Legal

Privacy Policy

Policy

This policy explains what personal information KuyaYos collects when you use our service, why we collect it, where it is stored, and the rights you have over your data. Plain English. We keep it short on purpose.

Effective date: 23 May 2026. Last updated: 24 May 2026.

---

Who we are

KuyaYos (referred to in this policy as "we", "us", and "our") is a booking service that connects customers in Metro Manila with vetted independent tradespeople: plumbers, electricians, aircon technicians, carpenters, and other skilled trades. The data controller is the KuyaYos team, contactable at [email protected].

What we collect, and why

We only collect what we need to match you with a tradesperson, confirm the booking, and improve the service. We don't collect extra "just in case" data.

When you book a tradesperson (/book/)

• Full name. So the assigned tradesperson knows who they are meeting.
• Mobile number. Our main contact channel for booking confirmation and payment instructions.
• Facebook username (optional). Backup contact channel if we cannot reach you on the number above.
• Barangay. To match a tradesperson based near your location.
• Service type, problem description, photos. So the tradesperson can quote accurately before they arrive.
• Preferred date and time slot. For scheduling.
• Referral source. To understand how customers find us.

When you apply to join the network (/apply/)

• Full name, mobile number, email (optional). To reach out to you about next steps.
• Trade, years of experience, certifications (optional). To assess your application.
• Service areas. To route customer bookings near you once you are approved.
• Referral source. Same as above.

Automatic collection

• IP address and request metadata. Collected by Cloudflare for rate limiting, bot protection, and basic security. Not used to profile individuals.
• Cloudflare Turnstile token. A short-lived anti-bot token verified at submission. Cloudflare's own privacy practices apply. See cloudflare.com/privacypolicy.
• Server logs. Standard request logs (timestamp, response code, and so on) used for debugging and abuse prevention.

Cookies and similar technologies

We use only what is strictly necessary to keep the site working safely. No marketing cookies, no advertising cookies, no third-party analytics, no behavioural tracking.

• Cloudflare security cookies. Cloudflare sets short-lived cookies (such as __cf_bm, cf_clearance) for bot protection, DDoS mitigation, and Turnstile verification. These are essential to keep abuse off the platform. See Cloudflare's cookie policy for full details.
• localStorage entry. We store one key (kuyayos.cookieConsent) so the cookie banner does not show on every page load after you click OK. The value is "1" or absent. No personal data.
• No first-party analytics. We do not run Google Analytics, Meta Pixel, Hotjar, or any similar tool.
• No advertising or remarketing. We do not run ads on this site, and we do not feed your data to any ad network.

You can clear these via your browser settings at any time. Doing so does not affect your ability to use the site. If you clear the localStorage entry, the cookie banner will simply show again on your next visit.

Where your data is stored

• Booking and application records are written to a Google Sheets workbook hosted in Google Workspace. Access is restricted to the KuyaYos coordinator team.
• Photos you attach to a booking are uploaded to a private Google Drive folder, also restricted to our team and the assigned tradesperson for that specific job.
• Request handling runs on Cloudflare Pages (servers in regional edge locations). No personal data is stored long-term on Cloudflare's edge.

International data transfers

Some of the platforms we rely on (Google Workspace for Sheets and Drive, Cloudflare for hosting and security) operate data centres outside the Philippines. By using KuyaYos, you understand that your personal data may be processed in the United States, the European Union, or other jurisdictions where these providers operate.

Both Google and Cloudflare commit to safeguarding international transfers under the EU Standard Contractual Clauses (SCCs) and equivalent frameworks. We rely on these commitments and do not transfer your data to any additional third parties outside our processors.

Legal basis for processing

We process your personal data under the following bases recognised by the Philippines' Data Privacy Act of 2012 (RA 10173):

• Contract performance. When you submit a booking or application, we process the data needed to deliver the booked service or evaluate your application.
• Consent. You explicitly consent to processing when you tick the consent box on our forms.
• Legitimate interest. Limited processing for security, fraud prevention, and abuse handling (e.g., Cloudflare's bot protection) is based on our legitimate interest in keeping the platform safe.
• Legal obligation. Where required by Philippine law or a valid court order.

