Legal

Privacy Policy

Policy

This policy explains what personal information KuyaYos collects when you use our service, why we collect it, where it is stored, and the rights you have over your data. Plain English. We keep it short on purpose.

Effective date: 23 May 2026. Last updated: 18 October 2026.

---

Who we are

KuyaYos (referred to in this policy as "we", "us", and "our") is a booking service that connects customers in Metro Manila with vetted independent tradespeople: plumbers, electricians, aircon technicians, carpenters, and other skilled trades. The data controller is the KuyaYos team, contactable at [email protected].

What we collect, and why

We only collect what we need to match you with a tradesperson, confirm the booking, and improve the service. We don't collect extra "just in case" data.

When you book a tradesperson (/book/)

• Full name. So the assigned tradesperson knows who they are meeting.
• Mobile number. Our main contact channel for booking confirmation and payment instructions.
• Facebook username (optional). Backup contact channel if we cannot reach you on the number above.
• Barangay. To match a tradesperson based near your location.
• Service type, problem description, photos. So the tradesperson can quote accurately before they arrive.
• Preferred date and time slot. For scheduling.
• Referral source. To understand how customers find us.

When you apply to join the network (/apply/)

• Full name, mobile number, email (optional). To reach out to you about next steps.
• Trade, years of experience, certifications (optional). To assess your application.
• Service areas. To route customer bookings near you once you are approved.
• Referral source. Same as above.

Automatic collection

• IP address and request metadata. Collected by Cloudflare for rate limiting, bot protection, and basic security. Not used to profile individuals.
• Cloudflare Turnstile token. A short-lived anti-bot token verified at submission. Cloudflare's own privacy practices apply. See cloudflare.com/privacypolicy.
• Server logs. Standard request logs (timestamp, response code, and so on) used for debugging and abuse prevention.

Cookies and similar technologies

• Cloudflare security cookies. Cloudflare sets short-lived cookies (such as __cf_bm, cf_clearance) for bot protection, DDoS mitigation, and Turnstile verification. These are essential to keep abuse off the platform. See Cloudflare's cookie policy for full details.
• Ad click details. If you reach us from an ad, we keep the ad's click identifier and campaign tags in your browser's localStorage for up to 90 days, so a booking you make later can be credited to the ad. They are saved with your booking.
• Site usage records. Our pages send us first-party records of how the site is used: which page you opened and where you came from, how far you scrolled, which form step you reached, the name of the form field you last used, buttons and contact links you tapped, page errors, and when you left. We never record what you type into a field. These records carry a random visitor ID (kept in localStorage) and a random visit ID, plus the country Cloudflare reports for your connection, never your IP address. We use them only to find where our pages and forms lose people, and we delete them after 180 days. If you choose Decline on the banner, the visitor ID is not kept between visits.
• Your banner choice. One localStorage key (kuyayos:consent) remembers whether you chose Accept or Decline on pages with ad tags, and one (kuyayos.cookieConsent) remembers that you dismissed the notice on other pages.

You can clear these via your browser settings at any time. Doing so does not affect your ability to use the site.

Advertising tags

On our service pages, our advertising landing pages (such as /go/ and /landing/), and our booking, application, and callback forms, we use measurement tags from Google (Google Ads) and Meta (Facebook Pixel) to see which ads lead to real bookings.

• Google. Unless you choose Decline, Google Ads stores a first-party cookie (such as _gcl_aw) with the click identifier from your ad, so your booking can be matched to the ad you clicked. Google is not allowed to use it to personalise ads for you. Choosing Decline turns this off and removes those cookies.
• Meta. Meta's tag runs without cookies until you choose Accept. If you accept, Meta may set its advertising cookies on those pages and use them to match your visit to your ad click.
• When you submit a booking, application, or callback form, our server sends Google and Meta a record of that submission so they can count which ads lead to real bookings, applications, and enquiries. That record includes a securely hashed (one-way scrambled) version of your mobile number and, where you gave one, your email address. When you came from a Google ad and paid for your booking, we also send Google the click identifier saved with your booking and the time and amount of the payment. We never share your mobile number or email in plain text for advertising.
• You can change your choice at any time by clearing your cookies (the banner shows again), or by emailing [email protected].

For details on how these providers use data, see Google's advertising policies and Meta's cookie policy.

Where your data is stored

• Booking and application records are written to a Google Sheets workbook hosted in Google Workspace. Access is restricted to the KuyaYos coordinator team.
• Photos you attach to a booking are uploaded to a private Google Drive folder, also restricted to our team and the assigned tradesperson for that specific job.
• Work videos you attach to a tradesperson application are stored in a private Cloudflare R2 bucket, viewable only by our recruitment team, and deleted automatically 30 days after upload.
• Request handling runs on Cloudflare Pages (servers in regional edge locations). No personal data is stored long-term on Cloudflare's edge.

