Privacy Policy

1. Who we are

SabayApp is a platform for rides (Sakay), food and shop delivery (Food & Mart), buy-for-me errands (Pasabuy) and parcel delivery (Padala) in Marawi City, Lanao del Sur. We decide how your personal data is used, so we are the personal information controller under the law.

2. What we collect

• Account: your full name, mobile number, e-mail (optional), password and language. We never keep your password itself, only a scrambled version (a bcrypt hash) that cannot be turned back into it.
• If you sign in with Google or Facebook: the name, e-mail address and account ID that Google or Facebook gives us, so we can open your account next time. We never get your Google or Facebook password, and we never post anything for you. You can add or remove them in Account → Sign-in methods.
• Orders: pickup and drop-off points (address and map pin), items and notes, the Pasabuy list and shop, and for Padala the name and mobile number of the sender or receiver. If you give us another person's details, make sure they agree.
• Saved addresses: the labels, addresses and map pins you save.
• Riders: vehicle type, plate and body number, driver's license number and expiry date, city or municipality and barangay, and photos of your license, your vehicle and yourself (selfie), plus your permit and OR/CR if you add them.
• Merchants: store name, category, business phone, address and map pin, opening hours, description, logo, cover and menu photos, and your business permit if you add it.
• Payout details (riders and merchants): the name and number of your GCash, Maya or bank account.
• Location: see Location below.
• Photos: pickup and delivery photos, Pasabuy receipts, cash remittance screenshots and photos sent in chat. We remove the hidden location data (EXIF) from the photos you upload.
• Messages: your chats with support, your rider and your store.
• Ratings: the stars and comments customers give riders and stores.
• Payments: the amount, method and status of each payment, refunds, your wallet credits, and for riders and merchants their earnings, cash to remit and payouts. Card and e-wallet details are typed on our payment provider's page, not ours, so we never see your full card number. The provider may send us the card brand and its last 4 digits.
• Device and security data: your phone's push notification token and app version, a short device description (for example "Android 14"), the IP address used when you sign in, and your sign-in sessions. The app also sends an id of your phone or browser, which we keep only in scrambled (hashed) form with the accounts used on it; our staff may block that one phone or browser after prank or abusive bookings. We also keep a log of staff actions for security.

We do not use advertising trackers or analytics tools. We do not ask for your birthday or for government ID numbers other than a rider's driver's license.

3. Location

• Customers: when you allow it, the app uses your location to set the pickup point, find stores near you and suggest places. At checkout it also checks whether you are near the pin: far away, the order is paid online (not cash). We save only the pickup and drop-off points of your orders.
• Riders: while you are online, the app sends your location every few seconds, also when the app is in the background (a notification shows while this is on). We use it to offer you nearby jobs and to show the trip to the customer and the store. During a job we keep your route for 7 days. For your position we keep only the latest one; each update replaces it.

You can turn off location in your phone settings at any time, but booking and riding need it.

4. Why we use your data

• To create and run your account and sign you in.
• To take bookings and orders, find a rider, and show the trip to the people on the order.
• To take payments, give refunds, keep wallet balances and send payouts.
• To check riders and merchants before we approve them, and to keep licenses up to date.
• To send notifications about your orders, messages and account.
• To answer questions and complaints and to settle disputes.
• To prevent fraud and abuse, keep accounts safe and keep the service working.
• To follow the law and lawful orders from the authorities.

We use your data because it is needed for the service you asked for (our agreement with you), because the law requires it, or for our legitimate interests such as safety and fraud prevention. A rider's driver's license is sensitive personal information under the law; we use it with the consent the rider gives when applying, to check that the rider may drive.

