Privacy Policy | Apolido

1. Overview

This Privacy Policy explains what personal information Apolido collects, why we collect it, who can see it, and the choices you have. It is written with reference to the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and covers the Apolido website and system, which connects clients with skilled workers and leadmen.

Responsible organization or person (personal information controller): [TEMPORARY PLACEHOLDER — INSERT RESPONSIBLE PERSON OR ORGANIZATION]. Effective date: [TEMPORARY PLACEHOLDER — CONFIRM EFFECTIVE DATE].

2. Personal Information We Collect

2.1 Information you give us

Account details — full name, optional company name, email address, mobile number, and password. Passwords are stored as a one-way hash, not in readable form.
Profile and settings — an optional profile photo, saved addresses (label, full address, note), and your notification preferences.
Booking details — trade requested, job location, start and end dates, number of workers, notes, and details of added days.
Payment details — amount, payment method, reference number, an optional note, and the proof-of-payment image you upload. We do not collect card numbers.
Reviews — rating, optional title and comment, and whether you want to appear as Anonymous.
Worker and leadman information (entered by the administrator and the worker) — worker ID, trade, photo, bio, years of experience, daily rate, availability, job progress updates with before-and-after photos, and payout details (payout method, account name and number, optional QR code, and payout proofs and reports).

2.2 Information recorded by the system

Activity logs — who did what and when, such as the user, name, role, action, a short description, the related record, and a small amount of non-sensitive detail.
Notifications — messages the platform creates about your bookings and payments.
Security records — the number of failed login attempts, email verification and password-reset tokens (which expire), and the dates your account and records were created or changed.

2.3 Information the application does not collect

The application does not store IP addresses, browser or device details, or precise location, and no analytics or advertising tracker was found in it. Your hosting provider's server may still keep standard access logs: [TEMPORARY PLACEHOLDER — CONFIRM HOSTING PROVIDER LOGGING PRACTICES].

2.4 Age

[TEMPORARY PLACEHOLDER — CONFIRM AGE REQUIREMENTS AND CHILDREN'S DATA POLICY]

3. How and Why We Use Personal Information

Create and verify your account and keep it secure.
Process service requests, reserve and assign workers, and coordinate the job.
Review and verify deposits and other payments, and record payouts to workers.
Send notifications and emails about your bookings, payments and progress updates, according to your notification preferences.
Show worker profiles and publish reviews.
Keep an audit trail of important actions, prevent misuse, and resolve disputes.

Legal basis for each purpose: [TEMPORARY PLACEHOLDER — CONFIRM LEGAL BASIS FOR PROCESSING (CONSENT, CONTRACT, LEGITIMATE INTEREST, OR LEGAL OBLIGATION)].

4. How Information Is Handled for Each Role

4.1 Clients

You can see your own account, saved addresses, bookings, payments and notifications.

4.2 Workers and leadmen

Assigned workers and leadmen can see the details needed to do a job, which include the client's name, the job location, dates and notes. They also see their own profile and payout information.

4.3 Admins

Administrators can see account, booking, payment, review, payout and activity-log information in order to run the platform.

4.4 The public

Worker and leadman profiles shown on the website (such as name, photo, trade, rating, experience and rate) and published reviews are visible to visitors. A review shows the client's name unless the client chose Anonymous.

The platform has no feature that sells personal information or shares it for advertising. [TEMPORARY PLACEHOLDER — OWNER TO CONFIRM NO OTHER DISCLOSURES, INCLUDING DISCLOSURES REQUIRED BY LAW].

5. Booking Records, Payment Proofs and Uploaded Files

Booking details are used to match, schedule and manage the job. Payment proofs and reference numbers are used by Apolido administrators to verify that a payment was made. Photos you or the team upload (profile photos, payment proofs and job-progress photos) are stored on the server.

Worker payout QR codes and payout proofs are kept in a restricted folder and are delivered only after the system checks who is asking.

6. Sessions, Cookies and Technical Information

Apolido uses one necessary session cookie to keep you logged in. It lasts until you close your browser, cannot be read by page scripts (HttpOnly), is not sent on cross-site requests (SameSite Lax), and is marked Secure when the site is opened over HTTPS.
Forms use security tokens to protect against forged requests.
No analytics, advertising or tracking cookies were found in the application. The third-party services listed below may receive standard request information from your browser.

