Privacy Policy

YourNodo ("the Platform," "we," "us," or "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information in compliance with Republic Act No. 10173, also known as the Philippine Data Privacy Act of 2012, and its Implementing Rules and Regulations (IRR).

By registering for or using YourNodo, you consent to the data practices described in this Privacy Policy.

1. Information We Collect

1.1 Information You Provide

1.2 Sensitive Personal Information

If you choose Fast Track Verification, we collect the following sensitive personal information as defined under Section 3(l) of RA 10173:

Security Guarantee: Verification documents are stored in an encrypted, private storage bucket with strict access controls accessible solely to the uploading user and authorized Platform administrators. Documents are never shared with other users or displayed publicly.

2. Legal Basis for Processing

We process your personal data under the following legal bases recognized by RA 10173:

• Consent (Section 12(a)): You provide explicit consent during registration through mandatory checkboxes acknowledging this Privacy Policy and the Data Privacy Act.
• Contractual Necessity (Section 12(b)): Processing necessary to fulfill our service obligations — verifying your identity, maintaining your account, and facilitating marketplace transactions.
• Legitimate Interest (Section 12(f)): Community safety measures including fraud prevention, account integrity, and platform security, provided these do not override your fundamental rights.

3. How We Use Your Information

• Account management: Creating and maintaining your account, authenticating your identity.
• Community verification: Confirming that you are a real resident of your claimed neighborhood.
• Marketplace operations: Facilitating pin postings, chat coordination, and transaction completion.
• Trust & safety: Preventing fraud, enforcing community guidelines, and safeguarding local marketplace interactions.
• Governance: Supporting community governance functions (when activated) including the Community Treasury Fund.
• Communications: Sending transaction-related notifications, system updates, and community announcements.
• Platform improvement: Analyzing usage patterns (in aggregate, anonymized form) to improve the service.

4. Data Retention

5. Data Storage & Security

5.1 Infrastructure. YourNodo is built on Supabase (a managed cloud platform). Your data is stored on secure servers with encryption at rest and in transit (TLS/SSL).

5.2 Access Controls. We implement Row Level Security (RLS) policies ensuring users can only access their own data. Verification documents are stored in a private bucket inaccessible via direct URL.

5.3 Security Measures:

• Passwords are hashed using industry-standard algorithms (never stored in plaintext).
• Verification documents are stored in encrypted, access-restricted private storage.
• Only authorized administrators can view verification documents, and only for the purpose of manual address verification.
• Uploaded images are converted to optimized formats and stripped of unnecessary metadata.

5.4 Privacy Protections & Neighbor Controls. Guest visitors cannot see prices, exact addresses, contact information, phone numbers, real names, or exact house locations. For registered residents, real names, exact street addresses, and phone numbers are protected by granular privacy toggles (Show real name, Show address, Show phone) controllable under Edit Profile.

6. Data Sharing & Third Parties

6.1 We Do Not Sell Your Data. YourNodo will never sell, rent, or trade your personal information to third parties for marketing or commercial purposes.

6.2 Service Providers. We use the following third-party services to operate the Platform:

• Supabase: Database hosting, authentication, and file storage (acting as a Data Processor under our instructions).

6.3 Legal Obligations. We may disclose your information when required by Philippine law, court order, or lawful government request, in accordance with Sections 12 and 13 of RA 10173.

6.4 Community Visibility. The following information may be visible to other users within your community:

• Your real name or display nickname (controlled by your profile privacy toggle).
• Your verification status badge.
• Your active marketplace listings and shop catalog (if active).

Your exact house number and street are masked from guests and unverified users by default. For verified neighbors in your subdivision, address visibility is controlled by your personal privacy toggle (Show address to neighbors) in your profile settings.

7. Cross-Border Data Transfer

Supabase servers may be located outside the Philippines. By using YourNodo, you acknowledge and consent to the transfer of your data to servers outside the Philippines, subject to appropriate safeguards as required by Section 21 of RA 10173 and NPC Circular 2016-02. We ensure that any overseas processor maintains data protection standards comparable to those required under Philippine law.

8. Your Rights Under RA 10173

As a data subject, you have the following rights under the Data Privacy Act:

To exercise any of these rights, contact our Data Protection Officer at the details provided below.

9. Children's Privacy

YourNodo requires users to be at least fifteen (15) years of age. Users aged 15–17 must be registered under a Household where the primary member (aged 18+) assumes liability. We do not knowingly collect personal data from children under 15. If we become aware that a child under 15 has created an account without proper Household oversight, we will promptly deactivate the account and delete associated data.

10. Cookies & Local Storage

10.1 Authentication. We use essential browser cookies and local storage for authentication session management. These are strictly necessary for the Platform to function.

10.2 Notes System. The Notes system stores data locally on your device by default (using browser local storage). This data does not leave your device unless you explicitly choose to sync it to the cloud.

10.3 No Tracking Cookies. We do not use third-party tracking cookies, advertising cookies, or analytics cookies that track you across other websites.

10.4 Automated Bot & Abuse Prevention. To protect resident accounts, prevent fraudulent registrations, and safeguard authentication endpoints from automated malicious bot traffic, we utilize Cloudflare Turnstile. Turnstile evaluates browser technical characteristics to verify legitimate human interaction without collecting personal user profiles or cross-site tracking data, subject to Cloudflare's Privacy Policy.

11. Data Breach Notification

In the event of a personal data breach, we will:

• Notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, as required by NPC Circular 16-03.
• Notify affected data subjects within the same period if the breach involves sensitive personal information or is likely to cause serious harm.
• Document the breach and remedial actions taken.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through in-app notification or email. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the Platform after changes constitutes acceptance of the updated policy.

13. Data Protection Officer

For questions, concerns, data access requests, or correction requests regarding your personal data, please contact our Data Protection Officer:

14. Governing Law

This Privacy Policy is governed by and construed in accordance with the Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and all applicable issuances of the National Privacy Commission of the Philippines.

For the full text of the law, please visit: Republic Act No. 10173 — Data Privacy Act of 2012