Privacy Policy

1Overview

Scoutlify is operated from the Philippines and complies with the Data Privacy Act of 2012 (Republic Act No. 10173) and the rules of the National Privacy Commission (NPC). This Privacy Policy applies to all users of our website, mobile experience (PWA), and API — including buyers, brokers, agents, and administrators.

By using Scoutlify, you agree to the collection and use of your information as described here. If you do not agree, please do not use the Service. Your continued use after a policy change constitutes acceptance of the revised terms.

2Information We Collect

We collect information in three ways:

2.1 Information you provide directly

• Account data — first name, last name, email address, phone number (optional), password (hashed with bcrypt — we never store it in plain text).
• Profile data — profile photo, bio, locale, timezone, social-media links (Facebook, X / Twitter, Instagram, LinkedIn), broker affiliations (for brokers).
• Listing data (brokers only) — property title, description, photos, location, price, amenities, contact information you choose to publish.
• Communications — messages you send to other users through our in-app messaging, inquiries you submit, visit-request notes, support tickets.
• Payment data — billing details are processed by PayMongo; we receive only the transaction reference, amount, and status — not your full card number.

2.2 Information from third-party sign-in providers

If you sign in with Google or Facebook, we receive your name, email address, and profile picture from that provider — only what's needed to create or link your account. We do not receive your password from the provider, and we don't post anything back to your social account without explicit permission.

2.3 Information collected automatically

• Usage data — pages visited, properties viewed, search queries, time spent, click paths. Used to improve the platform and personalize recommendations.
• Device data — IP address, browser type, operating system, screen size, language preference.
• Location data — approximate location from your IP, or precise GPS coordinates if you tap "Find homes near me" (we ask permission first; you can refuse).
• Cookies and similar technologies — see Section 5 for details.

3How We Use Your Information

We process your data only for purposes you would reasonably expect:

• Provide the Service — show you property listings, route inquiries to brokers, deliver messages, schedule visits, accept payments.
• Personalize — surface relevant listings, calculate lead scores, recommend brokers and properties.
• Communicate — send transactional emails (verification, password reset, inquiry notifications), product updates (only if you opt in), and customer-support replies.
• Security and fraud prevention — detect and block fake accounts, spam listings, abusive behavior, payment fraud. This includes verifying broker identity and reviewing flagged content.
• Legal compliance — respond to lawful requests from Philippine authorities, comply with tax and accounting requirements.
• Improve the platform — aggregated, anonymized analytics to understand usage patterns and prioritize features. We do not sell your personal data to advertisers.

4How We Share Your Information

We share information only in these specific cases:

• With brokers — when you submit an inquiry, book a visit, or favorite a listing, the broker who owns that listing sees your name, contact details, and message contents. This is the core of the platform.
• With other users — your public profile (name, profile photo, broker badge, social links you've added) is visible to anyone browsing the platform.
• With service providers (data processors) — we use vetted third parties for specific functions:
  • Cloudinary — image hosting and optimization
  • MapTiler — map tiles and address geocoding
  • Resend — transactional email delivery
  • Pusher — real-time message and notification delivery
  • PayMongo — payment processing
  • DigitalOcean — application hosting and database infrastructure
  • Upstash — rate limiting and abuse prevention
  Each is contractually bound to use your data only to provide their service to us, never for their own purposes.
• Legal compliance — we may disclose data when required by Philippine law, a court order, or a request from the National Privacy Commission.
• Business transfers — if Scoutlify is acquired or merges with another entity, your data may transfer to the new owner under the same protections.

We do not sell your personal information. We do not share your contact details with advertisers.

5Cookies and Tracking

We use cookies and similar technologies for three purposes:

• Strictly necessary — login session (sl_at, sl_rt httpOnly cookies), CSRF protection, language preference. These cannot be disabled without breaking core features.
• Functional — theme preference (light / dark / system), recently-viewed listings, dismissed onboarding tooltips.
• Analytics — aggregated traffic analysis. We do not use third-party advertising cookies.

You can block cookies in your browser settings, but doing so will sign you out and disable language switching.

