Privacy Policy
1. Who we are
UTOS ("we", "us") runs a neighbourhood delivery platform that connects customers, local stores ("Tindahan") and riders in the Philippines. We are the personal information controller for the data described here, and we process it in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).
Data Protection Officer: privacy@utos.shop
2. What we collect
| Who | Data | Why |
|---|---|---|
| Everyone | Name, mobile number, email, password (stored hashed), language setting | Create and secure your account, send codes and order updates |
| Customers | Delivery addresses and map pin, orders, favourites, vouchers used, ratings and reports | Deliver your orders, apply promos (e.g. SAMPUNG UTOS), handle complaints |
| Riders | Government ID, registration selfie, shift selfies before going online, vehicle details, live GPS location while online, earnings and wallet | Verify identity, confirm the right person is riding each shift, assign nearby orders, show customers where their order is, pay you |
| Store owners | Government ID, selfie, store name, address, location, products and photos, opening hours, payout details | Verify the business owner, list your store, pay you |
| Devices | Approximate device info, app version, and in the Android app whether a VPN or fake-GPS (mock location) app is active | Prevent fraud such as fake locations; keep the service working |
| Payments | Payment status and reference numbers. We never see or store your full card or GCash login. | Confirm payment, refunds and payouts |
3. Location
Customers: we use your pin only to find nearby stores and deliver your order. Riders: we collect GPS location only while you are online or on an active delivery. We show a rider's live position to the customer only during that customer's active order, and the customer's exact address is shown to the rider only after they accept the order (before that, only the general area is shown).
4. ID and selfie checks
Rider and store-owner IDs and selfies are stored in a private storage area that only the account owner and authorised UTOS administrators can open. They are reviewed by a person (and, if enabled, by an identity-verification provider) to approve accounts and to compare shift selfies with the registration selfie. A mismatch can lead to the account being frozen pending review.
5. Legal basis
We process data because it is necessary to provide the service you asked for (contract), to comply with law (e.g. tax and anti-fraud obligations), for our legitimate interest in keeping the platform safe, and, where required, with your consent (for example, for marketing messages, which you can turn off).
6. Who we share data with
We do not sell personal data. We share only what is needed:
- Between users of an order: the customer, the store and the assigned rider see the names, contact numbers and addresses needed to complete that order.
- Service providers who process data for us under contract: Supabase (database and file storage), Netlify (website hosting), Resend (email), Semaphore (SMS), Xendit (payments), and map-tile providers (map display). Some of these store data outside the Philippines; we use providers with appropriate security safeguards.
- Authorities when required by law, court order, or to protect someone's life or safety.
7. How long we keep it
- Account data: while your account is active, and up to 5 years after closure for tax, accounting and dispute purposes.
- ID documents and selfies: while the account is active, then deleted within 1 year after closure unless needed for an open investigation.
- Shift selfies and rider GPS history: up to 1 year.
- Order records: up to 10 years (Philippine bookkeeping rules).
8. Security
Data is encrypted in transit (HTTPS). Access is controlled per account with row-level security, so users can only read their own records; ID images are in private storage; administrator actions are recorded in an audit log. No system is perfectly secure; if a breach affects you, we will notify you and the NPC as the law requires.
9. Your rights
Under the Data Privacy Act you have the right to be informed, to access, to correct, to object, to erasure or blocking, to data portability, to damages, and to file a complaint with the National Privacy Commission (privacy.gov.ph). Email privacy@utos.shop from your registered email and we will respond within 15 working days. Some data may have to be kept even after a deletion request where the law requires it (e.g. completed order and payment records).
10. Children
UTOS is for people aged 18 and older. Riders and store owners must be at least 18. We do not knowingly collect data from children.
11. Changes
We may update this policy. We will post the new version here with a new effective date, and tell you in the app if the change is significant.