Privacy Policy
LOCATR is a verified rental matchmaking platform for the Philippines, operated by HNS Corp PH ("LOCATR", "we", "us", "our"). This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have under the Philippine Data Privacy Act of 2012 (RA 10173).
1. What we collect
1.1 Identity & verification data
- Full legal name, date of birth, sex (as printed on your government ID)
- Photograph and ID number from government-issued ID (PhilSys, UMID, Driver's License, Passport, Postal ID)
- Live selfie image (matched against your ID, then discarded after liveness confirmation)
- For landlords: Property title or tax declaration document showing ownership
1.2 Contact data
- Mobile phone number (verified via SMS OTP)
- Email address (optional)
1.3 Location data
- Approximate device location (to filter listings within your search area)
- Precise GPS coordinates only when a landlord publishes a listing (to enforce the anti-scam "must be at the property" check). We do not track location in the background.
1.4 Camera & media
- Photos you upload of your property, ID, or maintenance issues
- Camera access for live selfie capture during ID verification
1.5 Usage & device data
- Swipe/match interactions, search history, chat messages, contract signatures (PIN acknowledgements)
- Device model, OS version, app version, language
- Anonymized analytics on screen views and feature usage
1.6 Financial data (when applicable)
- Payment confirmations from Xendit (we never see your card number or e-wallet balance — only success/failure status and transaction ID)
- Reservation escrow status and disbursement records
- Rent collection logs when you opt into Auto-Collect Premium
2. How we use your data
- Identity verification — match your ID against a live selfie to prevent fake accounts and scams
- Property verification — OCR-cross-check the name on your Government ID with the name on the Property Title (landlords only)
- Matchmaking — show you (or your property) to relevant counterparties
- Communications — deliver chat messages once a match exists; never to unmatched users
- Trust & safety — flag suspicious patterns, enforce GPS fencing, calculate your LOCATR Score
- Payments — collect activation fees, hold reservation escrow, facilitate rent transactions via Xendit
- Legal compliance — meet obligations under the DPA 2012, Civil Code on Lease (Arts. 1642–1688), Rent Control Act (RA 9653), AMLA (RA 9160), and Cybercrime Prevention Act (RA 10175)
- Service improvement — debug crashes, improve UX based on aggregate, anonymized usage
We do not sell your personal information, share it for advertising, or use it for purposes outside what is described here.
3. Legal basis for processing
Under the DPA 2012, we process your data based on:
- Consent — you explicitly agree at signup before any verification step
- Contract performance — necessary to provide the matching, payment, and contract services you signed up for
- Legitimate interest — fraud prevention and platform integrity
- Legal obligation — anti-money-laundering, tax reporting, and judicial cooperation when subpoenaed
4. Third parties we share data with
We share strictly limited data with these vetted providers, each bound by Data Processing Agreements:
| Provider | What we share | Why |
|---|---|---|
| Firebase (Google Cloud) | All app data — encrypted at rest in asia-southeast1 region (Singapore) | Database, authentication, storage, push notifications |
| Xendit Philippines, Inc. | Payment amount, currency, your name and phone for KYC | Process payments, hold reservation escrow, disburse to landlords |
| Google Cloud Vision | ID image (temporarily, for OCR only) | Extract name from ID and Property Title for cross-checking |
| Project NOAH (DOST) | Listing coordinates only | Retrieve flood-risk classification for the area |
| Google Maps Platform | Approximate device location | Geocoding, map display, commute time calculation |
| Expo Application Services | Crash reports, anonymized usage logs | App stability and over-the-air updates |
We also disclose data when required by Philippine law — for example, in response to a valid subpoena from the NBI Cybercrime Division, court order, or AMLC Suspicious Transaction Report.
5. How long we keep your data
| Data type | Retention period |
|---|---|
| Government ID image | Deleted within 48 hours of successful verification. Only the "Verified" badge flag persists. |
| Live selfie image | Deleted immediately after liveness + face-match confirmation |
| Property Title image | Deleted within 48 hours of OCR cross-check completion |
| Profile data (name, phone, email) | While your account is active, plus 30 days after deletion request |
| Lease contracts | Retained for 10 years per Civil Code requirements for evidentiary purposes |
| Chat messages | Retained while the match is active, plus 6 months for dispute resolution |
| Payment records | Retained for 5 years per BIR and AMLC requirements |
| Anonymized analytics | Retained indefinitely (no longer linked to you) |
6. Security
- Encryption in transit — TLS 1.3 for all network traffic between your device and our servers
- Encryption at rest — AES-256 for sensitive documents (government IDs, property titles) before they touch Firebase Storage
- Access controls — Firestore Security Rules enforce that you can only ever read your own private data; landlords never see renter IDs and vice versa
- Auto-deletion — scheduled Cloud Functions wipe ID documents on the 48-hour schedule above
- Audit logs — administrative access is logged and reviewed
- Bug bounty — coming Q3 2026; report security issues to security@locatr.hnscorpph.com
No system is perfectly secure. If we ever experience a personal data breach that may pose a real risk of serious harm, we will notify you and the National Privacy Commission within 72 hours, as required by the DPA 2012.
7. Your rights under the Data Privacy Act of 2012
You have the right to:
- Be informed — this Privacy Policy itself
- Access — request a copy of the personal data we hold about you
- Object — withhold consent to certain processing (note: this may prevent us from providing the service)
- Correct — fix any inaccurate data on your profile
- Erasure / Blocking — request deletion of your account and all associated personal data
- Data portability — request an export of your data in machine-readable format
- Damages — claim indemnity if your data is unlawfully processed
- File a complaint with the National Privacy Commission at privacy.gov.ph
To exercise any of these rights, email privacy@locatr.hnscorpph.com. We respond within 15 business days.
8. Children
LOCATR is for users 18 years and older. Rental contracts require legal capacity under the Philippine Civil Code. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, contact us and we will delete the account.
9. Changes to this policy
We may update this Privacy Policy as the product evolves or as laws change. When we make material changes we will:
- Update the effective date at the top of this page
- Notify all active users via in-app banner and email
- For significant changes, require fresh consent before continuing to use LOCATR
10. Contact us
For privacy questions, complaints, or to exercise your DPA rights:
- Email: privacy@locatr.hnscorpph.com
- Data Protection Officer: HNS Corp PH (registration with the National Privacy Commission pending)
- Mailing address: HNS Corp PH, Philippines (full address provided upon registration)
You may also contact the National Privacy Commission directly:
- Website: privacy.gov.ph
- Email: info@privacy.gov.ph