Privacy Statement

1. Who is responsible

The platform operator’s legal name, address and privacy contact are still being finalized. Participating businesses also have responsibilities for the customer information they use to deliver their services. Each business is responsible for its use of customer information and any applicable processing agreements.

2. Information we handle

Owner registration uses an email address and password through Supabase Authentication, together with account and session information. Private business setup stores information you submit, such as business and branch names, contact details, addresses, map links, opening hours, rates, booking settings, resource descriptions, logos and photos. Uploaded images are processed for display; access is restricted to authorized users in the current private setup.

The sample directory, reservations and financial figures are fictional. Live customer receipt collection is not enabled. Owners may optionally submit relevant business registration, branch permits and professional evidence privately for GCash, Maya or QR Ph receiving-account review. Documents are restricted to the submitting business’s authorized owner access and authorized platform verification, and are not included in public business pages. GCash, Maya or QR Ph receiving details and QR files are also restricted in the current private workspace. Choosing payment at the venue does not require submitting documents here.

Your business information and optional documents

Private business setup and verification documents are protected by authenticated access, business-specific database permissions and private file storage. Other businesses cannot access your private records. Saving a private draft does not publish it.

We request business documents only when you choose to display a GCash, Maya or QR Ph receiving number or payment QR so customers can pay your business directly. If customers pay at the venue, you can skip document submission. Using a promotional QR that opens your business website does not require receiving-account verification.

Submitted registration, branch permits and applicable professional credentials are used to review the operator, the relevant establishment and authority over the receiving account. Access is restricted to the business’s authorized owner account and authorized platform verification reviewers. Support access alone does not grant access to these documents. They are not displayed on public business pages.

GCash, Maya or QR Ph receiving details and QR upload remain disabled until approval; your regular business contact number remains available. Payment goes directly to the business, and the platform does not collect, hold or transfer customer booking funds. These choices do not remove a business’s legal responsibility to hold the permits and licences required to operate.

3. Why information is used

Current uses include creating and securing owner accounts, confirming sign-in, saving private business setup, controlling access and recording relevant changes. Information must only be used for an applicable lawful purpose. Reading this notice is not blanket consent to unrelated processing or marketing.

4. Access, providers and public visibility

Supabase currently supports authentication, database records and private file storage for the service. Authorized account access is limited to the business and branches the person is authorized to access. The website uses OpenAI Sites hosting. Public pages can be browsed without signing in; private business records require authorized account access. No owner’s private draft becomes a public listing just because it was saved.

Hosting, email delivery and storage providers process information needed to deliver the service. Publishing a business page makes its selected listing fields public. Private receipts, permits and customer lists must not be included in public listings.

Booking and support records

Booking requests include contact details, the selected service and time, a private access code and change requests. The booking service also uses a private visitor cookie and hashed request identifiers to limit automated requests. These controls are separate from advertising. Keep your access code private. Staff scheduling notes and actions include the responsible account and time. Support conversations are restricted to the business and authorized support staff. Do not submit medical records or confidential case facts.

Fictional sample bookings are kept in browser-tab session storage for up to 24 hours or until removed. Receipt files in those examples are not uploaded. Real booking records and staff activity are separate and retained separately from these browser-only samples.

5. Cookies, maps and external links

Authentication uses cookies to maintain your session. The website has no configured advertising or marketing analytics. Embedded Google Maps loads when you choose to show a configured map; loading it or following an external link can share connection information with that provider under its own privacy terms.

Branch maps

Embedded branch maps load only when you choose to show them. Loading a map or opening a Google Maps link connects to Google, which handles connection information under its own privacy policy. This website does not request your device’s current location to display a branch map. The business supplies its address, map pin and arrival instructions; fictional examples use clearly labelled area maps, not real venue pins.

6. Retention and security

Retention periods, deletion schedules, backup retention and account-closure procedures have not yet been finalized. Removing an image from the active gallery does not necessarily erase its stored file or history. Contact support@bookmonayan.com about retention or account deletion; this page does not specify a fixed retention period.

Current safeguards include authenticated private access, database permission controls and private media storage. No system can promise absolute security.

7. Your rights and privacy requests

Under applicable Philippine privacy law, rights may include being informed, access, correction, objection, erasure or blocking, data portability and filing a complaint, subject to the relevant conditions. Send privacy requests to support@bookmonayan.com. We may need to verify your identity before disclosing or changing private account information.

For information about these rights and complaint procedures, visit the National Privacy Commission.

8. Sensitive information and changes

Do not upload clinical records, diagnoses, confidential legal case information or unrelated identity documents to booking or support forms. Healthcare and other sensitive workflows require a separate privacy and security assessment before live use. When the service’s data handling changes, the notice must be updated and any required separate choice or consent obtained.

Account deletion and exports

Signed-in users can request account deletion, track or withdraw the request, and download their account information. Requests are reviewed by the authorized support account. Only the requester and authorized deletion reviewer can see a request. Business ownership, existing reservations and retention obligations must be resolved before any permanent removal. A request does not erase payment or audit history automatically.