Skip to main content
Legal

Privacy Policy

We take your privacy seriously. This policy explains what data Scoutlify collects, how we use it, who we share it with, and how you can control or delete it at any time.

Last revised · May 27, 2026

1Overview

Scoutlify is operated from the Philippines and complies with the Data Privacy Act of 2012 (Republic Act No. 10173) and the rules of the National Privacy Commission (NPC). This Privacy Policy applies to all users of our website, mobile experience (PWA), and API — including buyers, brokers, agents, and administrators.

By using Scoutlify, you agree to the collection and use of your information as described here. If you do not agree, please do not use the Service. Your continued use after a policy change constitutes acceptance of the revised terms.

2Information We Collect

We collect information in three ways:

2.1 Information you provide directly

  • Account data — first name, last name, email address, phone number (optional), password (hashed with bcrypt — we never store it in plain text).
  • Profile data — profile photo, bio, locale, timezone, social-media links (Facebook, X / Twitter, Instagram, LinkedIn), broker affiliations (for brokers).
  • Listing data (brokers only) — property title, description, photos, location, price, amenities, contact information you choose to publish.
  • Communications — messages you send to other users through our in-app messaging, inquiries you submit, visit-request notes, support tickets.
  • Payment data — billing details are processed by PayMongo; we receive only the transaction reference, amount, and status — not your full card number.

2.2 Information from third-party sign-in providers

If you sign in with Google or Facebook, we receive your name, email address, and profile picture from that provider — only what's needed to create or link your account. We do not receive your password from the provider, and we don't post anything back to your social account without explicit permission.

2.3 Information collected automatically

  • Usage data — pages visited, properties viewed, search queries, time spent, click paths. Used to improve the platform and personalize recommendations.
  • Device data — IP address, browser type, operating system, screen size, language preference.
  • Location data — approximate location from your IP, or precise GPS coordinates if you tap "Find homes near me" (we ask permission first; you can refuse).
  • Cookies and similar technologies — see Section 5 for details.

3How We Use Your Information

We process your data only for purposes you would reasonably expect:

  • Provide the Service — show you property listings, route inquiries to brokers, deliver messages, schedule visits, accept payments.
  • Personalize — surface relevant listings, calculate lead scores, recommend brokers and properties.
  • Communicate — send transactional emails (verification, password reset, inquiry notifications), product updates (only if you opt in), and customer-support replies.
  • Security and fraud prevention — detect and block fake accounts, spam listings, abusive behavior, payment fraud. This includes verifying broker identity and reviewing flagged content.
  • Legal compliance — respond to lawful requests from Philippine authorities, comply with tax and accounting requirements.
  • Improve the platform — aggregated, anonymized analytics to understand usage patterns and prioritize features. We do not sell your personal data to advertisers.

4How We Share Your Information

We share information only in these specific cases:

  • With brokers — when you submit an inquiry, book a visit, or favorite a listing, the broker who owns that listing sees your name, contact details, and message contents. This is the core of the platform.
  • With other users — your public profile (name, profile photo, broker badge, social links you've added) is visible to anyone browsing the platform.
  • With service providers (data processors) — we use vetted third parties for specific functions:
    • Cloudinary — image hosting and optimization
    • MapTiler — map tiles and address geocoding
    • Resend — transactional email delivery
    • Pusher — real-time message and notification delivery
    • PayMongo — payment processing
    • Vercel + Neon — hosting and database infrastructure
    • Upstash — rate limiting and abuse prevention
    Each is contractually bound to use your data only to provide their service to us, never for their own purposes.
  • Legal compliance — we may disclose data when required by Philippine law, a court order, or a request from the National Privacy Commission.
  • Business transfers — if Scoutlify is acquired or merges with another entity, your data may transfer to the new owner under the same protections.

We do not sell your personal information. We do not share your contact details with advertisers.

5Cookies and Tracking

We use cookies and similar technologies for three purposes:

  • Strictly necessary — login session (sl_at, sl_rt httpOnly cookies), CSRF protection, language preference. These cannot be disabled without breaking core features.
  • Functional — theme preference (light / dark / system), recently-viewed listings, dismissed onboarding tooltips.
  • Analytics — aggregated traffic analysis. We do not use third-party advertising cookies.

You can block cookies in your browser settings, but doing so will sign you out and disable language switching.

6Data Retention

We keep your data only as long as we need it:

  • Active accounts — for as long as your account is active.
  • Deleted accounts — 30-day grace period during which you can reactivate by signing in again; after 30 days, your personally identifiable information (name, email, phone, photo, messages) is permanently purged. Anonymized financial records (invoice numbers, transaction amounts) may be retained for up to 10 years to satisfy Philippine tax and accounting law.
  • Listings — when you archive a listing it's hidden from public view; we keep it for 90 days so you can restore it, then permanently delete the photos and content.
  • Logs — server logs (IP, request paths, timestamps) are kept for 30 days for debugging and security; longer only if part of an active fraud investigation.
  • Backups — daily encrypted snapshots are kept for 14 days, then automatically rotated.

