Privacy Notice

BaligyAklan (“we”, “us”) is an online buy, sell, and rent marketplace for Aklan province, operated by Lumtri Software Development Services, a DTI-registered business in Aklan, Philippines. For the purposes of Republic Act No. 10173 (the Data Privacy Act of 2012, or “DPA”), we act as the Personal Information Controller for the data described in this notice.

Personal information: your name, email address, optional mobile number, home municipality, profile photo, the listings you post, the messages you exchange with other users, and technical data (IP address, device/browser type, usage logs) collected automatically for security.

Sensitive personal information:if you choose to verify your identity, we collect photos of your government-issued ID (front and back) and a selfie of you holding it. Accepted IDs include the PhilSys National ID, driver's license, UMID, passport, and similar Philippine government IDs. We do not knowingly collect other sensitive categories (health, religious, or political data) — please don't include them in listings or messages.

Account, listings, and messaging: performance of our contract with you (the Terms of Service). Identity verification: your explicit consent — given through an unticked checkbox before you submit any photo — plus our legitimate interest in keeping the marketplace free of fake accounts and scams. Security, fraud detection, and responses to lawful requests: legitimate interest and legal obligation. You may withdraw verification consent anytime by contacting us; your account then loses its verified status.

Verification is reviewed manually by our small, named review team. Your ID photos are stored in a private, access-restricted storage area — encrypted in transit and at rest — and are never shown to other users; buyers and sellers only ever see a “Verified” badge. Our systems enforce this at the database level: verification records are unreachable through the public interface, every approval or rejection is recorded in a tamper-proof audit log, and a verified user who changes their account name automatically loses the badge until re-verified (this protects buyers from impersonation).

We retain verification photos for the life of your account — they support appeals, re-reviews, and fraud investigations. If you delete your account or send a verified erasure request to the contact in Section 9, we delete them.

We do not sell your personal data. We share it only with:

• Other users, to the extent you choose:your display name, photo, town, listings, public reviews and badges, and (for approved businesses) your shop identity. Messages are visible only to the person you're dealing with — our moderators cannot read chat content. Your mobile number is revealed to a deal partner only after both of you confirm a meetup.
• Service providers acting on our instructions: Supabase (database, authentication, and file storage — may process data outside the Philippines), Vercel (application hosting), PayMongo (payment processing for seller subscriptions — your card and e-wallet details are handled by PayMongo and never stored by us), and your browser's push service if you opt into notifications. We use no analytics or advertising trackers.
• Authorities: where required by law, court order, or a valid request from the National Privacy Commission or law enforcement.

Account and profile data: for as long as your account is active. Listings: retained after sale or removal for dispute and record purposes. Messages: for the life of the deal record. Verification status and photos: for the life of the account, or until a verified erasure request. Moderation and audit logs: retained for accountability. After the applicable period or a valid erasure request, data is securely deleted or irreversibly anonymized unless the law requires longer.

• Encryption in transit (TLS) and at rest.
• Row-level security on every database table — verification data is accessible only to authorized reviewers.
• An append-only audit log of every moderation and verification decision that not even administrators can edit or delete.
• Database-enforced guards: nobody can mark themselves verified, and banned users are blocked from writing.
• A unique mobile-number rule that deters duplicate accounts.

No system is perfectly secure, but we work to protect your data and to respond quickly — including notifying the NPC and affected users — if an incident occurs.

Under the DPA you have the right to be informed, to access your data, to object or withdraw consent, to correct inaccurate data, to request erasure or blocking, to data portability, to damages for violations, and to file a complaint with the National Privacy Commission. To exercise any of these, contact us (Section 9) — we may need to verify your identity before acting on a request.

Our data protection contact handles privacy questions, consent withdrawals, and data-subject requests: info.lumtri@gmail.com (Lumtri Software Development Services, Aklan, Philippines).

We use only strictly necessary cookies — the session cookies that keep you signed in — plus on-device preferences (such as dismissed banners). No analytics or advertising cookies.

BaligyAklan is for users 18 and older. We do not knowingly process the personal data of minors — if you believe a minor has provided us data, contact us so we can address it.

We'll update the date above when this notice changes and notify you in the app for material changes. If you have concerns, contact us first so we can resolve them — and you always have the right to complain to the National Privacy Commission (5F Philippine International Convention Center, Vicente Sotto Ave., Pasay City · privacy.gov.ph).