5. Who can see your data

• Riders near you, before one accepts your booking: your first name, the pickup and drop-off points, and the price.
• The rider and the store on your order: your name, mobile number, the pickup and drop-off points, your notes and the Padala contact. They can still open past orders they worked on.
• Customers see their rider's name, mobile number, plate or body number, rating and location during the trip, and the store's name, address and phone.
• Everyone: store names, menus, photos and ratings are public. Reviews show only the customer's first name.
• Our staff, only as their work needs: for example to approve riders and merchants (they see the documents), to help with orders and to answer chats. Staff can read order chats and support chats.
• Service providers that help us run SabayApp: PayMongo for payments, refunds and payouts (your name, mobile number and e-mail for payments; the payout account for payouts); Google for maps, address search and routes (what you search and map points), the maps shown in the app, Firebase Cloud Messaging for push notifications (your push token and the notification text), and Google sign-in if you use it; Meta (Facebook) for Facebook sign-in if you use it (Google and Meta learn that you signed in to SabayApp — see their own privacy policies); OpenStreetMap services as a backup for address search and routes (what you search and map points); Hostinger for the servers and e-mail that run SabayApp (alert e-mails to our staff may include a rider's or applicant's name and mobile number).
• Authorities, when the law or a lawful order requires it.

We do not sell your personal data. Some providers keep data outside the Philippines; we share with them only what they need.

6. How long we keep it

• Rider route during a job: 7 days.
• In-app notifications: 30 days.
• Pickup and delivery photos and Pasabuy receipts: 90 days.
• Sign-in sessions: they end 90 days after you last use the app, or when you log out.
• Push notification tokens: removed when you log out or after 60 days without use.
• Order chats close 24 hours after the order ends.
• Everything else (your account, orders, payments, wallet and payout records, chats, ratings, documents and logs): while your account is open, and after that only as long as needed for the reasons above, including legal, tax and accounting duties and disputes. Then we delete it or make it anonymous.

7. How we protect it

We use HTTPS, scrambled passwords and sign-in keys, private storage for documents and delivery photos that only the right people can open, staff roles and permissions, and a signed ledger for wallet money. The apps show payout account numbers only in part.

No system is 100% safe. If a breach puts you at real risk, we will tell you and the National Privacy Commission as the law requires.

8. Your rights

Under the Data Privacy Act you have the right to:

• Be informed about how your data is used (this policy).
• Access your data and get a copy.
• Object to its use, including where you gave consent.
• Erasure or blocking of data that is incomplete, outdated, false, unlawfully obtained or no longer needed.
• Rectification: have wrong data corrected. You can change your name and e-mail in the app; for other details, contact us.
• Data portability: get your data in a common electronic format.
• Damages if you are harmed by wrong or unlawful use of your data.
• File a complaint with the National Privacy Commission (privacy.gov.ph).

To use a right, contact us. We may ask you to prove who you are.

9. Deleting your account

There is no delete button in the app yet. To delete your account, ask us through Contact us or Messages in the app, or the contacts below. We will check that it is you, close the account, and delete or anonymise your data, except what we must keep for the law, taxes, accounting, open orders, unpaid balances or disputes. Riders and merchants should withdraw their balance first.

If you signed in with Google or Facebook, you can also remove SabayApp in your Google account (Security → Third-party connections) or in Facebook (Settings → Apps and websites). That stops the sign-in, but it does not delete your SabayApp account or its records; ask us as above for that.

10. App permissions, cookies and storage

• The Android app asks for: location (bookings and rides), camera and photos (documents, delivery and receipt photos, chat photos), notifications, running in the background for riders and stores (so alerts arrive), and installing updates (the in-app updater). You can turn these off in your phone settings; some features then stop working.
• The web app and these pages keep your sign-in, cart, language, theme and sound settings in your browser's storage, plus a language cookie. We use no advertising cookies.

11. Children

SabayApp is not meant for children. If you are under 18, use it only with the permission of a parent or guardian. Riders and merchants must be at least 18 years old.

12. Changes to this policy

We may update this policy. We will post the new version here with a new date, and tell you in the app when a change is important.

13. Contact us and our Data Protection Officer

For questions, complaints, or to use your privacy rights:

• SabayApp
• In the app: Account → Contact us, or Messages
• Help Center: sabay.binary.ph/app/#/help
• Data Protection Officer: reach our Data Protection Officer through the contacts above.