International data transfers

Some of the platforms we rely on (Google Workspace for Sheets and Drive, Cloudflare for hosting and security) operate data centres outside the Philippines. By using KuyaYos, you understand that your personal data may be processed in the United States, the European Union, or other jurisdictions where these providers operate.

Both Google and Cloudflare commit to safeguarding international transfers under the EU Standard Contractual Clauses (SCCs) and equivalent frameworks. We rely on these commitments and do not transfer your data to any additional third parties outside our processors.

Legal basis for processing

We process your personal data under the following bases recognised by the Philippines' Data Privacy Act of 2012 (RA 10173):

• Contract performance. When you submit a booking or application, we process the data needed to deliver the booked service or evaluate your application.
• Consent. You explicitly consent to processing when you tick the consent box on our forms.
• Legitimate interest. Limited processing for security, fraud prevention, and abuse handling (e.g., Cloudflare's bot protection) is based on our legitimate interest in keeping the platform safe.
• Legal obligation. Where required by Philippine law or a valid court order.

Who we share it with

• The assigned tradesperson receives the booking details they need to do the job: your name, barangay, contact, problem description, and photos. Nothing more.
• Service processors. Google (storage) and Cloudflare (hosting, security) act on our instructions. They do not use your data for their own purposes.
• We do not sell, rent, or trade your personal information. Ever.
• Legal compliance. We will disclose information if required by Philippine law, a valid court order, or to protect the safety of customers, tradespeople, or the public.

How long we keep it

• Active bookings: retained for the duration of the job and for customer support afterwards.
• Completed bookings: retained for up to two years for tax records, dispute resolution and service-quality review.
• Tradesperson applications that aren't shortlisted: deleted within six months.
• Approved tradesperson records: retained while you remain in the network, plus two years after exit.
• Work videos from tradesperson applications: deleted automatically 30 days after upload.
• Server logs: retained up to 30 days for security and debugging.

Your rights under the Data Privacy Act

Under the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173), you have the right to:

• Be informed about how your data is processed. This policy.
• Access the personal information we hold about you.
• Correct inaccurate or outdated data.
• Block, erase or have your data removed, subject to legal retention obligations.
• Withdraw consent for processing at any time.
• Object to processing where appropriate.
• Lodge a complaint with the National Privacy Commission (NPC) at privacy.gov.ph.

To exercise any of these rights, email [email protected] with your booking reference number (KYS-XXXX) or application reference (KYA-XXXX). We aim to respond within five business days.

Marketing communications

From time to time we send marketing and promotional emails. Examples include product updates, new trades we cover, new service areas, customer stories, and seasonal offers. These are separate from operational messages (booking confirmations, status updates, payment instructions, and direct replies to your enquiries), which we send regardless of your marketing preferences because they are required for the service to function.

Marketing emails are only sent to people who have explicitly opted in. We do not opt you in by default. We do not buy or rent email lists. When you submit a booking or application, you are not automatically added to a marketing list.

You can opt in by:

• Ticking the optional marketing checkbox on the booking or application form (when offered).
• Emailing [email protected] with the subject "Subscribe".
• Signing up via any newsletter form we publish on the site or our social channels.

You can opt out at any time by:

• Clicking the "unsubscribe" link included in every marketing email we send.
• Emailing [email protected] with the subject "Unsubscribe".
• Replying to any marketing email and asking to be removed.

We process opt-out requests within five business days. Once you opt out, you will not receive further marketing messages from us. Operational messages tied to active bookings will continue.

Updating your information

You can ask us to update or correct any personal data we hold about you. Email [email protected] or message us on Messenger with your booking or application reference number and the change you need. We aim to process correction requests within five business days.

Security

We use HTTPS with TLS encryption for all traffic. Booking submissions are protected by Cloudflare Turnstile (anti-bot), per-IP and global rate limiting, and a server-side proxy secret that authorises our backend writes. Access to the Google Sheets workbook and Drive folder is restricted to authorised team members. No system is perfect. We take reasonable steps but cannot guarantee absolute security.

Data breach notification

If a personal data breach occurs that creates a real risk to your rights and freedoms, we will:

• Notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, as required by Philippine law.
• Notify affected users directly via Messenger, email, or both, with a plain-English description of what happened, what data was affected, what we are doing about it, and what you can do to protect yourself.
• Publish a summary statement on this site once immediate response activities are complete.

Children

KuyaYos is intended for users aged 18 and over. We do not knowingly collect personal information from minors. If you're a parent or guardian and believe a minor has submitted information, contact us and we'll delete it.

Changes to this policy

If we change how we handle data, we'll update this page and revise the "Last updated" date at the top. Material changes will be flagged on the homepage for at least 14 days.

Contact

Questions about this policy, requests to access or delete your data, or any other privacy concern: email [email protected]. For security-related issues specifically, see /.well-known/security.txt.