Privacy Policy

Gigspact is the data controller for the personal data we process on the Platform. Our Data Protection Officer can be reached at dpo@gigspact.com.

We collect only what we need to run the Platform safely:

• Account data. Name, email, mobile number, profile photo, cover banner, and role (Customer or Vendor). We do not use passwords — sign-in is a one-time 6-digit code sent to the email you register with, so there is no password for us to store, hash, or leak.
• Vendor verification. Government-issued ID, DTI or SEC registration, business address, bank account details for payouts, tax identification.
• Booking & Agreement data. Event details, chat messages, quotations, co-signed Agreements, QR check-ins, proof-of-service uploads.
• Payment metadata. Payment intent identifiers, amounts, status, and payout references. We do not store card numbers or full card details — our payment processor handles those directly.
• Balance-capture data. For bookings that use the full-payment escrow model (Terms Section 6), we record the payment-method identifier the Customer authorizes for the scheduled balance capture, the capture date, the amount, and the capture status (scheduled, captured, failing, waived, force-cancelled). The card details themselves stay with our payment processor; we hold only the processor’s tokenized reference.
• Standing-ledger flags. Trust-and-safety flags recorded against your account — for example a payment_unresolved flag set when a balance capture reaches the escalation ladder’s default-cancel outcome (Terms Section 6). Each flag carries a set-at timestamp, an expiry, the source booking, and any clearing event.
• Content you post. Portfolio photos, package descriptions, feed posts, comments, reviews, dispute submissions.
• Device & usage data. IP address, user-agent, session identifiers, push-notification tokens, PWA install signals, page and event telemetry.
• Location (approximate). City-level location for browse and matching. We do not track precise geolocation.

• Operate the marketplace, bookings, escrow, and chat.
• Verify Vendor identity and prevent fraud.
• Compute confidence scores and flag abusive patterns.
• Send transactional notifications (in-app, push, and email) about bookings, payments, disputes, and account activity.
• Enforce these policies and resolve disputes based on the Agreement.
• Improve the Platform — measure feature adoption, debug errors, tune performance.
• Comply with legal, tax, and regulatory obligations.

We rely on the following bases under the Data Privacy Act and its IRR:

• Contract. To provide the Platform and fulfill the Terms & Conditions you agreed to.
• Consent. For marketing communications, push notifications, and optional features. You can withdraw consent at any time.
• Legal obligation. For tax reporting, anti-money-laundering checks, and lawful-request responses.
• Legitimate interest. For fraud prevention, security, and Platform integrity, where your rights do not override.

We do not sell your data. We share it only with parties we need to run the Platform:

• Other users, as required by the booking. A Customer sees a Vendor’s public profile and verification badges; a Vendor sees the Customer’s name and contact details once a booking is accepted.
• Payment processor. A licensed payment service provider processes card charges, holds escrow, executes the scheduled balance captures described in Terms Section 6, and disburses payouts. We share only the payment details necessary to complete each transaction, including the tokenized payment-method reference used to run the balance capture.
• Subprocessors. Reputable third-party providers for cloud hosting, database, transactional email, push-notification delivery, analytics, and error tracking. Each is bound by data-processing agreements and is chosen for compliance with recognized security standards (e.g., SOC 2, ISO 27001, PCI DSS as applicable).
• Law enforcement or regulators. When we receive a valid legal request or must protect the safety of users or the public.
• In a business transfer. If Gigspact is acquired or merges, personal data may transfer, subject to this policy.

• Account data: while your account is active, plus up to 24 months after closure for dispute defense and audit.
• Booking, Agreement, and financial records: at least 10 years, as required by Philippine tax and anti-money-laundering rules.
• Chat messages: retained for the life of the booking and for the dispute window that follows, then archived.
• Verification documents: kept only as long as needed to prove verification, then encrypted-at-rest and access-restricted.
• Server logs and telemetry: 90 days by default, longer for security-incident investigation.
• Standing-ledger flags (e.g. payment_unresolved): retained for the flag’s duration — six months from the triggering event, per Terms Section 6 — then archived. Cleared earlier if the Customer settles the outstanding balance with the affected Vendor and both parties confirm in-app.
• Stored payment-method mandates for balance capture: kept for the life of the booking that authorized them, then revoked. The processor’s underlying token is deleted on our side once the booking terminally resolves (captured, waived, cancelled, or refunded).

Under the Data Privacy Act you have the right to:

• Be informed about how we process your data.
• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Object to processing, or withdraw consent for marketing and optional features.
• Erasure or blocking of data that is unlawful, outdated, or no longer necessary — subject to our legal-retention obligations.
• Data portability in a common electronic format.
• Damages if you suffer harm from a data-processing violation.
• Lodge a complaint with the National Privacy Commission at privacy.gov.ph.

To exercise any of these rights, email dpo@gigspact.com. We respond within 15 working days.

• Sign-in is passwordless (one-time codes only) — we never store, hash, or handle a password. Sensitive fields (verification documents, payment references) are encrypted at rest.
• Payment card data never touches Gigspact servers — our payment processor is PCI-DSS compliant.
• Access to production systems is limited, logged, and reviewed.
• Verification documents are stored with restricted access and purged from operational systems after review.
• We run rate limiting, abuse-cluster detection, and manual review of high-risk activity.

No system is perfectly secure. If we discover a breach that materially affects you, we will notify you and the National Privacy Commission within 72 hours, as required by law.

We use only the cookies our own servers need to keep you signed in and protect your account. No advertising cookies, no cross-site trackers, no third-party analytics, no device fingerprinting, no session recording.

The three cookies we set are all first-party and strictly necessary. They live on gigspact.com only and are never shared with anyone else:

• Session cookie. A signed token that identifies your account to our server after you sign in. Contains only your user id and role (Customer, Vendor, or admin). HttpOnly (JavaScript can’t read it), Secure (HTTPS only in production), SameSite=Lax (browsers won’t send it on cross-site requests). Cleared automatically after 30 days or the moment you sign out.
• CSRF-protection cookie. A random opaque number that protects sign-in forms from cross-site request forgery attacks. Contains no personal data. Cleared when the sign-in flow completes.
• Return-URL cookie. Remembers which page you were on before signing in, so we can return you there afterward. Cleared right after the redirect.

We do not read or write browser localStorage, sessionStorage, or IndexedDB for tracking. We do not integrate third-party analytics libraries (Google Analytics, PostHog, Mixpanel, or similar) and we do not embed advertising or tracking pixels. When you sign out, we send a Clear-Site-Data response header so your browser purges cookies, storage, and cache for this origin in one step.

Because all three cookies are strictly necessary for the service to function, no consent banner is required under the Data Privacy Act or the EU ePrivacy Directive. We keep it that way on purpose — a signup flow shouldn’t need six checkboxes to work.

Some of our subprocessors operate outside the Philippines. When we transfer personal data abroad, we do so under contractual safeguards required by the Data Privacy Act, and we keep the transfer to the minimum necessary to run the Platform.

The Platform is not directed at people under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has an account, email dpo@gigspact.com and we will remove it.

We may update this policy from time to time. Material changes will be announced in-app or by email at least 14 days before they take effect. The date at the top of this page always reflects the latest effective version.