プライバシーポリシー

PhilRoom is operated by Twinkle Moron Elpanag, a sole proprietor in Metro Manila, Philippines, who is the personal information controller for the data described here under the Data Privacy Act of 2012 (RA 10173). Our business registration is in process and will be published here.

For anything about your personal data — access, correction, deletion, or a complaint — write to privacy@philroom.ph.

If you are just browsing. Nothing that identifies you. We run no analytics service, no advertising pixel and no third-party tracker on this site. Our hosting provider keeps ordinary server logs, including IP addresses, for security.

If you ask about a listing or open an account. Your name, email address, contact number, the language you chose, the messages you send us and their machine translations, and which listings you asked about.

If you list a property. Your name and contact number, the address and details of the unit, your photos and videos, and the notes our staff take when they call you to confirm the listing.

Contact numbers taken from public advertisements. When a rental is advertised publicly — for example in an open Facebook group — we record the contact number published with it so that we can call to confirm the unit, and so that we can tell when the same unit is being posted several times or by someone who is not the owner. That number is stored apart from the public listing and is readable only by our operations team. If you do not want us to hold your number, tell us at privacy@philroom.ph and we will delete it.

If you apply to work with us, or work with us. Your CV and career history, your PRC licence number and card, PTR, BIR 2303, DHSUD registration where it applies, a government ID and a photo of you holding it, your TIN, the GCash or bank account you want to be paid into, your transactions and payout records, and a record of the undertaking you signed — the name you typed, the time, your IP address, your browser, and a fingerprint of the exact text you agreed to. Government IDs and the ID photo are sensitive personal information under RA 10173 §13 and we ask for your consent before you upload them.

• To answer you and run your account — necessary for the service you asked for (§12(b)).
• To confirm listings and catch fake or duplicated ones — our legitimate interest and yours (§12(f)). This is the reason we hold contact numbers at all.
• To check the licence and identity of anyone who will act in our name — required of us under RA 9646, and to establish or defend legal claims (§12(c), §13(f)).
• To pay commissions, withhold tax and issue BIR 2307 — a legal obligation (§12(c)).
• To keep proof of what someone agreed to — for legal claims (§13(f)).

We do not sell your personal data, we do not rent it to advertisers, and we do not make automated decisions about you that have legal effect.

• The salesperson or broker handling your inquiry, and the broker who supervises them. They need your name and number in order to call you back.
• The owner of the unit you are asking about, where that is needed to answer you.
• The providers that run the service for us: Supabase (database, file storage and sign-in), Netlify (website hosting and server logs), Resend (account and password emails), Google Cloud Translation and DeepL (translating inquiry messages), and Telegram (a short alert to our own operations channel when an application or inquiry arrives, so that nobody waits a day for an answer).
• Government offices and courts — the BIR, the PRC, the National Privacy Commission, or a court — where the law requires it.

The providers listed above process data on servers outside the Philippines. Sending your data abroad does not relieve us of responsibility for it — under RA 10173 we remain accountable for what happens to it there.

• Inquiries and messages — five years after the last message.
• Listings and the contact number behind them — while listed, then three years, because that history is what lets us recognise a unit being re-posted.
• Applications that we do not approve — one year, then deleted.
• Documents, payout and tax records of people who work with us — ten years, as tax rules require.
• Signed undertakings and the record of who signed what — ten years after the relationship ends (Civil Code, Art. 1144).

Under RA 10173 you have the right to be informed, to object, to access your data, to have it corrected, to have it erased or blocked, to be indemnified for damage, and to obtain a copy in a portable form. To use any of them, write to privacy@philroom.ph. We answer within fifteen (15) working days.

We may ask you to confirm who you are before we act — otherwise we would be handing your data to whoever asks for it.

Some things we cannot delete on request: tax and payout records, the record of a transaction that closed, and a signed undertaking. We keep those for the periods in section 6 and use them for nothing else.

You can also complain to the National Privacy Commission (privacy.gov.ph) at any time. We would rather you told us first, but that is your right, not our permission.

• Every table has row-level security. Who may read a row is decided by the database, not by the screen you happen to open.
• Owner contact numbers are kept in a separate table that public listings cannot reach, readable only by our operations team.
• Uploaded documents and ID photos sit in private storage. They have no public address, and one worker cannot open another’s file.
• Payout accounts are visible only to their owner and to an administrator — not to team leaders.
• Passwords are handled by our sign-in provider. We never see them, so we can never tell you yours.

We use only the cookies the site needs to work: a session cookie from our sign-in provider that keeps you signed in. There are no advertising cookies, no analytics cookies, and no Facebook or Google tracking pixels. Your language is taken from the address you are on (/en, /ko, /ja, /zh, /fil), not from a cookie.

The Service is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal information, write to privacy@philroom.ph and we will delete it.

When what we collect changes, this notice changes with it. The version number and effective date at the top of the page tell you which one you are reading.

privacy@philroom.ph — data protection questions, requests and complaints. Our terms of use are on a separate page.