Privacy Policy

Last updated: March 8, 2026

Tuluyan is a property management platform built for operators, guests, tenants, unit owners, and affiliates in the Philippines. This Privacy Policy explains what personal information we collect, how we use it, and how we protect it. It applies to everyone who uses the platform.

We believe in being straightforward about data. If we are ever unsure whether something counts as personal data, we assume it is and treat it accordingly. This policy should be read alongside our Terms of Service.

1. Information we collect

We collect different types of information depending on how you use the platform. Here is what we may collect:

Account information — your name, email address, and phone number when you sign up or update your profile.
Identity verification documents — government-issued ID information submitted for property owner or operator verification.
Payment information — payment details processed through our third-party payment gateways (QR Ph, GCash, GrabPay, card). We do not store full payment credentials on our servers.
Property data — property listings, descriptions, photos, pricing, room details, and availability that operators and owners provide.
Booking data — reservation details, check-in and check-out dates, guest counts, and transaction records.
Messages — communications sent through the platform's in-app messaging system.
Affiliate activity — if you participate in our affiliate program, we track link clicks, conversions, and attribution codes tied to your affiliate account.
Device and browser information — IP address, browser type, operating system, and general device information collected automatically when you visit the platform.
Cookies — essential cookies used for authentication and session management. See the Cookies & tracking section below.

2. How we use your information

We use your information for the following purposes:

Account management — to create and maintain your account, authenticate your identity via magic link email, and manage your organization membership.
Identity and property verification — to verify property owners and operators through government-issued ID checks and property documentation.
Payment processing — to facilitate transactions between guests and property operators through our supported payment gateways.
Platform operation — to run the platform, display property listings, process bookings, manage room availability, and deliver the core service.
Communication — to send you transactional emails (booking confirmations, magic link sign-ins), platform notifications, and service-related updates.
Affiliate attribution — to track referral activity, calculate commissions, and manage the affiliate program.
Fraud prevention — to detect and prevent fraudulent activity, unauthorized access, and abuse of the platform.
Analytics — to understand how the platform is used and to improve the service. Analytics are based on aggregated, anonymized data only. We do not build individual user profiles for advertising purposes.

We do not sell, trade, or share your personal information with third parties for their commercial purposes. This includes your name, contact details, government ID information, and individual transaction records.

We may share your information in the following limited circumstances:

Payment gateway providers — we share the minimum information necessary with our payment processors (QR Ph, GCash, GrabPay, card networks) to complete your transactions.
Identity verification providers — when you submit documents for verification, we share them with trusted verification services to confirm your identity.
Hosting and infrastructure providers — our platform runs on cloud infrastructure. These providers process data on our behalf to operate the service but do not use your data for their own purposes.
Aggregated, anonymized data — we may share platform-wide trends, occupancy patterns, payment method usage, and booking volumes with partners. This data is aggregated and anonymized and cannot be traced back to any individual user or property.
Legal requirements — we may disclose your information if required by law, regulation, legal process, or government request, or when we believe disclosure is necessary to protect the rights, safety, or property of Tuluyan, our users, or the public.

4. Data retention

We keep your personal information for as long as your account is active and as needed to provide you with the platform's services.

If you request deletion of your account, we will remove your personal data within 30 days of the request. However, some information may be retained longer where required by law:

Transaction records may be kept for tax compliance and legal obligations.
Records related to disputes or legal claims may be retained until those matters are resolved.
Aggregated, anonymized data (which cannot identify you) may be retained indefinitely for analytics purposes.

5. Your rights

Where local data protection law grants you rights regarding your personal data, you may exercise them by contacting us. These rights may include:

Access — request a copy of the personal data we hold about you.
Correction — ask us to correct inaccurate or incomplete information.
Deletion — request that we delete your personal data, subject to legal retention requirements.
Portability — request your data in a structured, commonly used format so you can transfer it to another service.
Withdraw consent — where processing is based on your consent, you may withdraw it at any time.

To exercise any of these rights, contact us at hello@tuluyan.com. We will respond within 30 days.

6. Cookies & tracking

We use cookies strictly for essential platform functionality:

Authentication cookies — to keep you signed in and manage your session securely after you authenticate via magic link.
Session cookies — to maintain your session state as you navigate the platform.

We do not use third-party advertising cookies or tracking pixels. We do not serve ads on the platform.

For our affiliate program, we track link clicks and conversions using attribution codes. This tracking is used solely to attribute referrals and calculate affiliate commissions.

7. Data security

We take reasonable measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These measures include:

Encrypted connections (HTTPS) for all data transmitted between your browser and our servers.
Secure, passwordless authentication using magic links — we do not store passwords.
Access controls that limit who within our team can access personal data.
Regular review of our data collection, storage, and processing practices.

No system is 100% secure. While we work to protect your information, we cannot guarantee absolute security. If you become aware of any security issue, please contact us immediately at hello@tuluyan.com.

8. Children's privacy

Tuluyan is not intended for users under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have collected data from a person under 18, we will delete that information promptly. If you believe a minor has provided us with personal data, please contact us at hello@tuluyan.com.

9. International data transfers

Tuluyan is based in the Philippines. Your data may be processed in countries other than where you are located, including countries where our cloud infrastructure providers operate. These countries may have data protection laws that differ from those in your jurisdiction.

By using the platform, you consent to the transfer of your information to these countries. We take steps to ensure that your data receives an adequate level of protection wherever it is processed.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page and notify you through the platform or by email where appropriate.

Your continued use of the platform after changes are posted constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

11. Contact

If you have questions about this Privacy Policy, want to exercise your data rights, or have concerns about how we handle your information, contact us at:

hello@tuluyan.com