Puntos Privacy Notice
DRAFT — for lawyer review. Not yet in effect.
Version: 0.1 (draft) · Effective date: [EFFECTIVE DATE]
This notice explains how the Puntos team ("Puntos", "we") collects, uses, shares, and protects personal information when you use the Puntos website and apps (the "Service"), as required by the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).
Personal information controller: the Puntos team Data Protection Officer: the Puntos team, [PRIVACY EMAIL]
1. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | name, email, sign-in provider ID (e.g. Google), profile photo | you, your sign-in provider |
| Phone (when verification is enabled) | mobile number (stored hashed for uniqueness checks) | you |
| Profile | display name, handle, sports, positions, skill level, city, bio, Facebook profile link | you |
| Club and event activity | clubs joined and roles, registrations, waitlist position, cancellations, transfers (pasalo) | you, organizers |
| Payment records | amount, payment method type, reference number, optional proof image, approval status | you, organizers |
| Attendance and reliability | check-ins, no-shows, late cancellations, disputes and outcomes | organizers, you |
| Organizer payment details | account name, account number (encrypted), QR code image | organizers |
| Communications | notification preferences, push subscription tokens, support messages | you, your device |
| Technical | IP address (stored hashed in audit logs), device and browser type, request logs, error reports | your device |
| Usage analytics | pages viewed and actions taken, with privacy-respecting settings | your device |
We do not collect your wallet or bank login credentials, and we do not process card payments.
2. Why we use it (purposes and lawful basis)
| Purpose | Lawful basis (RA 10173 Sec. 12) |
|---|---|
| Create and secure your account; prevent duplicate and fake accounts | Contract; legitimate interest (fraud prevention) |
| Run rosters, waitlists, offers, transfers, and event rules you agreed to | Contract |
| Let organizers verify payments and track balances and refunds | Contract; legitimate interest of organizers and players in accurate records |
| Show attendance and reliability records under your privacy settings | Contract; legitimate interest; your settings |
| Handle disputes | Contract; legitimate interest |
| Send notifications (in-app, push, email) | Contract; consent for optional channels |
| Keep the Service secure, debug errors, prevent abuse | Legitimate interest; legal obligation |
| Improve the Service with aggregate analytics | Legitimate interest (you may object) |
| Comply with law, lawful orders, and NPC requirements | Legal obligation |
We do not sell personal information and we do not use it for third-party advertising.
3. Who can see your information
- Other players and the public: what your privacy settings allow (e.g. display name on a public roster). Phone numbers are never shown.
- Organizers of clubs and events you join: your roster status, payment submissions and proof images, attendance, balances, and disputes for their own club.
- Players registered in an organizer's event: that organizer's payment details, so they can pay.
- Service providers (processors) that run the Service for us under contract, only as needed:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in, file storage | Singapore |
| Fly.io | Website, API and background jobs | Singapore |
| Cloudflare | Domain, network security, bot checks on sign-in, email forwarding | Global edge |
| Resend | Email delivery | United States |
| Sign-in (if you choose it) | Global | |
| Meta | Facebook sign-in (if you choose it) | Global |
| Sentry | Error monitoring | United States |
| New Relic | Performance monitoring | United States |
| PostHog | Privacy-respecting product analytics | United States / EU |
- Authorities, when required by law or a lawful order, or to protect someone's life or safety.
- A successor, if the business is reorganized or sold, under this notice.
4. Transfers outside the Philippines
Some providers process data outside the Philippines (see table). We use providers with contractual data-protection commitments and security safeguards, and we remain accountable for your data under RA 10173.
5. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | While your account is active; deleted or anonymized within 30 days of account deletion |
| Payment proof images | Deleted 180 days after the event |
| Ledger entries, refunds, audit logs | Kept for record integrity; your identity is anonymized when you delete your account |
| Attendance and reliability records | While your account is active; anonymized on deletion |
| Unpaid balances at deletion | Your name as the club knew it, the game and the amount, visible only to that club's owner and admins; erased when paid or waived, or after [DEBT RETENTION PERIOD] |
| Server and error logs | Up to 90 days |
| Push subscriptions | Until you unsubscribe or the device token expires |
We may keep data longer if required by law or to resolve an active dispute.
6. How we protect it
Encryption in transit (HTTPS) and at rest; organizer account numbers encrypted in the database; payment proofs in private storage with short-lived links; access limited by role and by club; append-only audit logs; personal data redacted from application logs; regular security scanning. No method is perfectly secure, but we work to meet recognized standards (OWASP ASVS Level 2).
7. Your rights
Under RA 10173 you have the right to: be informed; access your data; object to processing (including analytics); erasure or blocking; rectification; data portability; damages for violations; and to file a complaint with the National Privacy Commission (privacy.gov.ph).
You can edit your profile and privacy settings and delete your account in the Service. For other requests, email [PRIVACY EMAIL]. We may need to verify your identity. We respond within 15 days, or tell you if we need more time.
Some records cannot be fully erased without harming other people's accurate records (for example, a ledger entry an organizer relies on). In those cases we anonymize your identity instead.
8. Cookies and similar technologies
We use essential cookies and local storage to keep you signed in and to remember settings. We use privacy-respecting analytics to understand usage; you can opt out in your settings. We do not use advertising cookies.
9. Breach notification
If a personal data breach is likely to put you at real risk of serious harm, we will notify the National Privacy Commission and affected users within 72 hours of knowledge, as required by NPC rules, and tell you what we are doing about it.
10. Children
The Service is for people 18 and older, or minors using it with the consent and supervision of a parent or guardian. If you believe a minor's data was given to us without that consent, contact [PRIVACY EMAIL] and we will delete it.
11. Changes to this notice
We will post updates here with a new version and effective date, and notify you in the Service or by email of material changes.
12. Contact
Data Protection Officer: the Puntos team · [PRIVACY EMAIL]