Draft, pending legal review.

Privacy Notice

This notice explains what personal information GoTuloy handles, why, and what you can do about it, as required by the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.

Who we are

GoTuloy is operated by GoTuloy, [business address]. For anything about your personal information, contact our Data Protection Officer at hello@gotuloy.com.

We play two roles:

  • For hosts (people with a GoTuloy account), we are the personal information controller of your account details.
  • For guests (people who open a host's page), the host is the personal information controller and we process information on the host's behalf, under our Data Processing Agreement.

Information about hosts

  • Name, email address and, if you add it, a mobile number.
  • Your password, stored only as a one-way hash.
  • Your business name for receipts, your properties and the content of your pages.
  • Payment records: amount, date, method (for example GCash) and the payment reference from PayMongo, PayPal or GCash. Card numbers and e-wallet logins are handled by PayMongo, PayPal or GCash; we never see or store them. If you pay by GCash to our account, we keep the reference number and the GCash name you give us.
  • Two-factor authentication secrets, if you turn it on, stored encrypted.

We use this to run your account, bill you, send service emails (receipts, renewal reminders, guestbook alerts and a few setup tips you can switch off), keep the service secure, and meet legal and tax duties.

Information about guests

Guests never need an account. We do not ask guests for their email address, phone number, government ID or payment details.

  • Guestbook notes: the display name, optional "from" place, message and optional photo a guest chooses to submit, the time they gave consent, and a scrambled (hashed) form of their IP address used only to stop spam. Photos are resized and all embedded data, including location, is removed before storage.
  • Taps on the page: when a guest confirms the house rules or taps "Done, we've checked out", we store the time, the guest count they chose and a hashed IP address.
  • Stay code: after a guest enters the correct stay code, an encrypted cookie on their device remembers it until the code changes.
  • Visit counts: we count page views, QR scans and which sections were opened as daily totals per page. We do not keep a record of individual visits.
  • Building guest lists: hosts may enter guests' names and a vehicle plate number to prepare the email their building administrator asks for. These are encrypted and deleted automatically 7 days after check-out. Guests do not see this feature.

Cookies

We use only cookies needed for the service: the login session and security token for hosts, the light or dark theme choice, the guest's stay-code unlock, and the language choice. We do not use advertising or cross-site tracking cookies.

Who we share it with

We do not sell personal information. We share it only with service providers that help us run GoTuloy, under contracts that protect it:

  • PayMongo Philippines, Inc. (payments)
  • PayPal Pte. Ltd. (payments, if you pay with PayPal)
  • [Hosting provider], servers in Singapore
  • Cloudflare (security and content delivery, including bot protection on forms)
  • [Email provider] (sending account emails)
  • [Error-monitoring provider] (diagnosing errors)

Some of these providers store or process information outside the Philippines, mainly in Singapore. We share information with authorities only when the law requires it.

How long we keep it

  • Building guest-list names and plate numbers: deleted 7 days after check-out.
  • Guestbook notes a host hides or rejects: deleted 30 days after being hidden.
  • When a host deletes their account: their pages, notes and photos are deleted within 30 days.
  • Payment records: kept as long as tax and accounting rules require.

Your rights

Under the Data Privacy Act you may ask to be informed, to access, correct or delete your information, to object to processing, to receive a copy in a portable format, and to be compensated for damages. You may also complain to the National Privacy Commission (privacy.gov.ph).

Guests: to have a guestbook note removed, ask the host, or write to hello@gotuloy.com with the page link and the note, and we will pass it on or remove it.

Security

We use encrypted connections, encrypt sensitive fields, require two-factor authentication for our staff, log every staff action on host accounts, and limit access to the people who need it. If a breach affects your information, we will notify you and the National Privacy Commission as the law requires.

Changes

We will post changes here and email hosts about significant ones before they take effect.