Privacy Policy

This Privacy Policy explains how AdCartKo (“AdCartKo”, “we”, “us”) collects, uses, shares, and protects personal data when you use the AdCartKo mobile app and related web services (together, the “Service”). It is prepared in line with the Philippine Data Privacy Act of 2012 (RA 10173) and applicable National Privacy Commission guidance, and it also serves as our disclosure for the Apple App Store and Google Play.

1. Who we are

AdCartKo operates an invite-only, hyper-local marketplace that lets residential communities, condos, campuses, and offices run their own private storefronts. For privacy questions or requests, contact us at james@defyne.solutions.

Within each community, the person who runs the community you joined may act as a joint data controller for the membership and moderation data of that community.

2. Data we collect

Information you provide

• Account: email address and display name.
• Profile: any optional details you add to your profile.
• Community: the communities you join or create and, if you run one, the invite codes and member list you manage.
• Shop Owner content: your shop details, product listings, prices, add-ons, and product images.
• Orders: the orders you place or receive, their items, amounts, status, and delivery notes.
• Messages and media: order-chat messages and any images you attach, including payment receipts you upload.
• Ratings: the star ratings and reviews you submit after a completed order.
• Support: the contents of emails or reports you send us.

Information collected automatically

• Location: with your permission, approximate or precise device location — to place your shop on the community map, show you shops near you, and (only during an active order) share live delivery location with the other party. You can revoke this in your device settings at any time.
• Push token: a device push identifier issued via Expo/Apple/Google so we can send order notifications, if you enable notifications.
• Device & usage data: app version, device model and OS, language, and basic diagnostic/error information needed to keep the app working.
• Photo library access: when you choose to upload an image, the app reads only the photos you select. We do not scan your photo library.

3. Payments

AdCartKo does not process card or e-wallet payments for orders. Customers pay shop owners directly by GCash, Maya, bank transfer, or cash. We do not collect or store your financial account credentials or card numbers. If you upload a payment receipt image, it is stored as order content so the shop owner can confirm payment. Any subscription or setup fees for shop owners/communities are handled by a third-party payment processor under its own privacy policy; we receive only a confirmation of payment status.

4. How we use data

• Create and secure your account and authenticate you.
• Show you the correct community and the shops, products, and orders you are entitled to see.
• Route orders between customers and shop owners and power the order-status timeline and real-time chat.
• Compute verified shop ratings (only customers with a completed order can rate).
• Send transactional notifications about your orders and account.
• Provide customer support and handle disputes and reports.
• Detect, prevent, and address fraud, abuse, security issues, and violations of our terms.
• Comply with legal, tax, and regulatory obligations.

5. Legal bases

We process personal data to perform our contract with you (operating the Service), on the basis of your consent (for example, location and notifications, which you can withdraw at any time), for our legitimate interests in keeping the Service safe and functional, and to comply with legal obligations.

6. How data is shared

• Other users: your display name, shop details, listings, ratings, and the order and chat content of a given transaction are visible to the other party of that transaction and, where relevant, to members of the same community.
• Community organisers: can see the membership and moderation information for the community they run.
• Service providers (processors): Supabase (database, authentication, file storage, and realtime, hosted on cloud infrastructure), and Expo together with Apple Push Notification service and Firebase Cloud Messaging (to deliver push notifications). These providers process data only on our instructions.
• Legal: we may disclose data if required by law, regulation, legal process, or enforceable government request, or to protect the rights, safety, and property of AdCartKo, our users, or the public.
• Business transfers: if AdCartKo is involved in a merger, acquisition, or asset sale, data may be transferred, subject to this policy.

We do not sell your personal data, and we do not share it for cross-context behavioral advertising.

7. International transfers

Our providers may process and store data on servers located outside your country. Where that happens, we rely on appropriate safeguards (such as the providers' contractual data-protection commitments) consistent with the Data Privacy Act.

8. Data retention

We keep account and transaction records while your account is active and for as long as needed for legitimate business, tax, accounting, and dispute-resolution purposes. After that, records are deleted or anonymised. Order-chat messages and images are retained for the life of the related order history unless you delete your account.

9. Deleting your account and data

You can delete your account at any time from the app: open the Profile tab, go to Settings, and choose Delete account. This permanently removes your profile, your shops and listings, and your order history associated with your account, except records we are required to retain by law (for example, tax records) or that must remain in anonymised form to preserve the integrity of another user's transaction history.

If you cannot access the app, email james@defyne.solutions from your registered address and we will process the deletion within 30 days.

10. Your rights

Subject to applicable law, you may access, correct, update, port, restrict, or object to the processing of your personal data, withdraw consent, and request erasure. Philippine users may also lodge a complaint with the National Privacy Commission. To exercise any right, contact james@defyne.solutions; we may need to verify your identity before acting.

11. Security

Data is stored on Supabase with row-level security so each user can only read the records they are entitled to. Connections are encrypted in transit (HTTPS/TLS). Passwords are handled by our authentication provider and are not stored in plain text. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authority of a breach where required.

12. Children

The Service is not directed to children under 13 (or the minimum age of digital consent in your jurisdiction), and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app. Continued use of the Service after an update means you accept the revised policy.

14. Contact us

Questions, requests, or complaints about this policy or your personal data:
james@defyne.solutions