Privacy Policy

1. Who We Are

Lokali Stays ("the Platform") is a rental listing platform for Cebu, Philippines, operated by Kyle Matthew Laurence C. Burce ("the Operator", "we", "us"). The Operator is responsible for the personal information processed through the Platform.

This Privacy Policy explains what personal information we collect, how we use and share it, and the rights you have under the Data Privacy Act of 2012 (Republic Act No. 10173). Please read it together with our Terms of Service.

2. What We Collect

We collect the following information, depending on how you use the Platform:

• Account information: your email address, full name, and account type (agent, owner, or renter). Passwords are handled by our authentication provider, Supabase. If you choose Continue with Google, Google shares your name, email address, and profile picture link with us.
• Lister profile details (agents and owners): phone number, Messenger, Viber, and WhatsApp links, city or municipality (owners), and whether you are looking for an agent.
• Listing content: title, description, price and payment terms, property type, furnishing, floor area, amenities, parking fee, barangay and city, address notes, walking distance notes, the map pin location, availability date, photos, and the post templates and graphics generated for the listing.
• Listing activity: when a listing is viewed, its post template is copied, or a contact button is clicked, we record the event type and time against the listing. These records do not include who performed the action.
• Renter activity: saved listings (watchlist) and notification settings, notifications about saved listings, tenancy confirmations from invite links sent by a lister, reviews (a star rating and an optional comment of up to 500 characters), and listing reports (a reason and optional details).
• Technical information: the cookies and browser storage listed in section 6. Our hosting and database providers may also record technical information, such as IP addresses and request logs, as part of operating their services.

3. How We Use Your Information

We use personal information to:

• create and secure your account and keep you signed in;
• send account emails, such as sign-up confirmation and password reset links;
• publish listings and lister profiles so renters can find and contact listers;
• generate listing descriptions and Facebook post templates when you request them, and marketing graphics if that feature is enabled;
• show listers statistics about their listings and market insights;
• notify renters about changes to listings they saved;
• confirm tenancies so that only renters with a confirmed tenancy can leave reviews;
• review reports and flagged reviews, and enforce our Terms of Service; and
• comply with legal obligations.

4. Who We Share It With

We share personal information only with the service providers below, and only the information each one needs to perform its function:

• Supabase: stores our database, user accounts, and uploaded photos. It holds all the information described in section 2.
• Vercel: hosts the website and processes the requests your browser sends to it.
• Groq: generates text with AI. When a lister generates a description, it receives the listing details. When a lister generates a Facebook post template, it also receives the lister's name, phone number, and Messenger link. When market insights are generated, it receives listing titles and listing statistics.
• Railway: hosts the service that will create marketing graphics. Marketing graphics are not active yet, and no data is sent to it today. If marketing graphics are enabled, it will receive the listing details, the lister's name and phone number, and links to the listing photos when a lister generates a graphic.
• Mailgun: delivers our account emails (sign-up confirmation, resent confirmation, and password reset). It receives your email address and the content of the message, including the confirmation or reset link.
• OpenStreetMap (Nominatim): when a lister places a map pin, our server sends the pin coordinates to look up the address.
• OpenStreetMap map tiles: maps on listing pages and the listing form are loaded by your browser directly from OpenStreetMap's servers, which receive your IP address, browser information, and the map area being viewed.
• Google sign-in script: the sign-in and registration pages load Google's sign-in script and button (Google Identity Services) directly from Google's servers (accounts.google.com). When either page loads, Google receives your IP address, browser information, and the address of the page, even if you do not use the button.
• Google: if you choose Continue with Google, Google processes your sign-in under its own privacy policy and sends us a signed sign-in token containing your name, email address, and profile picture link.
• Authorities: we may disclose information when required by law or a lawful order.

