Legal
Privacy Policy
Effective date: 26 July 2026 · Last updated: 26 July 2026
1. Introduction
This Privacy Policy explains how PapaFix ("PapaFix", "we", "us") collects, uses, stores, and protects your personal information when you use the PapaFix customer application or the PapaFix Technician application (together, the "Apps"), or this website.
PapaFix is a home services platform operating in the Philippines that connects customers with technicians for repair, cleaning, and maintenance work — starting with air conditioning services at launch, with other trades such as electrical and plumbing to follow. By using the Apps you agree to the practices described in this policy. If you do not agree, please do not use the Apps.
2. Who this policy covers
- Customers — individuals who book repair, cleaning, or maintenance services.
- Technicians — service providers who register on the platform to accept and perform jobs.
- Website visitors — anyone browsing this site or joining the launch waitlist.
Where a practice applies to only one group, this is stated explicitly.
3. Information we collect
3.1 Information you provide
All app users:
- Full name
- Email address
- Mobile phone number
- Password — stored only as a salted cryptographic hash. We never see or store your plain-text password.
- Profile photo (optional)
Customers:
- Service addresses, including street address, barangay, city, and province
- Geographic coordinates of your service addresses
- Details of the service requested — appliance type, unit details, and issue description
- Photographs you choose to upload describing a problem
Technicians:
- Registered service base address and its coordinates
- Service categories and specialisations
- Availability schedule
- Photographs of work performed, taken during inspection and after completion of a job
- Photographs of payment proof for cash transactions
3.2 Information collected automatically
Location data. This is the most sensitive category we handle, and the two Apps treat it differently:
- PapaFix (customer app) collects your device location only while the app is open and in use, to help you set a service address and to display the location of an assigned technician. The customer app does not collect location in the background.
- PapaFix Technician collects precise device location in the background — including when the app is closed or not in active use — but only while you have an active, accepted job in progress. This shares your live position with the customer waiting for you, and calculates travel distance for fee purposes. Background collection stops when the job is completed or cancelled.
Before background location access is requested, the Technician App displays a disclosure explaining what is collected and why, and requires your explicit consent. You may decline. If you decline, the App continues to function using foreground-only location, though live tracking will not be available to your customer.
Device and usage information:
- Device push notification token, used to deliver job and booking notifications
- Basic app interaction and diagnostic data, used to detect errors and improve reliability
3.3 From this website
- Email address — only if you submit it to the launch waitlist. Nothing else on this site asks for personal information.
- Standard server logs — our hosting provider records requests (IP address, browser type, page requested, timestamp) as part of normal operation and security.
This site does not use advertising cookies, analytics cookies, or third-party tracking pixels. Waitlist submissions are delivered to our team inbox through the form-relay service Web3Forms, which processes your email address solely to pass it on to us.
3.4 Information we do not collect
- We do not collect or store your payment card details, bank credentials, or e-wallet login information. Payments are made directly by you through your own banking or e-wallet application, or in cash to the technician.
- We do not access your contacts, calendar, SMS messages, or call logs.
- We do not record audio or video.
4. How we use your information
| Purpose | Data used |
|---|---|
| Creating and securing your account | Name, email, phone, password hash |
| Verifying your email address | Email address |
| Matching customers with available technicians | Location, service category, availability |
| Calculating travel fees | Service address and technician base location coordinates |
| Showing live technician location during an active job | Technician precise location (foreground and background) |
| Documenting job condition and completed work | Job photographs |
| Confirming manual payments | Payment proof photographs, booking amount |
| Sending booking, job status, and payment notifications | Push token, email address |
| Customer support and dispute resolution | Booking records, photographs, contact details |
| Fraud prevention and platform safety | Account and booking records |
| Meeting tax, accounting, and legal obligations | Booking and payment records |
| Telling you when PapaFix launches in your city | Waitlist email address |
We do not use your personal information for advertising, and we do not sell your personal information.
5. Legal basis and consent
We process your information on the basis of:
- Your consent, which you give when creating an account and, separately, when granting location permissions;
- Performance of a contract, where processing is necessary to deliver the service you requested;
- Legal obligation, where retention is required by Philippine tax and business records law;
- Legitimate interest, in preventing fraud and maintaining platform safety.
6. Sharing your information
6.1 Between users of the platform
- A technician assigned to your booking receives your name, contact number, service address, and issue details so they can perform the service.
