1. Introduction

CollectStory is operated by VirtualCup Solutions ("we," "our," "us") in the Philippines. This Privacy Policy explains what personal data we collect, why, who we share it with, and your rights under the Data Privacy Act of 2012 (Republic Act No. 10173), its implementing rules, and other applicable laws.

We decide how your account data is used, so for that data we are the personal information controller. For feedback your customers submit on your page, your business decides how it is used and we process it on your behalf (see Section 5).

2. Information We Collect

2.1 Your account

• Name, business name and email address
• Your password, stored only as a secure hash
• Logo and profile photo, if you upload them
• Page settings, such as your review link, rating routing and reward vouchers
• Your plan, invoices and payment status
• When you agreed to our Terms of Service and this Privacy Policy

2.2 Demo page requests

When you request a demo page, we collect your business name, email address, Google review link and IP address.

2.3 Customer feedback

When a customer rates a business through CollectStory, we collect the rating, any comment, the time, and, only if the customer chooses to give them, their name, email address and phone number.

We also use the customer's IP address briefly to block spam and to tell whether the same person rated twice within a few minutes. It is held for up to 10 minutes and is not saved with the feedback.

2.4 Payments

Payments are handled by Xendit. We receive the invoice amount and whether it was paid. We never see or store your card or bank details.

2.5 Google Business Profile

If you connect your Google Business Profile, we store the access tokens Google gives us (encrypted) and the reviews we import from your profile. You can disconnect at any time.

2.6 Information collected automatically

• Device and browser type, and pages visited, through Vercel Web Analytics, which does not use cookies
• Error reports through Sentry, with personal details such as cookies and request contents removed
• On demo pages, which parts of the page you scroll to and what you tap, such as a star rating, a print template or the sign-up button. This is recorded under a random ID for your browser tab and is not linked to your name, email or IP address
• Your IP address, used for security and rate limiting, and on our website to show prices in your currency

3. How We Use Your Information

We use personal data only for these purposes, and only on the lawful bases allowed by the Data Privacy Act:

• To provide the Service (performing our contract with you): running your pages, dashboard, invoices and emails
• To keep the Service secure (legitimate interest): preventing spam, abuse and fraud, and fixing errors
• To improve the Service (legitimate interest): understanding how features are used
• To communicate with you: service emails such as verification, invoices and onboarding tips; to stop onboarding tips, email contact@collectstory.com
• To meet legal obligations: such as keeping payment records required by tax law

We do not sell personal data, and we do not use it for advertising.

4. Who We Share Data With

We share personal data only with service providers that help us run CollectStory, under agreements that require them to protect it and use it only for our instructions:

• Vercel (United States): website and app hosting, and cookie-free analytics
• Neon (United States): database
• Cloudflare R2: storage for logos and profile photos
• Resend: sending emails
• Upstash: spam protection and scheduling onboarding emails
• Sentry: error monitoring
• Xendit (Philippines): payments
• Google: reCAPTCHA spam protection on sign-up and sign-in, the Google Business Profile connection, and a spreadsheet we use to follow up on demo requests
• ipapi.co: detecting your country on our website to show prices in your currency

4.1 Review platforms

If a customer chooses to post a public review, they do so directly on that platform (for example Google), under that platform's own privacy policy.

4.2 Legal requirements

We may disclose personal data if the law, a court order or a government authority requires it, or to protect the rights and safety of our users, the public, or us.

4.3 Business transfers

If CollectStory is merged, acquired or sold, personal data may transfer to the new owner under the same protections.

5. Customer Feedback: Business and CollectStory Roles

For feedback submitted on a business's page, that business is the personal information controller and CollectStory is its processor. We store and show the feedback only so the business can read and respond to it.

If you left feedback for a business and want to access, correct or delete it, please contact that business. You can also email us and we will pass your request on and help the business respond.

6. Data Security

We protect personal data with organizational, physical and technical measures, including:

• Encryption in transit (HTTPS) and at rest
• Hashed passwords and encrypted access tokens
• Rate limits and spam protection on public forms
• Access limited to people who need it to run the Service

No system is completely secure. If a personal data breach occurs that is likely to put you at risk, we will notify you and the National Privacy Commission as the law requires.

7. Your Rights

Under the Data Privacy Act, you have the right to:

• Be informed about how your personal data is processed
• Access your personal data
• Object to processing, and withdraw consent where processing is based on consent
• Correct inaccurate or incomplete data
• Erasure or blocking of data that is outdated, false, unlawfully obtained or no longer needed
• Data portability: get a copy of your data in a commonly used format
• Damages for harm caused by inaccurate, false or unlawfully obtained data
• File a complaint with the National Privacy Commission

To exercise any of these rights, email our Data Protection Officer at contact@collectstory.com. We may need to confirm your identity first, and we will respond within the time required by law.

8. Cookies and Browser Storage

• Sign-in cookie: keeps you logged in to your dashboard. The app does not work without it.
• reCAPTCHA: Google sets cookies on the sign-up and sign-in pages to tell people from bots.
• Review pages: your browser remembers that you already rated a business, so you see your thank-you page and voucher instead of the form again. On demo pages, test feedback is kept only in your browser tab and is cleared when you close it.
• Demo page activity: a random ID is kept in your browser tab so the steps of one visit are counted together. It is cleared when you close the tab.

We do not use advertising or tracking cookies. You can clear cookies and site data in your browser settings.

9. Data Retention

• Your account: kept while your account is open. If you ask us to delete it, we delete your account and its feedback within 30 days.
• Payment records: kept for as long as tax and accounting laws require.
• Demo pages: deleted 30 days after they expire. Demo requests are kept so we can follow up, until you ask us to delete them.
• Demo page activity: contains no personal details, and is kept so we can see how demo pages are used over time.
• Backups: deleted data may remain in backups for a short period until they are overwritten.

10. Children

CollectStory accounts are for businesses and people aged 18 or over. The Service is not directed to children, and we do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.

11. International Data Transfers

Some of our service providers store or process data outside the Philippines, mainly in the United States. When we transfer personal data abroad, we remain responsible for it and require the same level of protection the Data Privacy Act requires.

12. Changes to This Privacy Policy

We may update this Privacy Policy. We will post the new version here with a new "Last updated" date, and tell you by email or in the Service before material changes take effect.

13. Data Protection Officer and Contact

For questions, requests or complaints about your personal data, contact our Data Protection Officer:

Data Protection Officer: contact@collectstory.com
Company: VirtualCup Solutions
Address: Mabini 3rd Street, Digos City, Davao del Sur, Philippines
Website: app.collectstory.com

If you are not satisfied with our response, you may file a complaint with the National Privacy Commission.