Privacy notice

Who is responsible for your data

DIP is run by the DIP development team, which decides how personal data on DIP is used and is responsible for it.

For any privacy question or request, email dip2rest@gmail.com.

What we collect

• Your account: first and last name, email address, mobile number (optional) and password. Passwords are stored only as a one-way hash by our sign-in provider; we never see them.
• If you list a property: business name, type, contact details and location, plus the verification documents you upload (business permit, DTI or SEC registration, BIR Form 2303, DOT accreditation).
• Security records: when you sign in, changes to your account's role, and the approval status of businesses. Network addresses used to stop repeated sign-in attempts are stored only as a one-way hash and deleted within a day.
• Cookies: only the ones needed to keep you signed in and remember your language. DIP uses no advertising or tracking cookies.

Why we use it

• To create and secure your account and let you sign in.
• To check that resorts and hotels listed on DIP are real, registered businesses before they can take bookings.
• To protect accounts from abuse, such as password guessing.
• To keep records required by law.

Who we share it with

We do not sell your personal data. We use Supabase to store our database, run sign-in and keep uploaded files. These servers are in Singapore, so your data is stored outside the Philippines; Supabase processes it only to provide these services to us.

Partner verification documents are seen only by the partner who uploaded them and by DIP administrators.

How long we keep it

• Account details: for as long as your account is open.
• Verification documents: for as long as the partner account is open.
• After you ask us to delete your account, we delete your account details within 30 days. Security records of past changes are kept, but no longer linked to you.

Your rights

Under the Data Privacy Act you have the right to:

• be informed about how your data is used (this notice);
• access the personal data we hold about you;
• correct it (you can edit your name and mobile number on your account page);
• object to processing, and have your data erased or blocked;
• get a copy of your data in a format you can reuse;
• be compensated for damages caused by misuse of your data;
• file a complaint with the National Privacy Commission at privacy.gov.ph.

To use any of these rights, email dip2rest@gmail.com.

Deleting your account

Customers can ask for deletion from their account page. Partners should email dip2rest@gmail.com, because their business listing and documents need to be handled first. An administrator completes the request within 30 days, and you can cancel it until then.

How we protect it

• All connections to DIP are encrypted (HTTPS), and stored data is encrypted by our provider.
• Every request is checked against your account's permissions in the database itself.
• Administrators must sign in with a second step (an authenticator app), and every change to who can do what is recorded.

Changes to this notice

If we change how we use your data, we will update this notice and its date. For important changes we will ask for your consent again.