Privacy Policy

1. Who we are

Talipapa is an online marketplace in the Philippines. Like a local wet market, it connects fish, vegetable and produce vendors with buyers in their community.

Talipapa is operated by Talipapa, Ilocos Norte, Philippines. We are the personal information controller for the information described in this policy. We have designated a Data Protection Officer, Talipapa, who handles privacy questions and requests. You can reach the Data Protection Officer, Talipapa about anything in this policy, including privacy requests, at [email protected].

2. Information we collect

Information you give us

• Account details: your first, middle and last name, email address, and either a password (stored only in scrambled, hashed form) or your Google sign-in ID if you sign in with Google.
• Profile: your profile photo and cover photo.
• Address: street, barangay, city or municipality, and province.
• Store details: if you sell, your store name, description, location, logo and banner.
• Listings: the posts you create and their photos. We resize and re-encode photos when you upload them, which removes hidden data such as GPS location from the image file.
• Activity: your comments, reactions, reviews and any reports you make about reviews.
• Buy requests: the items and quantities you ask for. Your location or address is shared with the seller only after the seller accepts your request.
• Payments: when paid plans are available, the name and email you give at checkout, and records of what you paid for, the amount, date, status, payment method and PayMongo reference numbers. Payments are processed by PayMongo. We do not see or store your full card number or e-wallet credentials.

Information created as you use Talipapa

• Notifications: the alerts we send you, such as new comments, reactions, and accepted or declined requests.
• Push tokens: if you turn on notifications, a Web Push subscription from your browser or a device token from the Android app (through Firebase Cloud Messaging) so we can deliver them.
• Technical data: your IP address, device and browser type (user agent), and logs we use to keep the service secure and to limit repeated actions (rate limiting).

Sensitive personal information

We do not ask for sensitive personal information, such as government-issued ID numbers, health, religious, political or financial account details, and we do not need it to use Talipapa. Please do not post it in your profile, listings or comments. Information you choose to make public (for example, in a store description or comment) can be seen by others.

3. Device permissions

The Android app and the installed web app may ask for these permissions. Each one is optional, and you can turn it off at any time in your device or browser settings. Talipapa still works without them, though some features, such as sharing your location on a buy request or receiving push alerts, will not be available.

• Camera: used only when you choose to take a photo, for example for a listing or your profile.
• Location: used only when you choose to share it on a buy request.
• Notifications: used only if you turn them on.

4. Why we use your information

The Data Privacy Act requires us to have a lawful basis for each use of your information. This table shows what we use it for and the basis we rely on.

We use your information only for these purposes, and only as much as we need. If we want to use it for a new purpose, we will tell you first and, where required, ask for your consent.

Consent and how to withdraw it

Where we rely on your consent (camera, location and notifications), we ask for it separately, at the moment the feature is used, and you can say no. You can withdraw consent at any time by turning the permission off in your device or browser settings, by turning off notifications in Talipapa, or by emailing our Data Protection Officer, Talipapa at [email protected]. Withdrawing does not affect what we did before you withdrew, and it only affects the feature that needed that consent.

Automated decisions and profiling

We do not make decisions about you using automated processing that has legal or similarly significant effects, and we do not profile you for advertising. We use automatic rate limits and spam checks to protect the service.

5. What other people can see

• Your public profile (your name, profile and cover photos, city, and listings) is visible to signed-in users.
• Your email address, street and barangay are never shown publicly.
• Store owners can hide their personal name from their store and show only the store's identity.
• A buyer's location is shared only with the seller, and only after the seller accepts the request. Once shared, the seller has that information and is responsible for how they use it.
• Comments, reactions and reviews you post can be seen by other users.

6. Who we share it with

We do not sell your personal information. We share it only with the service providers below, who act on our instructions under agreements or terms that require them to protect it, and for no purpose other than the one listed:

• Laravel Cloud for hosting, database and file storage.
• Resend for email delivery (your name and email address, and the message content).
• Google Firebase Cloud Messaging and your browser's push service for push notifications.
• PayMongo for payments, when paid plans are available. PayMongo handles your card or e-wallet details under its own privacy policy.
• Google for sign-in, if you choose to sign in with Google.
• Bunny Fonts, which delivers the web fonts the site uses. Your browser contacts it directly, so it receives your IP address.

We may also disclose information to the government, courts or law enforcement when required by law or a lawful order, to our professional advisers (for example, lawyers or accountants) under confidentiality, to establish or defend legal claims, or when needed to protect the rights, safety or property of our users or others. If Talipapa is ever sold or transferred to another operator, your information may go with it, and we will tell you before it is governed by a different policy.

7. Storage and security

We use reasonable organizational, physical and technical measures to protect your information. These include encrypted connections (HTTPS), hashed passwords, access controls that limit who on our team can see personal information, confidentiality obligations for people who handle it, and reliance on our hosting provider's secured data centers. No system is perfectly secure, so please use a strong, unique password and keep it private.

