Bukid respects your privacy. This Privacy Policy describes what personal data we collect, why we collect it, and how you can exercise your rights under the Data Privacy Act of 2012 (Republic Act No. 10173).

1. Personal information controller

Bukid operates as the Personal Information Controller under RA 10173. Registration with the National Privacy Commission (NPC) is tracked on our Launch Checklist. Our Data Protection Officer (DPO) can be reached at dpo@bukid.ph (placeholder).

2. Data we collect

• Email and password: required for account creation and authentication (Supabase Auth).
• Phone number: required to verify ownership via SMS OTP (Semaphore). Stored as an E.164 string.
• Government ID photo + selfie: for sellers only, used to verify seller identity (Cloudflare Images). EXIF/GPS is stripped before storage.
• City code: the PSGC code of your chosen city. Used for distance filtering on listings you browse and for listings you publish.
• Listings, messages, orders, reviews: content you create in the course of using the marketplace.
• Technical data: IP address, browser user agent, session cookies.

3. How we use your data

We use the data we collect to operate the marketplace, verify seller identity, help buyers find nearby listings, route messages and notifications, and detect abuse. We do not sell your personal information and we do not run advertising networks on Bukid.

4. Cookies

Bukid uses a single first-party session cookie managed by Supabase Auth to keep you logged in. We do not use third-party advertising cookies. When you first visit the site, a banner informs you of this cookie use.

5. Retention and deletion

You may request account deletion at any time. Deletion is a soft delete with a 30-day grace period: your account is immediately hidden from public view and you are signed out, but your data is retained for 30 days in case you change your mind. After 30 days, the data is hard-deleted by a scheduled operations task.

6. Your rights (RA 10173)

As a data subject you have the right to:

• Be informed about what we collect and why (this document).
• Access the data we hold about you.
• Export your data: /account/data. One JSON export per day.
• Correct inaccurate data (contact us at privacy@bukid.ph).
• Request deletion: /account/danger.
• Object to processing, subject to our legitimate interests.
• Lodge a complaint with the NPC at https://privacy.gov.ph.

7. Data sharing

Bukid shares personal data only with the service providers strictly required to operate the marketplace: Supabase (database and authentication), Cloudflare Images (image hosting), Semaphore (SMS OTP), Resend (transactional email), and PayMongo (subscription billing for sellers). Each provider operates under its own privacy terms.

8. International transfers

Some providers (Supabase, Cloudflare, Resend) process data in regions outside the Philippines. We rely on standard contractual clauses and provider certifications to maintain an equivalent level of protection.

9. Children

Bukid is not directed to persons under 18 and we do not knowingly collect their data.

10. Contact

Data Protection Officer: dpo@bukid.ph (placeholder). National Privacy Commission: https://privacy.gov.ph.