This Privacy Policy explains how TaraSama, 1274 Padre Algue St, Tondo, Manila, 1012 Metro Manila, Philippines ("TaraSama", "we") collects, uses and protects personal data, in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).
1. Personal data we collect
- Account data: name, email, phone number, password (stored hashed), account type.
- Host profile data: display name, photos, birth date, gender, city/area, languages, rates, availability.
- Identity verification data (sensitive personal information): government ID images, ID type, the last 4 characters of the ID number, date of birth, and (for clients) a selfie. The full ID number is stored only as a one-way cryptographic hash used to detect duplicate accounts.
- Booking data: event type, venue, date/time, check-in/check-out time and location, reviews.
- Messages: in-app chat content (contact details are masked automatically).
- Payment data: transaction IDs, amounts, crypto wallet addresses (and optional QR images) for withdrawals. We do not store card numbers.
- Safety data: SOS alerts with location, reports, emergency contact.
- Technical and security data: when you sign up or log in we record your IP address, browser and device type, operating system, language, time zone, screen size, a device identifier stored in a cookie and in your browser's local storage, and a one-way "fingerprint" code made from browser and hardware settings. We also use cookies needed to keep you logged in.
2. Why we process it (purpose and legal basis)
- To provide the service and process bookings and payments (contract).
- To verify identity and age, prevent fraud, fake accounts and trafficking, and keep users safe (legitimate interest and legal obligation). Security data lets us spot repeat fake accounts and block devices and networks of people banned for breaking our Terms or the law.
- To respond to support requests and disputes.
- To comply with legal obligations and lawful requests from authorities.
- Sensitive personal information (ID data) is processed with your consent and as necessary to protect the life and safety of users.
3. How long we keep it
- ID images and selfies are encrypted and automatically deleted 90 days after approval (7 days after a rejection). The verification result and hashed ID number are kept while your account exists, to prevent duplicate accounts.
- Booking, payment and ledger records are kept as required by tax and accounting rules.
- Sign-in security records are kept for 1 year; blocks of banned devices are kept until lifted.
- Other account data is deleted or anonymised after account closure, unless needed for a dispute or legal obligation.
4. Who can see your data
- Other users see only your public profile information (hosts) or first name (clients). Contact details are never shown.
- Only authorised TaraSama staff (e.g. verification reviewers) can view ID documents, through time-limited access that is logged.
- Service providers who help us operate (hosting, email, payment gateway) under data processing agreements.
- Authorities when required by law.
5. Security
We use encryption in transit (HTTPS) and at rest for ID files, access controls with two-factor authentication for staff, audit logs, and regular backups.
6. Your rights
Under the Data Privacy Act you have the right to be informed, to access, to object, to erasure or blocking, to rectification, to data portability, and to damages; and you may lodge a complaint with the National Privacy Commission. To exercise your rights, contact our Data Protection Officer.
7. Data Protection Officer
TaraSama Data Protection Officer · support@tarasama.com · 1274 Padre Algue St, Tondo, Manila, 1012 Metro Manila, Philippines
8. Changes
We will notify you of material changes to this policy through the website or email.