In plain English
The short version
- Sachi Technologies OPC is the controller of your data.
- We collect account, KYC, transaction, and usage data — directly from you and our payment partner.
- We never sell your data and use no third-party ad cookies.
- You can delete your account and erase your data from your dashboard.
- Records the law requires us to keep are retained anonymized.
This summary is a convenience. The numbered sections below are the binding text.
1Who controls your data (Personal Information Controller)
The PIC is Sachi Technologies OPC, operating the unidorms.ph platform. Our Data Protection Officer can be reached at privacy@unidorms.ph. We are responsible for deciding how and why your personal data is processed and for keeping it secure.
2Information we collect
- Account: name, email, phone number, university, role (student/landlord/admin), avatar, password hash (we never see your plaintext password).
- Landlord KYC: government ID and proof of authority over the unit, stored in a private bucket.
- Transactions: reservations, lease terms, platform fee payment references, refund records.
- Browsing: presence (active-now counts), favorites, listing views (aggregated).
- Communications: messages and dispute submissions.
3Where your data comes from (sources)
Most personal data is collected directly from you when you sign up, list a unit, book, message, or upload KYC. Some data is obtained from third parties: the legal payor name captured by our BSP-regulated payment partner (Xendit / GCash) when you pay, and publicly available business information used to seed building and area listings. Where we obtain your personal data from a source other than you, this section is your notice of that fact.
4How we use it (purpose)
To create and manage your account, verify identity, match students with landlords, process reservations and refunds, generate legally enforceable leases, resolve disputes, prevent fraud, comply with Philippine law (BIR, NPC, KYC), and improve the platform. We do not sell your personal data.
5Lawful basis
We process personal data based on contract performance (your reservation/listing agreement), legal obligation (KYC, tax, NPC compliance), legitimate interest (fraud prevention, service improvement), and your consent where required (e.g., marketing email, which you can withdraw at any time).
6Who we share it with (recipients)
With Landlords: after a reservation, a Student’s name and contact information (email, phone) are revealed to the Landlord so they can coordinate move-in. With Students: a Landlord’s public business name and KYC-verified status. Service providers (processors under data-processing agreements): Supabase (hosting/storage), Vercel (hosting), Resend (email), Xendit / GCash (payments). Authorities: when required by law, court order, or NPC directive. We do not share your data for third-party advertising.
7How long we keep it (retention)
- KYC documents: kept while you operate as a Landlord and for 5 years after KYC revocation or account deletion (anti-money-laundering / fraud-prevention basis), then securely deleted from the private bucket.
- Transaction & lease records: 10 years (BIR record-keeping obligation), retained in anonymized form after account deletion.
- Account profile, messages, favorites, notifications: deleted or anonymized when you delete your account (see Section 9).
- Reviews: retained while the listing exists; author anonymized after account deletion.
- Contact-form inquiries: the email and message you send through our contact form are kept to handle your request and for follow-up, then deleted or anonymized within 24 months of our last correspondence (unless an inquiry forms part of a transaction or legal record above).
- Browsing/presence data is aggregated and not personally identifiable.
8Automated processing
In plain English — We use automation to flag possible fraud and to rank search results — but a real person reviews anything that meaningfully affects you, like disputes and KYC.
We use limited automated processing for fraud prevention (e.g., matching the payment-rail payor name against the booking account to flag third-party payers) and for search ranking and recommendations. We do not make decisions producing legal or similarly significant effects on you based solely on automated processing without a route to human review. Disputes and KYC approvals are reviewed by a human.
9Your rights under the DPA
In plain English — You can access, correct, object to, or erase your data — and you can delete your account and wipe your data yourself from your dashboard.
You have the right to be informed, to access your data, to correct inaccuracies, to object to processing, to erase or block data, to data portability, to file a complaint with the NPC, and to be indemnified for damages. You can delete your account and erase your personal data directly from your dashboard (Account → Delete my account), or by emailing privacy@unidorms.ph. Records the law requires us to keep (e.g., BIR transaction records) are retained in anonymized form.
10Storage & security
Data is stored in Supabase (primary region: Asia Pacific). KYC documents are stored in a private bucket restricted to named admin roles and released only via short-lived signed URLs. Passwords are stored as hashes; sessions use httpOnly cookies. We use TLS in transit and standard administrative, technical, and physical safeguards.
12Children
13International transfers
Some service providers (e.g., Vercel) may process data outside the Philippines. We rely on contractual safeguards and your consent where required.
14Changes
We may update this Privacy Policy. Material changes will be announced in-app or by email.
15Data Protection Officer & complaints
Data Protection Officer: privacy@unidorms.ph. You may also lodge a complaint with the National Privacy Commission: privacy.gov.ph.
Questions about this document?
The contacts below reach the team that maintains this document.