Privacy Policy — Rider app

Personal data we collect

• Account data — name, email, phone, authentication identifiers.
• Rider verification — KYC documents and details needed for rider approval (including information about how you deliver). Riders must be approved before accepting jobs.
• Duty and job data — on-duty / off-duty status, claimed orders, handover codes, delivery status updates, and related chats.
• Location data — precise or approximate location while you use location features for matching, navigation, and live map visibility to FlashFood ops and, where applicable, the customer for an active delivery.
• Wallet and cash-out — delivery fee credits net of platform fees, cash-out methods and requests (subject to admin verification).
• Reviews and disputes — ratings and comments about your deliveries, and any dispute records.

Location — important notice

Location is central to rider operations. When location permission is granted and you are on duty or on an active job, FlashFood may collect and share location updates so customers and operations can track the delivery and so available jobs can be coordinated.

You can control OS-level location permissions; disabling location may limit or prevent job access. Visual or in-app indicators may show when location is used for an active session, consistent with platform design.

Sensitive personal information

Government IDs and similar KYC uploads are treated as sensitive personal information and used for rider approval, safety, and fraud prevention.

Purposes and lawful bases

• Approve riders and enforce high-mobility / carry rules (contract / legitimate interest / consent for KYC).
• Assign and complete deliveries safely (contract).
• Credit earnings and process cash-outs (contract).
• Protect customers, merchants, and riders through moderation and investigations (legitimate interest / legal claims).
• Comply with applicable Philippine laws (legal obligation).

Sharing

Customers and merchants receive the rider information needed for a live order (for example first name or display name and delivery progress). FlashFood administrators can view duty, location (ops map), KYC, and wallet records for operations and safety.

Service providers and disclosures

We use processors and infrastructure providers under arrangements that require appropriate protection of personal data, which may include:

• Cloud database and object storage for accounts, orders, and uploaded files (for example identity documents and payment proofs).
• Email delivery for transactional messages (when configured).
• Google Sign-In, when you choose to authenticate with Google.
• Maps / Places services to help you set delivery pins and store locations.
• Push notification services (for example Expo / device OS push channels) for order and account alerts.

Retention and account deletion

We keep personal data only as long as necessary for the purposes stated in this Policy, or as required by law (including tax, accounting, consumer, and dispute-related obligations).

If you request account deletion from the customer-facing account controls, FlashFood applies a soft-delete immediately: commerce features are locked, while you may still sign in during a 150-day window to cancel deletion (unless restore is blocked for abuse). After 150 days, we hard-delete or anonymize personal identifiers and remove KYC/media files where feasible. Order and financial ledger records may be retained in anonymized or minimized form where needed for audits, fees, cash-out history, or legal claims.

Ban or suspension by FlashFood is separate from user-requested deletion and may keep necessary records for safety and fraud prevention.

Security measures

We implement organizational, physical, and technical security measures appropriate to the nature of the personal data we process, including access controls for the admin console, encrypted transport (HTTPS/TLS) for production deployments, authentication via OAuth/JWT sessions, and role-based restrictions so merchants and riders only see order information needed for their work.

No method of transmission or storage is completely secure. Please protect your login credentials and notify us promptly through Report a concern if you suspect unauthorized access to your account.

Your rights under the Data Privacy Act

Subject to the conditions and limitations in the DPA and NPC issuances, you may exercise the following rights regarding your personal data:

• Right to be informed — to know how we collect, use, share, and retain your personal data.
• Right to object — including to processing for direct marketing or certain automated processing, where applicable.
• Right to access — to reasonable access to your personal data and information about how it is processed.
• Right to rectification — to dispute inaccurate or incomplete personal data and request correction.
• Right to erasure or blocking — to request suspension, withdrawal, blocking, removal, or destruction of personal data in the cases allowed by law (for example, when data is unlawfully obtained, no longer necessary, or you have withdrawn consent where consent is the basis).
• Right to damages — to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data, as provided by law.
• Right to data portability — where personal data is processed by electronic means and in a structured or commonly used format, to obtain a copy in an electronic or structured format that is commonly used, subject to technical feasibility and legal limits.
• Right to lodge a complaint — with FlashFood and/or the National Privacy Commission (https://privacy.gov.ph).

How to contact us and the NPC

For privacy requests, questions, or complaints about this Policy, use Report a concern in the FlashFood app or console (Help / Profile → Report a concern). That channel creates a support ticket with an in-app chat so we can verify your identity and respond.

If you are not satisfied with our response, you may file a complaint with the National Privacy Commission through the channels published at https://privacy.gov.ph.