5. What Is Public by Design

The Platform exists to connect listers and renters, so some information is visible to anyone, including visitors who are not signed in:

• Listings: all listing content, including photos, location, price, and the map pin.
• Lister profiles: name, account type, phone number, Messenger, Viber, and WhatsApp links, city or municipality, join date, and Pro status.
• Reviews: the star rating, comment, and date. The reviewer's name is not shown with the review.
• Profile records: agent and owner profiles, including the name and contact details stored in them, are visible to anyone and can be read through the Platform's public data interface. Only add contact details you are comfortable making public. A renter's profile is visible only to that renter and to administrators.

6. Cookies and Local Storage

We do not use advertising or analytics cookies, and the Platform does not load advertising or analytics scripts. We use only the following:

• sb-<project>-auth-token (cookie, may be split into numbered parts): keeps you signed in. Set by Supabase Auth. Essential.
• sb-<project>-auth-token-code-verifier (cookie): used briefly during email confirmation and password reset to complete the sign-in securely. Essential.
• lokali_welcome_seen (local storage): remembers that you closed the welcome message on the home page.
• lokali_cookie_notice_seen (local storage): remembers that you closed the cookie notice.
• tos_contact_ack (session storage): remembers, for the current browser tab only, that you acknowledged the Terms reminder before contacting a lister.

The sign-in and registration pages also load Google's sign-in script. Google may read or set its own cookies and browser storage on its domains, for example if you are already signed in to a Google account. These are controlled by Google under its own privacy policy, not by Lokali.

7. Transfers Outside the Philippines

Some of our service providers store or process data on servers outside the Philippines, so your information is transferred to the following countries:

• South Korea: Supabase (database and photo storage; Seoul, South Korea).
• United States: Vercel (website hosting; United States (Washington, D.C.)), Groq (AI text generation; United States), Mailgun (account email delivery; United States), Railway (graphic renderer, not active yet; United States).

The data protection laws of these countries may differ from those of the Philippines. We remain responsible for protecting your information as required by the Data Privacy Act of 2012.

8. Retention

We keep your account and listing data while your account is active. If you ask us to delete your account, we remove your database records within 30 days. Uploaded photo files may take longer to remove. Our hosting providers keep their own server logs under their own schedules. Once paid plans exist, we keep billing records for as long as the law requires.

When an account is deleted, the database records linked to it are deleted with it, including the profile, listings and their activity records, reviews, saved listings, notifications, tenancies, and reports.

To request deletion, email kmlcburce.business@gmail.com from the email address on your account.

9. Your Rights

Under the Data Privacy Act of 2012, you have the right to:

• be informed about how your personal information is processed;
• access the personal information we hold about you;
• correct inaccurate or outdated information;
• have your information erased or blocked when it is incomplete, outdated, false, unlawfully obtained, or no longer necessary;
• object to processing, including processing based on consent;
• data portability: obtain a copy of your information in an electronic, commonly used format;
• claim damages for harm caused by inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your information; and
• file a complaint with the National Privacy Commission (privacy.gov.ph).

10. How to Make a Request

You can update your name and contact details at any time from your dashboard profile page. For any other request, including access, correction, portability, or objection, email kmlcburce.business@gmail.com from the email address on your account and describe your request.

Data deletion: the Platform does not yet offer self-service account deletion. To delete your account and its data, email kmlcburce.business@gmail.com from the email address on your account with the subject "Delete my account". We may ask you to confirm your identity before acting on the request.

11. Minors

You must be at least 18 years old to create an account, as stated in our Terms of Service. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

12. Security

Measures currently in place include:

• Passwords are handled by Supabase Auth and are not stored by the Platform itself.
• Database access rules (row level security) limit which records each account can create, change, or delete.
• Administrative functions are restricted to administrator accounts and checked on the server.
• Privileged service keys are used only on the server and are never sent to your browser.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. Continued use of the Platform after changes means you accept the revised policy.

14. Contact

For questions about this Privacy Policy or your personal information, contact kmlcburce.business@gmail.com.