Privacy Policy

This Privacy Policy explains how Joesons ("we", "us", or "our") collects, uses, stores, and shares personal data of members and creators who use the Joesons mobile application. Members accept the current version when they create an account and when material updates require re-acceptance in the app. We process personal data in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and other applicable laws. 1. WHO WE ARE Joesons is the personal information controller for the data described in this Policy. We use that data to run accounts, orders, the creator program, security, and our own legal compliance. You can contact us using the details in Section 13. 2. PERSONAL DATA WE COLLECT Account and profile. First name, last name, email address, contact number when you provide one, password (stored as a hash, not in plaintext), role, email verification status, and legal-acceptance records (the version you accepted and when). If you sign up with email and password, we email a one-time verification code. That code is stored only as a hash and expires shortly after it is sent. If you use Google sign-in, Google provides your verified email address and name so we can create or sign in to your account. We do not receive or store your Google password. A Google-created account may not include a contact number until you add one. Orders and checkout. Cart contents, products ordered, amounts, promo codes you apply, payment method type (COD or QR transfer), order status, recipient name, contact number, complete address, landmark, customer notes, tracking and carrier information entered by staff, cancellation and fulfillment timeline, and uploaded payment-proof images and optional reference notes. Payment-proof images are photos you choose from your photo library. We do not scan your library, and we do not access your camera unless a future version of the app asks for that permission separately. Affiliate and creator. Display name, bio, social handles and URLs, optional follower counts, creator affiliation, unique link codes, click events, device identifier, attribution window, commission amounts and statuses, and payout method (GCash, Maya, or bank: account name, account number, and bank name). Payout method fields are encrypted at rest. Payout proof images may be stored. Device, usage, and technical data. An install-scoped device identifier used for affiliate attribution and order association, stored in app storage on your device; Internet Protocol address and request metadata for security, rate limiting, and logs; application diagnostics; and authentication tokens stored in the device secure store. We do not collect precise location, your contacts, or an advertising identifier, and we do not use your data to build advertising profiles. Communications. In-app inbox messages and emails we send (verification, order and affiliate notices, password reset). SMS may be used if that channel is configured. You may provide data about other people (for example a delivery recipient). You must have permission to do so. 3. HOW WE COLLECT DATA We collect data that you submit, that staff enter to fulfill your orders, that is generated by use of the Service (orders, clicks, logs), that payment and storage providers return to us, and that Google provides if you choose Google sign-in. Public affiliate links may record a click with a device identifier even if you are not signed in. 4. PURPOSES AND LEGAL BASES We use personal data to: - create and authenticate accounts, including Google sign-in; - provide the catalog, carts, checkout, fulfillment, and customer order history; - operate affiliate attribution, commissions, and recorded payouts; - send transactional notices (email and in-app; SMS if enabled); - store files you upload (payment proofs, payout proofs, profile images); - maintain security, prevent fraud and abuse, enforce rate limits, and debug incidents; - comply with law, enforce these Terms, and handle disputes; - improve Joesons (aggregated or de-identified analytics where feasible). Legal bases under the Data Privacy Act typically include your consent (including account creation and legal-document acceptance), processing that is necessary to fulfill a contract or take steps at your request, our legitimate interests that do not override your rights (such as security, attribution, and product improvement), and compliance with legal obligations. 5. DEVICE IDENTIFIERS The Joesons app stores session tokens in the device secure store and an install-scoped device identifier in app storage, to keep you signed in and to attribute affiliate clicks when you open a creator link, sign in, or place an order. Photo-library access is requested only when you choose a payment-proof image. These are not used to sell advertising profiles. You can uninstall the app; some features (stay signed in, attribution) may then work less completely. 6. SHARING We share personal data with: - Joesons administrators and staff who need the data to fulfill orders, review payment proofs, or run the creator program; - creators, limited to their own commissions, payouts, and program status — buyer identity is not exposed on creator commission APIs; - processors who host or deliver the Service, including application hosting providers, database and cloud hosting, file storage, email delivery, payment processors such as Xendit, and Google for sign-in; - professional advisers, authorities, or counterparties when required by law, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets, subject to appropriate safeguards. We do not sell personal data. Customer payments for goods are made to Joesons (COD or the Joesons QR destination). Those payment channels sit with Joesons except for proofs and statuses stored in the Service. 7. INTERNATIONAL TRANSFERS Servers, storage, email, or payment providers may process data outside the Philippines. Where we transfer personal data abroad, we take steps required by applicable law so that recipients protect it appropriately. 8. RETENTION We keep personal data only as long as needed for the purposes above, including while accounts are active, for the life of orders and commissions, and thereafter as required for legal, tax, accounting, dispute, and security purposes. Examples: authentication sessions expire according to token settings; unpaid QR stock reservations expire on a short timer (typically 48 hours); order records are kept for longer statutory periods. When data is no longer required, we delete or anonymize it where feasible. 9. SECURITY We use administrative, technical, and organizational measures appropriate to the risk, including access control, transport encryption, hashed passwords, encryption of creator payout-method fields, and webhook verification for payment providers. No method of transmission or storage is completely secure. You must use a strong password and protect devices that store Joesons sessions. 10. YOUR RIGHTS Subject to the Data Privacy Act and other law, you may request to: - access personal data we hold about you; - rectify inaccurate or incomplete data (you can also update much of your profile in the app); - object to or withdraw consent for certain processing, including by closing your account where the Service allows; - request erasure or restriction, subject to legal retention needs (for example completed orders and fraud prevention); - request data portability where applicable. Contact us using Section 13. We may need to verify your identity before fulfilling a request. You may complain to the National Privacy Commission of the Philippines (https://privacy.gov.ph) if you believe your data privacy rights were violated. 11. CHILDREN Joesons is intended for users 18 years of age or older. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will take appropriate steps to delete it. 12. CHANGES TO THIS POLICY We may update this Privacy Policy. The version and date will appear in the Service. Members will be asked to review and accept the current version before continuing when material changes require acceptance. Continued use after that point means you acknowledge the updated Policy. 13. CONTACT Privacy requests and questions: Joesons, through the Joesons mobile application. You may also contact the National Privacy Commission for guidance on your rights under Philippine law.