Privacy policy

This is the part most privacy policies skip, and it decides everything else on this page. We handle two different kinds of personal information and we are not in the same position for both.

Your own account information, as a shop owner: we decide what we collect and why, so we are the personal information controller for it. Everything on this page about your rights applies to us directly.

Your customers’ and staff’s information, which you put into Tindahub or which reaches us because a customer messaged your shop: you are the controller and we are the processor. You decide what to collect, why, and who sees it. We hold it, secure it and act on your instructions. If one of your customers asks us directly to correct or delete something, we will normally refer them to you, because it is your relationship and your decision, and we will tell you that they asked.

The one exception is a deletion request that arrives from Facebook under Meta’s rules. We act on those ourselves, immediately, and section 6 explains exactly what happens.

Listed as it exists in the system rather than in categories, so you can check it against what you see in the app.

About you, the owner:

• Your name, email address, mobile number and business name.
• Your login credentials. Passwords are hashed and we cannot read them.
• Your subscription, what you were billed and when, and any affiliate code you arrived with.
• Support messages you send us.

About your staff, because you run payroll in Tindahub:

• Full name and role.
• A hashed PIN used to clock in and to open the till. We cannot read it.
• Clock-in and clock-out times, shifts worked, hours and the pay calculated from them.

About your customers:

• Name, mobile number and email address, where you or they provide one.
• Loyalty membership, points balance, and any note you add to their record.
• What they bought, when, at which branch and how they paid.
• If they order through Messenger: their Facebook-scoped page ID, the conversation with your shop, the delivery address they give, and any images they send, including payment screenshots.

We do not collect government identification numbers, health information, or any of the other categories the Data Privacy Act treats as sensitive personal information. We do not ask for card numbers: where a card is used, the payment provider handles it and we never see the full number.

Section 12 of the Data Privacy Act lets us process personal information only on specific grounds. Ours are:

• To do what you signed up for. We cannot run a till, track stock or calculate payroll without holding the records that make those things work.
• Because the law requires it. Sales records are financial records. Keeping them is not our choice.
• Because you asked us to, where a feature is optional and you switched it on.
• Our legitimate interest in keeping the service secure, preventing fraud and abuse, and fixing faults, provided that does not override your rights.

We do not sell personal information. We do not share it with advertisers. We do not use your shop’s data or your customers’ data to train artificial intelligence models for anyone else.

Only the parties below, and only the part each one needs. Every one of them is bound to protect it to at least the standard we are, which is what section 21 of the Act requires of us.

• Our hosting and database provider, which stores the data and runs the service.
• Meta,where your shop uses Messenger ordering. Messages travel through Facebook’s systems and Meta’s own policies apply to them there as well as ours here.
• Lalamove,where a delivery is booked through them. They receive the pickup and drop-off addresses and the recipient’s name and number, because a rider cannot deliver without them.
• Our payment provider, for subscription payments.
• A public authority, where we are legally compelled. We will tell you unless we are forbidden from doing so.

Messages and attachments: 12 months. Conversations from Messenger ordering, and the images sent in them, are deleted automatically once they are older than twelve months. The job runs nightly.

There is one exception and we would rather state it than let you discover it. Anything attached to an order whose money has not settled is kept past the twelve months until it settles, and then ages normally from that point. A payment screenshot on an unpaid order is the evidence that the order is unpaid, so deleting it on schedule would destroy the record of a dispute while the dispute is still open.

Sales records: kept. A completed sale is a financial record. We keep it for as long as the law requires a business to keep its books, and section 6 explains what happens to the personal information attached to it when someone asks to be deleted.

Your account: for as long as you have one.Close your shop’s account and we delete your account information within 30 days, other than what we must keep for tax and accounting.

Deleting a person is not the same as deleting everything about them, and any policy that says otherwise is not telling you the truth. This section is the whole procedure: how to ask, what comes out, what stays, and how long it takes.

How to ask

If you ordered from a shop through Messenger, the fastest route is Facebook itself:

1. Open Facebook and go to Settings & privacy, then Settings.
2. Go to Apps and websites.
3. Find Tindahub in the list and select it.
4. Choose Remove, and confirm.

