Privacy Policy of BayanihanPH

1. Information We Collect

What we collect depends on how you use the Platform. We collect the following categories of personal information:

• Account Information: Full name, email address, date of birth, profile photo and cover image, and any bio you write. Organization accounts also provide the organization's name and the name and title of its representative. If you sign in with Google, we receive your name and email address from Google.
• Identity Verification Information: To verify Campaign Owners and to lift donation limits, we collect a government-issued ID, a selfie, and, for organizations, registration documents such as SEC, DTI, or BIR records and DSWD permits. From these we record the ID type and number, details shown on the document, and its issue and expiry dates. See Section 3 for how these documents are checked.
• Payout Information: Bank or e-wallet account holder name, account number, bank code, and the email address and mobile number you give for payouts.
• Campaign Information: Campaign titles, stories, photos, updates, beneficiary details you choose to include, and any permits you upload.
• Donation Information: Donor name and email address, the amount, the payment method and provider references, any message you attach, and your donation history. We never receive or store your full card number or account credentials; payment details are entered on the payment provider's own pages.
• Communications and Content: Comments, reports you file about a campaign, messages you send to organizers through the Platform, referral program applications (name, email, phone number, brand name, and social links), and emails you send us.
• Technical Data: IP address, browser and device information, and the pages you visit. We record the IP address and browser of administrators when they take actions on the Platform, and of payment providers when they notify us of a payment. Sign-ups are protected by Google reCAPTCHA, which receives your IP address and browser signals to distinguish people from bots.
• Account Activity: The calendar dates on which you use the Platform while signed in. We record only the date, not the time, the pages you visit, or your device, and use it to count how many accounts use the Platform each day and month.

We do not collect your home address. Contact numbers are collected only where you provide them, such as for payouts or a referral application.

2. How We Use Your Information

We collect and process your data to:

• Create and manage your account and enable the creation and promotion of campaigns
• Verify the identity of Campaign Owners and donors, as described in Section 3
• Facilitate secure donations, pay out campaign funds, and keep financial records
• Provide receipts, confirmations, and campaign updates to donors
• Detect and prevent fraud, misuse, payment disputes, and off-platform solicitation, and to enforce our Terms of Service
• Communicate with you regarding your campaign, donation, or account
• Understand how the Platform is used and improve our services
• Comply with Philippine law, including tax, anti-money laundering, and data privacy requirements

We process your data on the basis of your consent, the performance of our agreement with you, our legal obligations, and our legitimate interest in running a safe fundraising platform. Identity verification images are processed on the basis of your explicit consent, which you give when you submit them.

3. Identity Verification and Automated Checks

When you submit a government ID and selfie, we check that the document is genuine, current, and belongs to you. These checks combine automated tools provided by the service providers listed in Section 4 with review by our team. The automated tools include facial comparison between your selfie and your ID and recognition of the text on the document. Facial comparison involves processing biometric information, which is sensitive personal information under the Data Privacy Act. We keep the outcome of the checks, not a reusable facial template.

We also use your verification and payout details to detect duplicate or linked accounts and other signs of fraud.

A verification may be decided automatically or by a member of our team. If your verification is declined, you may ask for a human review by contacting us at the address in Section 11; a member of our team will look at your submission and explain the outcome.

Verification documents are stored with restricted access and can be viewed only by you and our authorized administrators. Earlier submissions are kept as part of your verification history for fraud prevention and audit purposes, as described in Section 5.

4. Data Sharing and Disclosure

We do not sell or rent your personal data. We share it only as described here.

4.1 Service Providers

We rely on the following providers to run the Platform. Each processes personal data only on our instructions and for the purpose stated:

• Supabase — database, authentication, and scheduled jobs (all account, campaign, and donation data)
• Vercel — website hosting and privacy-focused page analytics
• Cloudinary — storage and processing of images, including profile photos, campaign images, permits, and verification documents, and identity verification checks
• Amazon Web Services — identity verification checks
• Google — Sign in with Google, reCAPTCHA bot protection at sign-up, and identity verification checks
• Resend — transactional emails such as receipts, confirmations, and campaign notifications
• Payment providers (currently Maya and SwiftPay) and their partner banks — to accept donations and disburse campaign funds. At checkout, we send the provider your name, email address, the donation amount, and a reference to the campaign and donation

4.2 Other Users and the Public

• Campaign Owners with a public campaign are asking the public for money, so their full name (or organization name), profile, and campaign are public and may be indexed by search engines.
• Donors and other users are shown to others only by a shortened name, and their profile pages are not indexed by search engines.
• Donations appear on the campaign page with the donor's name unless you choose to donate anonymously. Anonymous donations hide your name from the public and from the Campaign Owner, but your name and email are still recorded with the donation so we can issue receipts, handle refunds and disputes, and meet our legal record-keeping obligations. They are visible to our administrators and are sent to the payment provider to process the payment.
• Messages to organizers sent through the Platform are emailed to the organizer with the name and email address on your account, and a copy is kept with your account so we can act on abuse reports.

