On this page
This Privacy Policy explains how PropMallows collects, uses, stores, and protects personal data, in compliance with Republic Act No. 10173 (the Data Privacy Act of 2012) and its Implementing Rules and Regulations.
1. Who We Are
PropMallows is a Software-as-a-Service (SaaS) property management platform built for Filipino freelance property managers, co-hosts, and property owners. We are the Personal Information Controller for the data described in this policy.
- Data Protection Officer (DPO): Mohammad Aminorhan Sahipa
- Email: privacy@propmallows.com
- Address: Phirst Park Homes, Poblacion, Pandi, Bulacan, Philippines
2. What Information We Collect
2.1 Property Manager account data
When a property manager creates an account, we collect:
- Full name and email address
- Phone number (for SMS notifications)
- Password (stored as an encrypted hash — never in plain text)
- Business name and address (optional)
- Payment billing information (processed by PayMongo — not stored by PropMallows)
2.2 Property and booking data
Through normal use of PropMallows, we collect:
- Property details — name, address, description, photos
- Airbnb and Booking.com iCal feed URLs (read-only access to booking data)
- Guest names and check-in / check-out dates (from iCal sync)
- Guest phone numbers (entered by the property manager for SMS rent collection)
- Booking amounts and payment status
2.3 Owner account data
Property owners invited by a property manager provide:
- Full name and email address
- Password (encrypted)
- No financial account details are collected from owners
2.4 Technical data
- IP address and browser type (for security logging)
- Device type and operating system
- Usage logs (pages visited, features used, timestamps)
3. How We Use Your Information
| Purpose | Legal basis (RA 10173) | Data used |
|---|---|---|
| Provide property management services | Contract necessity | All account and booking data |
| Process GCash / Maya rent collection | Contract necessity | Tenant phone, payment amount |
| Send SMS rent reminders | Contract necessity + consent | Tenant phone number |
| Generate monthly owner reports | Contract necessity | Booking and payment data |
| Assign cleaners after checkout | Contract necessity | Checkout time, cleaner contact |
| Post listings to Facebook | Consent (OAuth) | Property photos and description |
| Security and fraud prevention | Legitimate interest | IP address, usage logs |
| Legal and tax compliance | Legal obligation | Payment records (5 years) |
4. Data Sharing and Third Parties
PropMallows does not sell, rent, or trade your personal data to anyone, for any purpose.
We share data only with the following service providers, each bound by a Data Processing Agreement:
| Service provider | Purpose | Data shared |
|---|---|---|
| Supabase (USA) | Database hosting and authentication | All user and property data |
| PayMongo (Philippines) | Payment processing | Payment amounts, transaction IDs |
| Semaphore PH (Philippines) | SMS delivery | Phone numbers, message content |
| Resend (USA) | Email delivery | Email addresses, report PDFs |
| Anthropic Claude API (USA) | AI draft replies | Inquiry message text only |
| Cloudflare R2 (USA) | File and photo storage | Property photos, cleaner photos |
All third-party providers are contractually required to process data only as instructed by PropMallows, maintain appropriate security measures, and delete data on request.
5. Data Retention
We retain personal data only as long as necessary for its stated purpose, or as required by Philippine law:
| Data type | Retention period | Action after period |
|---|---|---|
| Guest name and phone number | 2 years from last stay | Anonymised (replaced with a Guest ID) |
| Booking dates and property | 3 years | Kept anonymised for tax records (BIR) |
| Payment records | 5 years | Permanently deleted (BSP requirement) |
| Messenger / inbox messages | 1 year | Permanently deleted |
| Cleaner task photos | 6 months | Permanently deleted from storage |
| Monthly owner reports (PDF) | 5 years | Permanently deleted |
| Property manager account data | Until deletion + 30 days | Permanently deleted on request |
| Security / audit logs | 2 years | Permanently deleted |
PropMallows runs an automated nightly cleanup process that anonymises and deletes personal data according to this schedule.
6. Your Rights Under RA 10173
As a data subject under the Philippine Data Privacy Act, you have the following rights:
6.1 Right to be informed
You have the right to know what personal data we collect about you, why we collect it, and how it is used. This Privacy Policy serves that purpose.
6.2 Right to access
You may request a copy of all personal data we hold about you. Submit a request to privacy@propmallows.com and we will respond within 15 business days.
6.3 Right to correction
You may request correction of any inaccurate or incomplete personal data. Property managers can update most data directly in their account settings.
6.4 Right to erasure
You may request deletion of your personal data. We will delete or anonymise your data within 30 days, except where retention is required by law (for example, BIR or BSP record-keeping).
6.5 Right to object
You may object to processing of your personal data for purposes beyond those stated in this policy. We will stop such processing on request.
6.6 Right to data portability
You may request your data in a machine-readable format (CSV or PDF). Submit a request to privacy@propmallows.com.
7. Data Security
PropMallows implements the following technical and organisational security measures:
- AES-256 encryption at rest for all personal data (Supabase)
- TLS 1.3 encryption in transit for all data transfers
- Row Level Security — property managers can only see their own data; owners can only see their own properties
- Multi-factor authentication available on all accounts
- Regular automated security backups
- Access logs for all database operations
- Annual security reviews and penetration testing
In the event of a data breach posing a risk to data subjects, PropMallows will notify the National Privacy Commission and all affected users within 72 hours, as required by RA 10173.
8. Contact and Complaints
For privacy-related requests or complaints, contact our Data Protection Officer:
- Email: privacy@propmallows.com
- Response time: within 15 business days
If a complaint is not resolved to your satisfaction, you may file it with the National Privacy Commission at privacy.gov.ph.
9. Changes to This Policy
PropMallows may update this Privacy Policy from time to time. We will notify registered users by email at least 30 days before material changes take effect.