If a personal data breach affects your information and is likely to put you at risk of serious harm, we will notify the NPC and you as required by law, which generally means within 72 hours after we learn of it or reasonably believe it occurred. Our Data Protection Officer, Talipapa handles these personal data breach notifications.

8. How long we keep it

• Account, profile, store, listings and activity: kept while your account is active. If you close your account, they are hidden at once and kept for 30 days so you can change your mind, then deleted or anonymized as described below.
• Notifications: notifications you have read are deleted automatically after 90 days.
• Push tokens: kept while notifications are on for that device, and removed when you turn them off or close your account.
• Payment records: Philippine tax rules generally require keeping sales records for years, so we keep payment records after your account is anonymized, for the period those laws require. Each record keeps only the payer name and email saved at checkout, amount, date, plan or boost, payment method, status and PayMongo references. Billing is currently off, so this applies once paid plans are available.
• Technical logs: kept for a limited period for security and troubleshooting, and then deleted.
• Backups: follow the same deletion and anonymization cycle. Information you have closed out is removed from backups as they are replaced in the ordinary course.

If you close your account

• Right away: your account is deactivated. Your profile, store and posts are hidden, you are signed out on all devices, and push notifications stop because we remove your device tokens and web push subscriptions.
• Within 30 days: if you sign in again, your account is restored.
• After 30 days: your personal data is anonymized. We delete your name, email, password, Google ID, address, profile and cover photos, store (including logo and banner), posts and their photos, comments, reactions, reviews you wrote and received, review reports, buy requests, follows, stock alerts, notifications and passkeys. The account record remains only as an anonymous placeholder that no longer identifies you. The only personal data we keep is the payment records described above.

When information is no longer needed, we dispose of it securely by deleting it from our database and file storage.

9. Transfers outside the Philippines

Our service providers (Laravel Cloud, Resend, Google, PayMongo and Bunny Fonts) may store or process your information outside the Philippines. Our app, database and file storage are hosted in Singapore (Asia Pacific). By using Talipapa, you understand that your information may be transferred there.

We remain responsible for personal information we hand to these providers. We choose providers that commit to protecting information, and we use contracts or terms that require protection comparable to what the Data Privacy Act requires.

10. Cookies and similar technologies

We use only the cookies and local storage needed to run Talipapa:

• Session and security cookies keep you signed in and protect your forms from forgery.
• Preference cookies remember your appearance (light or dark mode) and sidebar choice.

We do not use advertising or third-party tracking cookies. You can clear or block cookies in your browser settings, but you may then be unable to stay signed in.

11. Your rights

Under the Data Privacy Act, you have the right to:

• Be informed about how your information is collected and used.
• Access the information we hold about you.
• Object to processing, including withdrawing consent you have given.
• Erasure or blocking of information that is incomplete, outdated, false, unlawfully obtained, used for an unauthorized purpose, or no longer needed.
• Rectification of information that is wrong.
• Data portability, meaning a copy of your information in a common electronic format.
• Damages if you are harmed by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your information.
• File a complaint with the National Privacy Commission (privacy.gov.ph).

How to use your rights

• Update details: you can edit most of your information yourself in your profile and settings.
• Access and portability: go to Settings and choose "Download my data" to get a JSON copy of your profile, store, posts, comments, reactions, reviews, buy requests, notifications and payments. You can also email our Data Protection Officer, Talipapa at [email protected].
• Erasure: close your account in Settings (Close account). Enter your password, or, if you signed in with Google, type your account email. Your personal data is anonymized after 30 days, as explained in section 8. The exception is payment records, which we must keep for the period required by Philippine tax and accounting laws; we may decline to erase those until that period ends.
• Any other request (objection, blocking, correction, or help with the above): email our Data Protection Officer, Talipapa at [email protected] and say which right you want to use. The Data Protection Officer, Talipapa handles all data subject requests.

We may ask you to confirm your identity first, for example by writing from your account email. We will respond as soon as we reasonably can. We may decline or limit a request where the law allows, for example when we must keep records by law or need information to defend a legal claim, and we will explain why. If someone has died or become unable to act, their lawful heirs or assigns may exercise these rights for them.

If you are not satisfied with our response, you may file a complaint with the National Privacy Commission through privacy.gov.ph. We would appreciate the chance to resolve it first through our Data Protection Officer, Talipapa at [email protected], but you do not have to.

12. Children

Talipapa is not directed to anyone under 18. A minor may use it only with the consent and supervision of a parent or guardian, who is responsible for that use. We do not knowingly collect information from minors without that consent. If you believe a minor has given us information without it, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. If we make important changes, we will let you know in the app or by email before they take effect, and ask for your consent again where the law requires it. The effective date at the top shows when it was last updated.

14. Contact us

Data Protection Officer

Our Data Protection Officer, Talipapa handles data subject requests and personal data breach notifications (to the NPC and affected people within 72 hours of knowledge, where required). The Data Protection Officer, Talipapa is designated by role title only.