4.3 Legal and Safety

• Law enforcement, courts, and regulatory authorities, where required or permitted by law, including to report suspected fraud, money laundering, or other illegal activity
• Payment providers, card networks, and banks, to respond to chargebacks, refund requests, and payment disputes
• Our internal team and authorized administrators, for platform operation, support, moderation, and fraud review. Administrator actions are logged with the administrator's identity, IP address, and browser.

4.4 Transfers Outside the Philippines

Several of the providers above store or process data on servers outside the Philippines. Where that happens, we rely on the provider's contractual commitments to protect your data to a standard consistent with the Data Privacy Act.

5. Data Retention

We keep your data for as long as your account is active and for as long as needed to fulfill the purposes in this policy. Some records are kept longer:

• Financial records — donations, payouts, and the related payment provider notifications are retained for at least five years after the transaction, as required by Philippine tax and anti-money laundering rules
• Verification records — identity documents, including earlier submissions, and the results of verification checks are retained while your account exists and for as long as needed to investigate fraud, resolve disputes, and meet legal obligations
• Fraud, moderation, and audit records — reports, flagged content, cross-account matches, and administrator audit logs are retained for as long as needed to protect the Platform and its users
• Account activity dates are deleted after 13 months
• Comments and campaign updates you delete are hidden from the Platform but retained in a deleted state for moderation and dispute purposes

When data is no longer needed, we delete it or anonymize it so it no longer identifies you.

6. Data Security

We protect your data with encryption in transit, access controls that limit each user to their own records, restricted storage for verification documents, and audit logging of administrator actions. While we do our best to safeguard your information, no system is completely secure.

If a security breach affects your personal data in a way that is likely to cause you harm, we will notify you and the National Privacy Commission within the period required by law.

7. Your Rights Under the Data Privacy Act

As a data subject, you have the right to:

• Be informed about how your data is processed, which this policy is intended to do
• Access the personal data we hold about you
• Correct or update your data; most account details can be edited in your profile
• Object to processing, including to withdraw consent to identity verification, though this may mean you can no longer run a campaign or donate above the unverified limit
• Request deletion or blocking of your data, subject to the retention rules in Section 5
• Ask for a human to review a decision that was made automatically about you
• Receive a copy of your data in a commonly used electronic format
• Be indemnified for damages caused by unlawful processing of your data
• Lodge a complaint with the National Privacy Commission (NPC)

To exercise any of these rights, email us at the address in Section 11 from the email address on your account. Requests are handled by our team, and we respond within the time required by law. To delete your account, we remove or anonymize your profile and content, but keep the financial and verification records described in Section 5 for the period the law requires.

8. Age Requirement

The Platform is for people aged 18 and over. We check your date of birth at sign-up and against your government ID during verification. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we will delete it. Campaign stories may describe minors as beneficiaries; Campaign Owners are responsible for having the consent of a parent or guardian before sharing a minor's information.

9. Cookies and Similar Technologies

We use cookies to keep you signed in, remember your display preferences, and allow access to private campaigns you have been given a link to. Google reCAPTCHA may set its own cookies on the sign-up page. We also use Vercel Web Analytics, which counts page visits without cookies and without building a profile of you.

You can clear or block cookies in your browser settings, but you will not be able to stay signed in without them. Our Cookie Policy lists each cookie we use.

10. Third-Party Links

Our platform may contain links to third-party websites, including social media pages of organizers. We are not responsible for the privacy practices of these sites.

11. Contact Us

If you have any questions, requests, or concerns regarding your privacy or this policy, please contact:

contact@bayanihanph.org

12. Updates to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with the updated date, and we will notify you of material changes by email or a notice on the Platform. Continued use of the platform after a change takes effect constitutes your acceptance of it.