Privacy notice

DRAFT for legal review — not yet approved. Do not rely on this wording.

In short

We collect as little as we can. We never see your ID or selfie. We use no advertising or tracking cookies, and our pages load nothing from other companies' servers. You can download all your data in one go, and you can close your account whenever you like.

This policy explains what personal data Hookup Cebu collects, why, who sees it, how long we keep it and what your rights are. It follows the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the rules of the National Privacy Commission (NPC).

Who is responsible for your data

The personal information controller is [LAWYER: legal name of the operating holding company], registered at [LAWYER: registered address]. We run the Hookup Cebu website.

Our Data Protection Officer (DPO) is [LAWYER: DPO name and contact details]. You can reach the DPO through Contact. [LAWYER: confirm NPC registration of the DPO and of the data processing system, if required.]

Why this matters more on an adult site

Information about your sex life is "sensitive personal information" under the Data Privacy Act. Simply having an account here could reveal something private about you. We treat everything we hold about you with that in mind. [LAWYER: confirm the lawful basis for processing sensitive personal information under section 13 of RA 10173, most likely the member's specific consent, and whether the consent wording at sign-up is sufficient.]

What we collect

When you visit without an account (Viewer)

• your "I am 18+" answer, stored in a cookie on your device for 30 days
• your IP address and basic technical data, in our server logs [LAWYER: confirm server log retention period]

When you sign up (Registered User)

• your email address
• your password, stored only as a scrambled "hash" that we cannot turn back into your password
• your date of birth, as you declare it
• the IP address you signed up from
• which version of our Terms, this policy and our Community Rules you accepted, and when

Your profile

• display name
• profile type (for example single man, single woman or couple)
• your age, worked out from your date of birth
• nationality, or "Local"
• your area
• your "about me" text and interests
• the symbol you picked as your picture (you cannot upload your own photo at the moment)
• who you have chosen to show your listings, profile and posts to
• your colour and display preferences, such as your theme (saved in your account, not in a cookie)

What you do on the site

• listings, community posts, comments and private messages
• votes, emoji reactions and saved posts
• the IP addresses you used to sign in and to post
• your login history (when and from what IP address)
• a log of emails we sent you and whether they were delivered
• photos and videos, if that feature is switched on (it is off at launch)

When you take the age check (Community Member)

The age check is done by an independent provider, Didit (Didit Identity), on its own page. You give Didit a photo of your ID document and a live selfie. Didit checks that the face matches and that the date of birth on the ID shows you are 18 or over.

We only receive and keep:

• whether you passed or not
• that it was an ID check
• the country that issued the ID
• Didit's reason codes if you were declined

We never receive or keep your ID image, your selfie, the name on your ID, your ID number or the date of birth on your ID.

Didit has its own privacy notice, which applies to what you give it. Didit is based outside the Philippines. [LAWYER: confirm whether Didit acts as our processor or as a separate controller, the data-sharing or outsourcing agreement in place, and the legal basis and safeguards for the cross-border transfer under RA 10173 and NPC rules.]

Moderation records

• reports you make, and reports made about you
• case files, including copies ("snapshots") of the reported content as evidence
• warnings, restrictions, suspensions, bans and appeals
• requests from authorities and our replies
• a log of every time a moderator reads a private conversation

When you contact us

• your message, your email address and anything else you choose to tell us. Non-members can also contact us and report problems through Contact.

Cookies

We use only two cookies:

• a session cookie, which keeps you signed in
• a cookie that remembers your "I am 18+" answer for 30 days

We do not use advertising cookies or analytics cookies. Our pages do not load anything from other servers. That means no trackers, no social media buttons, no outside fonts and no outside scripts.

Why we use your data

We use your data only for these purposes:

• To run your account and the site. Signing you in, showing your profile and posts, sending private messages, and emails such as confirmation and password reset.
• To keep under-18s out. Your declared date of birth and your age-check result.
• To keep members safe. Handling reports, moderation, filtering banned words, stopping spam, scams and repeat accounts, and investigating abuse.
• To meet legal duties. Keeping records the law requires, answering lawful requests from authorities, and reporting child exploitation, trafficking, non-consensual images and threats.
• To prove what you agreed to. Keeping a record of which version of our documents you accepted.
• To keep the site secure. Using IP addresses and login history to spot break-ins and abuse.

We do not sell your data. We do not use it for advertising. We do not build marketing profiles.

[LAWYER: map each purpose to a lawful basis under sections 12 and 13 of RA 10173 (consent, contract, legal obligation, legitimate interests, protection of life and health, establishment or defence of legal claims).]

Who can see your data

Other members and visitors. They see what you post and your profile, depending on the visibility you choose (everyone, signed-in members, or Community Members only). They never see your email address, your date of birth (only your age), your IP addresses or your age-check details.