Facebook sends us the request and we act on it. You do not need to contact us as well.

By email, for any request. Write to mategroupph@gmail.com with the subject Data deletion request, and tell us the mobile number or email address the shop has for you and the name of the shop you ordered from. We need those two things to find your record and to be sure we are deleting the right person’s information rather than somebody else’s. We may ask one question to confirm it is you. That is not an obstacle we are putting in your way, it is the same protection that stops someone else deleting your information.

If you are a shop ownerasking us to close your own account, write to the same address from the email address on the account. Closing an account deletes your customers’ information with it, so export anything you need first.

What we remove

• The conversation with the shop, and every message in it.
• Every stored image from that conversation, including payment screenshots.
• Your Messenger customer record.
• Your saved delivery address and mobile number.
• Your customer record with the shop, including loyalty points and any note held about you.

What we keep, and why

The completed sale.A shop is required to keep its financial records and we are not able to delete a shop’s accounting records at the request of a third party without putting that shop in breach of its own obligations.

What we do instead is take you out of it. The sale stops pointing at any customer record, and your name and number come off the order. What is left is that a sale of certain items happened at a certain time for a certain amount, with nobody attached to it. It can no longer be used to identify you or to contact you.

We also keep anything we are separately required to keep by law, or that we need to establish, exercise or defend a legal claim, for as long as that reason lasts and no longer.

How long it takes

Within 30 days of us receiving the request, and usually much sooner. A request arriving automatically from Facebook is acted on immediately. If anything is going to take longer than 30 days we will write and tell you why rather than going quiet.

Backups. Deleted information can remain in encrypted backups for up to 30 days afterwards, because a backup that could be edited would not be a backup. It is never restored into the live service and it ages out on its own.

Checking on a request. Reply to our confirmation email, or write to mategroupph@gmail.com quoting the reference we gave you. If we cannot delete something you asked us to delete, we will tell you which item and the reason, not just that we declined.

Section 16 of Republic Act 10173 gives you these, and they are not conditional on asking nicely:

• To be told whether we hold information about you, and to be given a copy of it.
• To know why we hold it, how it is processed, and who it has been given to.
• To have anything inaccurate or incomplete corrected, and to have the correction passed on to anyone we already gave it to.
• To have information blocked, removed or destroyed where it is incomplete, outdated, false, unlawfully obtained, used for something you did not agree to, or simply no longer needed.
• To be compensated for damage caused by inaccurate, false or unlawfully used information about you.
• To complain to the National Privacy Commission.

Write to mategroupph@gmail.com. We will answer within 15 working days, and if a request is going to take longer than that we will tell you why rather than going quiet.

If you are a customer of a shop that uses Tindahub, that shop decides what happens to your information and we will usually pass your request to them. We will tell you that we have done so.

Section 20 of the Act requires organisational, physical and technical measures proportionate to the risk. In practice:

• Data is encrypted in transit and at rest.
• Passwords and staff PINs are hashed. Nobody at Tindahub can read them, including us.
• Access to a shop's data is restricted to that shop's own owner and staff, enforced in the database rather than only in the app.
• Staff access is scoped by role, so a cashier does not see payroll.
• Access by our own people is limited to those who need it to run or support the service, and it does not end when someone leaves: the duty of confidentiality continues.

No system is perfectly secure and we are not going to claim otherwise. If a breach happens that is likely to put you at real risk of serious harm, we will notify the National Privacy Commission and everyone affected, describing what happened, what information was involved and what we are doing about it. The Act requires that promptly and we treat it as a floor, not a target.

Tindahub is a tool for running a business and is not directed at children. We do not knowingly collect information from anyone under 18 as a user of the service. If you believe a child’s information has reached us, write to mategroupph@gmail.com and we will remove it.

If we change what we collect, why, or how long we keep it, we will change this page and change the date at the top. Where the change materially affects you, we will tell you in the app or by email rather than relying on you noticing. The Act does not allow us to quietly amend what we have already told you.

Tindahub is operated by Automates PH, in the Philippines. For anything on this page, including any of the rights in section 7, write to mategroupph@gmail.com.

You also have the right to complain directly to the National Privacy Commission, and you do not need to come to us first.

See also our terms of service.