7Your Rights

Under the Data Privacy Act of 2012, you have the following rights regarding your personal data:

  • Right to be informed — that's why this policy exists.
  • Right to access — view what we hold about you at any time via your account settings.
  • Right to rectify — correct inaccurate details in your profile.
  • Right to erasure — delete your account and have your data purged (see Section 8 below).
  • Right to portability — request a copy of your data in a machine-readable format by emailing privacy@scoutlify.com.
  • Right to object — opt out of marketing emails at any time via the footer of any email or in notification preferences.
  • Right to file a complaint — if you believe we've mishandled your data, you may file a complaint with the National Privacy Commission at privacy.gov.ph.

8User Data Deletion

You can delete your Scoutlify account at any time — including all personal data, listings, messages, and any data we received from third-party sign-in providers (Google, Facebook).

If you can sign in to Scoutlify

  1. Visit your security settings (or /account/security if you're a buyer).
  2. Scroll to the Delete account section.
  3. Confirm your password and click Delete my account.
  4. Your account is immediately deactivated. After a 30-day grace period (in case you change your mind and want to reactivate by signing in again), all personally identifiable information is permanently purged from our database.

If you signed in with Facebook and want to disconnect just Facebook (not delete the account)

You can revoke Scoutlify's access to your Facebook account at any time without deleting your Scoutlify profile:

  1. Go to your Facebook account → Settings & Privacy → Settings → Apps and Websites.
  2. Find Scoutlify in your Active apps list.
  3. Click Remove.

This severs the link between your Facebook account and your Scoutlify account. You can continue using Scoutlify by setting an email password instead (use the password-reset flow).

If you cannot sign in

If you've lost access to your account (forgot your email, lost your phone for two-factor codes, etc.), email us at privacy@scoutlify.com with the following:

  • The subject line: "Data deletion request — Scoutlify"
  • The full name on the account
  • The email address associated with the account
  • Any identifying detail you can provide (when you signed up, recent listing slugs you owned, etc.)

We will verify your identity and complete the deletion within 30 days of confirming the request. We will email you a confirmation once your data has been purged.

What gets deleted

  • Your name, email, phone, password hash, profile photo, bio, locale, timezone, social links, developer affiliations
  • All listings you created, including their photos
  • All messages you sent (other users see them replaced with "(message deleted)")
  • All inquiries, visit requests, favorites, and recently-viewed history
  • All third-party-sign-in linkages (Google, Facebook tokens) — we also revoke the access tokens with the providers
  • All push-notification subscriptions and rate-limit records

What we may retain (anonymized)

  • Aggregated, non-personal usage statistics — once stripped of any identifier linking back to you, this data is no longer "personal" under the Data Privacy Act.
  • Financial records — invoice numbers, transaction amounts, and dates for any PayMongo payments you made. These are kept for up to 10 years as required by the Bureau of Internal Revenue (BIR) and Philippine tax law. They contain no information beyond what's strictly required.
  • Security logs — IP addresses logged during active fraud investigations may be retained for up to 90 days after deletion to defend the platform against repeat abuse.

Need help? Email privacy@scoutlify.com at any time. We typically respond within one business day.

9Children's Privacy

Scoutlify is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please email privacy@scoutlify.com and we will delete it promptly.

10International Data Transfers

Scoutlify is hosted on Vercel and Neon, whose servers are located in Singapore (Asia-Pacific). Image hosting (Cloudinary), email delivery (Resend), and payment processing (PayMongo) may route data through their respective global infrastructures.

By using Scoutlify, you consent to your data being transferred to and stored in these jurisdictions. We require each provider to implement protections that meet or exceed Philippine data-privacy standards.

11Security

We protect your data with industry-standard safeguards:

  • Encryption in transit — every page is served over HTTPS with HSTS preloaded.
  • Encryption at rest — your database is encrypted by Neon; backups are encrypted with separate keys.
  • Password hashing — bcrypt with cost 12; we cannot recover your plain-text password.
  • Session security — JWT tokens with short lifetimes (15 minutes) and rotating refresh tokens (revoked on suspicious activity).
  • CSRF and SSRF defenses — Origin/Referer checks on every state-changing request; outbound URL fetches validated against IP-range allowlists.
  • Content Security Policy — strict allowlist of trusted sources for scripts, styles, and images.
  • Rate limiting — per-IP and per-email throttling on login, registration, and abuse-prone endpoints.
  • Regular audits — dependency vulnerability scans and penetration tests.

If you discover a security vulnerability, please disclose it responsibly by emailing privacy@scoutlify.com with the subject "Security report". We do not run a paid bug-bounty program but will acknowledge contributors who responsibly disclose issues.

12Third-Party Services

Scoutlify integrates with the following third-party services. Each has its own privacy policy:

13Changes to This Privacy Policy

We may update this Privacy Policy occasionally to reflect new features, legal requirements, or service-provider changes. When we do:

  • The Last revised date at the top of this page is updated.
  • For material changes (anything that materially expands how we collect, use, or share your data), we will notify active users via email at least 14 days before the change takes effect.
  • For minor edits (typo fixes, link updates, clarifications) the date is bumped but no notice is sent.

If you do not agree to a change, you can delete your account before the effective date. Continued use of Scoutlify after the effective date constitutes acceptance.

14Contact Us

For any privacy-related question, request, or complaint:

For complaints we cannot resolve to your satisfaction, you may contact the National Privacy Commission of the Philippines at privacy.gov.ph.

Want to delete your account or data now? Use the one-click flow in your security settings — no email needed.

Delete my account

Have a question we didn't answer? We respond within one business day.

Email us