7. Third-Party Services

The application uses these third-party services:

Email delivery — emails are sent through an SMTP email service (Gmail SMTP is configured in the system).
Address search — when you type in the Location field of the request forms on the Workers page, the text you enter is sent from your browser to OpenStreetMap's Nominatim search service to suggest matching places in the Philippines.
Fonts — pages load fonts from Google Fonts, so your browser contacts Google when a page loads.
Admin charts — the administrator dashboard loads the Chart.js library from the jsDelivr content network, so administrators' browsers contact that network.
Hosting — [TEMPORARY PLACEHOLDER — INSERT HOSTING PROVIDER, IF CONFIRMED].

These providers have their own privacy practices, which we do not control. Additional confirmed providers: [TEMPORARY PLACEHOLDER — INSERT CONFIRMED THIRD-PARTY PROVIDERS, IF ANY].

8. Data Security and Retention

8.1 Security

We use reasonable safeguards intended to protect your information. Those currently in place in the application include:

Passwords are stored as hashes.
Email verification for new accounts, and time-limited verification and reset links.
Login throttling, and temporary lockout after repeated incorrect password attempts.
Role-based access, so each role sees only its own pages.
Protected session cookies and forged-request (CSRF) tokens.
Restricted access to payout QR codes and payout proofs.

No online system can guarantee absolute security. Use of HTTPS on the live website: [TEMPORARY PLACEHOLDER — CONFIRM HTTPS AND OTHER SERVER-LEVEL SAFEGUARDS (BACKUPS, ENCRYPTION AT REST)].

8.2 Retention

Retention periods have not been set yet.

Account information: [TEMPORARY PLACEHOLDER — CONFIRM DATA RETENTION PERIOD FOR ACCOUNT INFORMATION]
Booking records: [TEMPORARY PLACEHOLDER — CONFIRM DATA RETENTION PERIOD FOR BOOKING RECORDS]
Payment proofs and payment records: [TEMPORARY PLACEHOLDER — CONFIRM DATA RETENTION PERIOD FOR PAYMENT PROOFS]
Notifications: [TEMPORARY PLACEHOLDER — CONFIRM DATA RETENTION PERIOD FOR NOTIFICATIONS]
Activity logs: [TEMPORARY PLACEHOLDER — CONFIRM DATA RETENTION PERIOD FOR ACTIVITY LOGS]

8.3 Deletion

Clients can delete their account in Settings when they have no active booking or unpaid balance. Deleting an account deactivates it and removes or replaces your name, email, phone, company name, profile photo and saved addresses. Booking and payment records, including uploaded payment proofs and job photos, are not deleted, because they are financial and operational records, and the activity log is an append-only audit record. Verification links expire after 30 minutes. Retention and deletion rules must be confirmed against operational needs and applicable legal requirements.

9. Your Privacy Rights

Under the Data Privacy Act of 2012, and subject to its conditions and exceptions, you may have the right to:

be informed about how your personal information is processed;
access your personal information;
object to certain processing;
correct inaccurate or incomplete information;
request the suspension, withdrawal, blocking, removal or destruction of your information where applicable;
data portability where applicable; and
claim compensation for damages and file a complaint with the National Privacy Commission.

Some of this can be done directly in Settings, such as updating your profile and addresses and deleting your account. Not every request can be granted in every case, for example where records must be kept for legal, financial or security reasons. More information: National Privacy Commission, privacy.gov.ph.

10. How to Make a Privacy Request

How to send a privacy request and how long we take to respond: [TEMPORARY PLACEHOLDER — CONFIRM PRIVACY REQUEST PROCEDURE AND RESPONSE TIME].

11. Changes to This Privacy Policy

We may update this policy. The latest version is always on this page, with its last-updated date at the top. How we notify users of important changes: [TEMPORARY PLACEHOLDER — CONFIRM HOW USERS WILL BE NOTIFIED OF CHANGES].

12. Contact Information

Responsible person or organization: [TEMPORARY PLACEHOLDER — INSERT RESPONSIBLE PERSON OR ORGANIZATION]
Privacy contact or Data Protection Officer: [TEMPORARY PLACEHOLDER — INSERT PRIVACY CONTACT OR DATA PROTECTION OFFICER]
Email: [TEMPORARY PLACEHOLDER — INSERT OFFICIAL CONTACT EMAIL]
Telephone: [TEMPORARY PLACEHOLDER — INSERT OFFICIAL CONTACT NUMBER]
Address: [TEMPORARY PLACEHOLDER — INSERT BUSINESS ADDRESS, IF APPLICABLE]