Privacy & data notice

1. What we collect

• Account data: the name, email address and profile photo URL that Google shares when you sign in, plus the optional mobile number you add. We never receive or store your Google password.
• Listing data: vehicle details, photos, the contact number you choose to display, and the OR/CR document you upload for review.
• Usage and safety data: when a signed-in verified account reveals a contact number, when listings are reported, and administrator actions.
• Session data: secure cookies that keep you signed in between visits.

Sign-in is handled by Google. Our database, authentication and file storage run on Supabase, which processes this data on our behalf.

2. What is shown publicly

Public listings show the vehicle details, photos (up to 3), the island, the owner's display name, and sponsored status. The owner's contact number is not included in the public page source; it is released only through an audited action available to signed-in accounts whose email address Google has verified.

3. What is never public

OR/CR documents are stored in a private bucket. Only the owner and Sakay administrators can access them. They are used solely to verify that a vehicle is properly registered for hire. They are never attached to public listings, search results, or shared with other users.

4. Why we process this data

• To operate the directory and let renters reach vehicle owners.
• To review and moderate listings, including for-hire documents.
• To prevent spam, fraud, and abuse, and to keep an audit trail of admin actions.
• To respond to reports and legal requests.

5. Consent

When you first sign in you accept these terms and consent to us processing your account data; the acceptance is recorded with a timestamp on your account. When you publish a listing you separately consent to displaying your vehicle photos and details publicly, and your contact number to signed-in users with verified emails. You can remove a listing at any time; the number stops being displayed with it.

6. Your rights under RA 10173

Under the Philippine Data Privacy Act of 2012 you have the right to be informed, to object, to access, to rectify, to erase or block, to damages, and to data portability. To exercise these rights, email sakay.support@gmail.com from the address on your account. We may need to verify your identity before acting.

7. Retention

Account and listing records are kept while the account is active. Removed listings are retained for a reasonable period for moderation and audit purposes. OR/CR documents are deleted from storage when the listing is deleted, unless we must retain them for an ongoing investigation or legal obligation.

8. Security

Access is enforced at the database level: contact numbers, private documents, reports, and audit logs are protected by row-level security. Contact reveals are rate-limited. Suspicious activity is surfaced to administrators. No system is perfectly secure, so please keep two-step verification on your Google account and verify details in person before a trip.

9. Contact

Data protection questions: sakay.support@gmail.com.