6Data Retention

We keep your data only as long as we need it:

• Active accounts — for as long as your account is active.
• Deleted accounts — 30-day grace period during which you can reactivate by signing in again; after 30 days, your personally identifiable information (name, email, phone, photo, messages) is permanently purged. Anonymized financial records (invoice numbers, transaction amounts) may be retained for up to 10 years to satisfy Philippine tax and accounting law.
• Listings — when you archive a listing it's hidden from public view; we keep it for 90 days so you can restore it, then permanently delete the photos and content.
• Logs — server logs (IP, request paths, timestamps) are kept for 30 days for debugging and security; longer only if part of an active fraud investigation.
• Backups — daily encrypted snapshots are kept for 14 days, then automatically rotated.

7Your Rights

Under the Data Privacy Act of 2012, you have the following rights regarding your personal data:

• Right to be informed — that's why this policy exists.
• Right to access — view what we hold about you at any time via your account settings.
• Right to rectify — correct inaccurate details in your profile.
• Right to erasure — delete your account and have your data purged (see Section 8 below).
• Right to portability — request a copy of your data in a machine-readable format by emailing [email protected].
• Right to object — opt out of marketing emails at any time via the footer of any email or in notification preferences.
• Right to file a complaint — if you believe we've mishandled your data, you may file a complaint with the National Privacy Commission at privacy.gov.ph.

9Children's Privacy

Scoutlify is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please email [email protected] and we will delete it promptly.

10International Data Transfers

Scoutlify is hosted on DigitalOcean, whose servers are located in Singapore (Asia-Pacific). Image hosting (Cloudinary), email delivery (Resend), and payment processing (PayMongo) may route data through their respective global infrastructures.

By using Scoutlify, you consent to your data being transferred to and stored in these jurisdictions. We require each provider to implement protections that meet or exceed Philippine data-privacy standards.

11Security

We protect your data with industry-standard safeguards:

• Encryption in transit — every page is served over HTTPS with HSTS preloaded.
• Encryption at rest — your database is encrypted by DigitalOcean; backups are encrypted with separate keys.
• Password hashing — bcrypt with cost 12; we cannot recover your plain-text password.
• Session security — JWT tokens with short lifetimes (15 minutes) and rotating refresh tokens (revoked on suspicious activity).
• CSRF and SSRF defenses — Origin/Referer checks on every state-changing request; outbound URL fetches validated against IP-range allowlists.
• Content Security Policy — strict allowlist of trusted sources for scripts, styles, and images.
• Rate limiting — per-IP and per-email throttling on login, registration, and abuse-prone endpoints.
• Regular audits — dependency vulnerability scans and penetration tests.

If you discover a security vulnerability, please disclose it responsibly by emailing [email protected] with the subject "Security report". We do not run a paid bug-bounty program but will acknowledge contributors who responsibly disclose issues.

12Third-Party Services

Scoutlify integrates with the following third-party services. Each has its own privacy policy:

• Google (OAuth sign-in) — Privacy Policy
• Facebook / Meta (OAuth sign-in) — Privacy Policy
• PayMongo (payments) — Privacy Policy
• Cloudinary (image hosting) — Privacy Policy
• MapTiler (maps + geocoding) — Privacy Policy
• Resend (transactional email) — Privacy Policy
• Pusher (real-time delivery) — Privacy Policy
• DigitalOcean (hosting + database) — Privacy Policy
• Upstash (rate limiting) — Privacy Policy

13Changes to This Privacy Policy

We may update this Privacy Policy occasionally to reflect new features, legal requirements, or service-provider changes. When we do:

• The Last revised date at the top of this page is updated.
• For material changes (anything that materially expands how we collect, use, or share your data), we will notify active users via email at least 14 days before the change takes effect.
• For minor edits (typo fixes, link updates, clarifications) the date is bumped but no notice is sent.

If you do not agree to a change, you can delete your account before the effective date. Continued use of Scoutlify after the effective date constitutes acceptance.

14Contact Us

For any privacy-related question, request, or complaint:

• Email — [email protected]
• Website — https://scoutlify.com
• Postal address — Available on request from the email above

For complaints we cannot resolve to your satisfaction, you may contact the National Privacy Commission of the Philippines at privacy.gov.ph.