Privacy Policy

1. Personal Information Controller

Bubu (operated by its owners, referred to as "we," "us," or "our") is the Personal Information Controller (PIC) responsible for your personal data collected through the app and website. If Bubu is operated by an individual or unregistered business, that individual acts as the PIC for purposes of the Data Privacy Act of 2012.

You may reach us at hello@bubu.himo.site.

2. Personal data we collect

We collect only data that is necessary to provide and improve Bubu:

• Account data: name, email address, and profile details you provide on registration.
• Group and contribution data: group names, settings, contribution amounts, cycle records, and payment status you enter.
• Payment method details: account labels or QR codes you voluntarily add so group members can send you payments. We do not collect card numbers, PINs, bank login credentials, or direct access to any e‑wallet or bank account.
• Device and usage data: browser type, device identifiers, IP address, and how you interact with the app, used to operate and improve the service.
• Mobile app permissions (if applicable): when using our mobile app, you may be asked to grant permissions (for example, to access your camera for uploading payment proof, or notifications for reminders). We will only request permissions that are reasonably necessary for the relevant feature, and you can manage these permissions through your device settings.

Bubu is intended for users aged 18 and above. We do not knowingly collect personal data from children under 18 years old. If you believe a child has provided us with personal data, please contact us so we can delete it where appropriate.

3. Legal basis and purposes of processing

Under the Data Privacy Act, we process your personal data on the following bases:

• Contract performance: to create and manage your account, run groups, send reminders, and deliver the core features of the app.
• Legitimate interest: to improve the app, prevent fraud, and ensure the security of our systems.
• Consent: for optional features such as marketing communications, where we will seek your explicit consent separately.
• Legal obligation: to comply with applicable Philippine laws and lawful orders from government authorities.

4. How we use your data

We use your personal data to:

• Create and maintain your account and group memberships.
• Display contribution schedules, statuses, and histories to group members.
• Send payment reminders and notifications you have opted into.
• Improve and develop Bubu based on how it is used.
• Detect, investigate, and prevent fraudulent or unlawful use of the app.
• Comply with our legal obligations under Philippine law.

5. Data sharing and third parties

We do not sell your personal data. We may share data only in the following limited circumstances:

• Service providers (Personal Information Processors): third‑party providers such as our hosting provider (e.g., Supabase) and authentication services that process data on our behalf under strict confidentiality terms.
• Group members: certain information you enter (e.g., your display name, payment details you choose to share) is visible to members of groups you belong to. You control what you share.
• Legal authorities: when required by law, court order, or lawful request from Philippine government authorities.

Some of our service providers may process data outside the Philippines. Where this occurs, we ensure appropriate safeguards are in place consistent with the DPA and its IRR.

6. Data retention

We retain your personal data for as long as your account is active or as necessary to provide the service. If you delete your account, we will delete or anonymize your personal data within a reasonable period, except where retention is required by law or for the resolution of disputes.

We may retain certain aggregated or anonymized data (which no longer identifies you) for analytics, service improvement, and business purposes.

7. Security

We implement reasonable organizational, technical, and physical security measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction. These measures may include encryption in transit, access controls, and regular monitoring of our systems.

However, no system is completely secure. You use the app at your own risk and should take care to protect your own login credentials.

8. Your rights as a data subject

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data:

• Right to be informed: to know how your data is collected and processed.
• Right of access: to request a copy of your personal data we hold.
• Right to correction: to have inaccurate or incomplete data corrected.
• Right to erasure or blocking: to request deletion or blocking of data that is no longer necessary, unlawfully processed, or collected without your consent.
• Right to object: to object to the processing of your data, including for direct marketing purposes.
• Right to data portability: to receive your data in a structured, commonly used format where technically feasible.
• Right to damages: to be indemnified for damages caused by inaccurate, incomplete, or unlawfully processed data.

To exercise any of these rights, contact us at hello@bubu.himo.site. We will respond within a reasonable time consistent with the DPA and its IRR.

9. Complaints

If you believe your data privacy rights have been violated, you may file a complaint with the National Privacy Commission (NPC) of the Philippines at www.privacy.gov.ph. We encourage you to contact us first so we can address your concerns directly.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the app or by email. Your continued use of Bubu after changes are posted constitutes your acceptance of the updated policy.

11. Contact

For any privacy‑related concerns or to exercise your rights, contact us at: hello@bubu.himo.site.