Our moderators. They can see what is needed to deal with reports and keep the site safe. They can read a private conversation only when it is reported, or when it is needed for safety or legal reasons. Every such reading is logged.

Our service providers. We use [LAWYER: list hosting provider, email delivery provider and any other processors, with their locations] to run the site. They act only on our instructions, under written agreements.

Didit, for the age check, as explained above.

Authorities. We share data with the police, courts, the NPC or other public bodies when the law requires it, or to report serious crimes such as child sexual abuse or exploitation (under RA 11930), trafficking (under RA 9208 as amended) or non-consensual images (under RA 9995). We log every request we get and every disclosure we make.

If the business changes hands. If the site is sold or merged, your data may pass to the new owner, who must respect this policy. We will tell you first.

Transfers outside the Philippines

Some of our providers, including Didit, are based or store data outside the Philippines. When we transfer data abroad, we stay responsible for it under the Data Privacy Act and use contracts and other safeguards to protect it. [LAWYER: list countries and safeguards.]

How long we keep your data

We keep data only as long as we need it. These periods are our current plan:

• Unconfirmed sign-ups: wiped after 14 days.
• Login history and email delivery logs: about [LAWYER: confirm, proposed 90] days.
• Server logs: [LAWYER: period].
• Listings: they expire and disappear from view after a set number of hours. [LAWYER: confirm how long expired listings are kept before deletion.]
• Active accounts: for as long as your account is open.
• Closed accounts: kept for about [LAWYER: confirm, proposed 365] days, then anonymised. Anonymised means your display name is replaced, and your email, date of birth, IP addresses and texts are removed.
• Moderation records and evidence: may be kept for longer where needed for legal reasons, such as defending legal claims or helping authorities. [LAWYER: set a maximum period.]

We may keep data for longer, and not delete or anonymise it, if:

• it is under a legal hold (frozen because the law or an investigation requires it)
• it is part of an open moderation case, report or appeal
• it is part of an open request from an authority

Once that reason ends, the normal periods apply again.

Keeping your data safe

We use reasonable security measures, including:

• passwords stored only as hashes
• encrypted connections to the site
• removing location and other hidden data from photos, and blanking location and date data in videos (when uploads are switched on)
• limiting staff and moderator access to what each person needs
• logging when moderators read private conversations

No system is perfectly safe. If a breach is likely to put you at real risk, we will tell you and the NPC as the law requires, normally within 72 hours of finding out. [LAWYER: confirm breach notification wording against NPC Circular on personal data breach management.]

Your rights

Under the Data Privacy Act you have these rights:

• The right to be informed. To know that your data is being collected and why. This policy is part of that.
• The right to access. To get a copy of your data and details of how we use it.
• The right to object. To object to us using your data, including where you gave consent and want to take it back.
• The right to erasure or blocking. To have your data deleted or blocked when it is no longer needed, was collected unlawfully, or you withdraw consent.
• The right to rectification. To have wrong data corrected.
• The right to data portability. To get your data in a common electronic format you can reuse.
• The right to damages. To be paid for harm caused by wrong, false or unlawfully obtained data, or by unauthorised use of it.
• The right to file a complaint. To complain to the National Privacy Commission.

How to use your rights on the site

Download my data. Go to My data. You will get one file with everything about your account at once.

Correct your data. You can edit most of your profile yourself in Settings. For anything you cannot change yourself, such as your date of birth, ask through My data.

Close your account. Go to Close my account. Your profile and posts are taken down. [LAWYER: confirm with the owner exactly what is hidden at once on closing.] The rest is kept for the retention period above, then anonymised.

Ask for full erasure now. When you close your account, you can choose to have your data erased straight away instead of waiting for the retention period.

Other requests. For access details, objections or anything else, use My data. We will reply within [LAWYER: number, site default 15] days. We may ask you to confirm you own the account before we act.

When we may say no or wait. We may refuse or delay erasure where the law requires us to keep records. This includes a legal hold, a police or other investigation, or an open moderation case, report or appeal. If so, we will tell you why, unless the law forbids it.

Withdrawing consent. You can withdraw your consent at any time by closing your account. This does not affect anything we did before.

Complaints. Please tell our DPO first through Contact, so we can try to fix it. You also have the right to complain to the National Privacy Commission at any time.

Children

The site is only for people aged 18 and over. We do not knowingly collect data from anyone under 18. If an age check shows that someone is under 18, we close the account at once, and moderators review it. We may report it to the authorities. Any other data from that person is kept only as long as needed for that review or for the authorities, then deleted.

If you think someone under 18 is using the site, please tell us at once through Contact.

Changes to this policy

We may update this policy. If we make an important change, we will show a notice on the site and ask you to accept the new version when you next sign in. We record which version you accepted and when.

Contact

For any privacy question, contact our Data Protection Officer through Contact.

Last updated: [LAWYER: date]. Version: [LAWYER: version number].