accounts with a paid plan are never deleted this way.
  • Accounts you delete yourself: recoverable for 30 days, then deleted.
  • Listings you delete: kept in a recycle bin for 7 days, then deleted with their photos.
  • Verification documents: up to 2 years after review, then deleted.
  • Messages: 2 years after the conversation ends.
  • Subscription records: 5 years, the BIR retention period.
  • Server and error logs: 30 days.

5. Cookies

We use only the cookies needed to keep you signed in (Supabase Auth) and the Cloudflare Turnstile cookie that protects the sign-in forms. Vercel Web Analytics is cookieless. Your browser may also keep small preferences for this site (dismissed prompts, time on site) in local storage; they never leave your device. See the Cookie Policy.

6. Your rights under the Data Privacy Act

You have the right to be informed, to object, to access, to rectify, to erase or block, to damages, to data portability, and to file a complaint with the NPC. You can delete your own account from your profile page at any time.

7. Contact the Data Protection Officer

Email: cvstayph@gmail.com

If we do not resolve your concern within a reasonable time, you may escalate to the National Privacy Commission at privacy.gov.ph.

8. Security

Access is controlled by database row-level security, so each user can only reach their own data. Data is encrypted in transit. Sessions end 3 days after sign-in and email passwords must be renewed every 30 days. Sensitive documents are logged when viewed. We will notify the NPC and affected users within 72 hours if a breach of sensitive personal information occurs.

9. Children

CvStay PH is intended for users 18 and over. If you are under 18, a parent or legal guardian must use the platform on your behalf.

This draft is informed by NPC Circular 2022-04, NPC Circular 2022-01, NPC Circular 2023-04 (Consent), NPC Circular 2023-06 (Security), and the Data Privacy Act IRR. Counsel will finalize it before the 2027 business registration.