Who we share it with

• The assigned tradesperson receives the booking details they need to do the job: your name, barangay, contact, problem description, and photos. Nothing more.
• Service processors. Google (storage) and Cloudflare (hosting, security) act on our instructions. They do not use your data for their own purposes.
• We do not sell, rent, or trade your personal information. Ever.
• Legal compliance. We will disclose information if required by Philippine law, a valid court order, or to protect the safety of customers, tradespeople, or the public.

How long we keep it

• Active bookings: retained for the duration of the job and for customer support afterwards.
• Completed bookings: retained for up to two years for tax records, dispute resolution and service-quality review.
• Tradesperson applications that aren't shortlisted: deleted within six months.
• Approved tradesperson records: retained while you remain in the network, plus two years after exit.
• Server logs: retained up to 30 days for security and debugging.

Your rights under the Data Privacy Act

Under the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173), you have the right to:

• Be informed about how your data is processed. This policy.
• Access the personal information we hold about you.
• Correct inaccurate or outdated data.
• Block, erase or have your data removed, subject to legal retention obligations.
• Withdraw consent for processing at any time.
• Object to processing where appropriate.
• Lodge a complaint with the National Privacy Commission (NPC) at privacy.gov.ph.

To exercise any of these rights, email [email protected] with your booking reference number (KYS-XXXX) or application reference (KYA-XXXX). We aim to respond within five business days.

Marketing communications

From time to time we send marketing and promotional emails. Examples include product updates, new trades we cover, new service areas, customer stories, and seasonal offers. These are separate from operational messages (booking confirmations, status updates, payment instructions, and direct replies to your enquiries), which we send regardless of your marketing preferences because they are required for the service to function.

Marketing emails are only sent to people who have explicitly opted in. We do not opt you in by default. We do not buy or rent email lists. When you submit a booking or application, you are not automatically added to a marketing list.

You can opt in by:

• Ticking the optional marketing checkbox on the booking or application form (when offered).
• Emailing [email protected] with the subject "Subscribe".
• Signing up via any newsletter form we publish on the site or our social channels.

You can opt out at any time by:

• Clicking the "unsubscribe" link included in every marketing email we send.
• Emailing [email protected] with the subject "Unsubscribe".
• Replying to any marketing email and asking to be removed.

We process opt-out requests within five business days. Once you opt out, you will not receive further marketing messages from us. Operational messages tied to active bookings will continue.

Updating your information

You can ask us to update or correct any personal data we hold about you. Email [email protected] or message us on Messenger with your booking or application reference number and the change you need. We aim to process correction requests within five business days.

Security

We use HTTPS with TLS encryption for all traffic. Booking submissions are protected by Cloudflare Turnstile (anti-bot), per-IP and global rate limiting, and a server-side proxy secret that authorises our backend writes. Access to the Google Sheets workbook and Drive folder is restricted to authorised team members. No system is perfect. We take reasonable steps but cannot guarantee absolute security.

Data breach notification

If a personal data breach occurs that creates a real risk to your rights and freedoms, we will:

• Notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, as required by Philippine law.
• Notify affected users directly via Messenger, email, or both, with a plain-English description of what happened, what data was affected, what we are doing about it, and what you can do to protect yourself.
• Publish a summary statement on this site once immediate response activities are complete.

Children

KuyaYos is intended for users aged 18 and over. We do not knowingly collect personal information from minors. If you're a parent or guardian and believe a minor has submitted information, contact us and we'll delete it.

Changes to this policy

If we change how we handle data, we'll update this page and revise the "Last updated" date at the top. Material changes will be flagged on the homepage for at least 14 days.

Contact

Questions about this policy, requests to access or delete your data, or any other privacy concern: email [email protected]. For security-related issues specifically, see /.well-known/security.txt.