- A customer with an active booking receives the assigned technician's name, profile photo, contact number, and live location while the job is in progress.
Information is shared only between the parties to a specific booking. Other users cannot see your details.
6.2 Service providers
We use the following third-party providers to operate the platform. Each processes data only as necessary to provide its service:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, file storage, backend functions | All account, booking, location, and photo data |
| Google Maps Platform | Address lookup, mapping, distance and travel time calculation | Address text and coordinates |
| Firebase Cloud Messaging (Google) | Delivery of push notifications | Device push token, notification content |
| Resend | Delivery of account verification and transactional email | Email address |
| Expo / Google Play | App distribution and build infrastructure | Diagnostic data |
| Web3Forms | Relaying website waitlist submissions to our inbox | Email address |
6.3 Legal disclosure
We may disclose information where required by law, court order, or a lawful request from a government authority, or where necessary to protect the rights, safety, or property of our users, our technicians, or the public.
6.4 Business transfer
If the business is sold, merged, or reorganised, user information may transfer as part of that transaction. You will be notified of any such change and of any resulting change to this policy.
7. Data storage and security
Your information is stored on servers operated by Supabase. We apply the following protections:
- All data transmitted between the Apps and our servers is encrypted in transit using HTTPS/TLS.
- Passwords are stored only as salted cryptographic hashes.
- Database access is restricted by row-level security policies, so users can access only their own records and the records of bookings they are party to.
- Photographs are held in private storage; access requires authentication and is limited to the uploading technician and the customer of the associated booking.
- Payment QR code images and pricing settings are writable only by administrators.
No method of transmission or storage is completely secure. While we take these measures seriously, we cannot guarantee absolute security. If a breach ever affects your personal information, we will notify you and the National Privacy Commission as the law requires.
8. Data retention
We retain your information for as long as your account remains active. After account deletion:
- Personal identifiers — name, email, phone number, profile photo, saved addresses, location history, and device tokens — are deleted.
- Booking and payment records are retained for ten (10) years, the period Philippine tax regulations require for the preservation of books of accounts and their supporting records. Personal identifiers are removed from these records where the law permits.
- Job photographs and payment proof images are retained for ten (10) years as supporting records for accounting and dispute resolution, then deleted.
Waitlist emails are kept until launch, or until you ask us to remove yours — whichever comes first.
9. Your rights
Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), you have the right to:
- Be informed about how your data is collected and processed;
- Access the personal information we hold about you;
- Object to processing, including withdrawing consent;
- Correct inaccurate or incomplete information;
- Erasure or blocking of your information, subject to our legal retention obligations;
- Damages for violations of your rights under the Act;
- Data portability, to obtain a copy of your data in a usable format;
- File a complaint with the National Privacy Commission.
To exercise any of these rights, contact us at support@papafixph.com. We will respond within 30 days.
You may also manage certain rights directly:
- Location permissions can be revoked at any time in your device settings.
- Push notifications can be disabled in your device settings.
- Account deletion can be requested as described in Section 11.
10. Children's privacy
The Apps are intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected information from a person under 18, we will delete it. If you believe a minor has provided us information, contact us at support@papafixph.com.
11. Account deletion
You may request deletion of your account and associated personal data at any time. Full instructions, including what is deleted and what is retained, are on our account deletion page.
12. Changes to this policy
We may update this policy from time to time. Material changes will be notified through the Apps or by email to the address associated with your account. The "last updated" date at the top indicates when it was last revised. Continued use of the Apps after a change takes effect constitutes acceptance of the revised policy.
13. Contact us
For questions about this policy, or to exercise your rights under the Data Privacy Act:
PapaFix
support@papafixph.com
Tanauan, Batangas, Philippines
- Legal business name and registered address must replace "PapaFix" and "Tanauan, Batangas" in sections 1 and 13, and must match the Play Console developer account name.
support@papafixph.comdoes not exist yet. Create the mailbox and send it a test email before this URL goes into the Play Console — an unanswered deletion or access request is itself a violation.- Ten years is a deliberate choice, not a verified one. It is the ceiling under the BIR's preservation rules, so you cannot under-retain, but it is longer than some record types need and the Act expects you to keep data no longer than necessary. Job photographs in particular are worth revisiting — they are customers' homes. Confirm with the accountant and shorten where you can. Whatever you choose must match the deletion page.