Privacy Policy — Merchant (store) app

Personal and business data we collect

• Account holder data — name, email, phone, authentication credentials / Google Sign-In identifiers.
• Store profile — store name, description, cuisine tags, logo (including pending logo approvals), operating hours, open/closed status, map location / store pin, and packaging-related catalog fields.
• KYC and compliance — business and identity documents you upload, store address submissions, and site-inspection related evidence reviewed by FlashFood.
• Catalog and order operations — products, prices, variants/add-ons, moderation status, and order threads visible to your store after payment clearance rules are met.
• Wallet and cash-out — ledger balances, fee rates applicable to your account, cash-out method details (for example GCash/Maya/bank account name and number), and cash-out request history. Methods are call-verified by FlashFood before approval.
• Communications — kitchen/order chats where enabled, review responses/disputes, and Report a concern tickets.

Sensitive personal information

Government IDs, business registration documents, and similar uploads may constitute sensitive personal information or regulated business records. We process them for onboarding, site inspection, fraud prevention, and payout integrity, with access limited to authorized personnel.

Purposes and lawful bases

• Verify and approve your store (including site inspection) before customers can see it (contract / legitimate interest / consent for document uploads).
• Display your catalog and fulfill customer orders (contract).
• Calculate and credit wallet earnings net of platform fees, and process cash-out requests (contract).
• Moderate logos, products, and reviews for safety and platform standards (legitimate interest).
• Contact you about verification, payouts, disputes, and policy enforcement (contract / legitimate interest).
• Comply with the Internet Transactions Act, Consumer Act, tax/accounting needs, and other applicable Philippine laws (legal obligation).

Customer data you receive

When fulfilling orders you may see customer delivery details and order contents necessary for preparation and handover. You must use that information only to fulfill FlashFood orders, keep it secure, and not use it for unrelated marketing or disclosure outside the platform, except as required by law.

You act as a personal information controller (or as otherwise characterized by law) for any independent processing you perform outside FlashFood’s instructions. FlashFood remains controller of platform account and transaction systems described here.

Service providers and disclosures

We use processors and infrastructure providers under arrangements that require appropriate protection of personal data, which may include:

• Cloud database and object storage for accounts, orders, and uploaded files (for example identity documents and payment proofs).
• Email delivery for transactional messages (when configured).
• Google Sign-In, when you choose to authenticate with Google.
• Maps / Places services to help you set delivery pins and store locations.
• Push notification services (for example Expo / device OS push channels) for order and account alerts.

Retention and account deletion

We keep personal data only as long as necessary for the purposes stated in this Policy, or as required by law (including tax, accounting, consumer, and dispute-related obligations).

If you request account deletion from the customer-facing account controls, FlashFood applies a soft-delete immediately: commerce features are locked, while you may still sign in during a 150-day window to cancel deletion (unless restore is blocked for abuse). After 150 days, we hard-delete or anonymize personal identifiers and remove KYC/media files where feasible. Order and financial ledger records may be retained in anonymized or minimized form where needed for audits, fees, cash-out history, or legal claims.

Ban or suspension by FlashFood is separate from user-requested deletion and may keep necessary records for safety and fraud prevention.

Security measures

We implement organizational, physical, and technical security measures appropriate to the nature of the personal data we process, including access controls for the admin console, encrypted transport (HTTPS/TLS) for production deployments, authentication via OAuth/JWT sessions, and role-based restrictions so merchants and riders only see order information needed for their work.

No method of transmission or storage is completely secure. Please protect your login credentials and notify us promptly through Report a concern if you suspect unauthorized access to your account.

Your rights under the Data Privacy Act

Subject to the conditions and limitations in the DPA and NPC issuances, you may exercise the following rights regarding your personal data:

• Right to be informed — to know how we collect, use, share, and retain your personal data.
• Right to object — including to processing for direct marketing or certain automated processing, where applicable.
• Right to access — to reasonable access to your personal data and information about how it is processed.
• Right to rectification — to dispute inaccurate or incomplete personal data and request correction.
• Right to erasure or blocking — to request suspension, withdrawal, blocking, removal, or destruction of personal data in the cases allowed by law (for example, when data is unlawfully obtained, no longer necessary, or you have withdrawn consent where consent is the basis).
• Right to damages — to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data, as provided by law.
• Right to data portability — where personal data is processed by electronic means and in a structured or commonly used format, to obtain a copy in an electronic or structured format that is commonly used, subject to technical feasibility and legal limits.
• Right to lodge a complaint — with FlashFood and/or the National Privacy Commission (https://privacy.gov.ph).

How to contact us and the NPC

For privacy requests, questions, or complaints about this Policy, use Report a concern in the FlashFood app or console (Help / Profile → Report a concern). That channel creates a support ticket with an in-app chat so we can verify your identity and respond.

If you are not satisfied with our response, you may file a complaint with the National Privacy Commission through the channels published at https://privacy.gov.ph.