Privacy Policy

1. Introduction

Kabayan Connect is a trading name of Spacefor Limited, a company registered in England and Wales (company number 09240617), with its registered office at 77 Sotheby Road, London, N5 2UT, United Kingdom. VAT registration number GB 216 6063 26. Spacefor Limited is registered with the UK Information Commissioner's Office (ICO) under registration number ZC182413 and is the data controller responsible for personal data processed via the Platform.

In this policy, "we," "our," and "us" refer to Spacefor Limited trading as Kabayan Connect. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our website and services (the "Platform").

By using Kabayan Connect, you consent to the data practices described in this policy. If you do not agree with these practices, please do not use our Platform.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, password, and display name when you create an account
• Profile Information: Optional profile details including avatar, bio, and social links
• Event Listings: Event details, descriptions, images, locations, dates, ticket information, and contact details for events you create
• Restaurant/Experience Listings: Business information, descriptions, images, pricing, opening hours, and contact details for listings you create
• Marketplace Listings: Item descriptions, images, pricing, condition, and contact details for items you list for sale
• Housing Listings: Property descriptions, images, pricing, location, and contact details for housing and flatshare listings
• Professional Profiles: Professional qualifications, services offered, contact information, and portfolio details
• Job Postings: Job descriptions, requirements, salary information, and employer contact details
• Kabayan Service Listings: Service descriptions, pricing, availability, and provider contact information
• Recipes: Recipe content, images, ingredients, and preparation instructions you share
• Creator Profiles: Creator information, social media links, content descriptions, and portfolio data
• Reviews & Ratings: Comments, ratings, and images you attach to reviews
• Messages: Content of messages exchanged between users and listing owners through our messaging system
• Activity Posts: Content, images, and videos you share on the activity feed, including mentions of other users
• Contact Form Submissions: Name, email, and message content submitted via our contact page
• Payment Information: Payment details processed through our third-party payment provider (Stripe) for Pro subscriptions, event tickets, and advertising purchases. We do not store your full card details.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, and interactions with our Platform
• Device Information: Browser type, operating system, and device identifiers
• Location Data: General location based on IP address to show relevant local content; precise GPS location when you voluntarily use features like QR check-in or the map view
• Analytics Data: Listing views, engagement metrics, and session identifiers for performance tracking
• Kabayan Points Activity: Check-in history, points earned, rewards redeemed, and loyalty programme participation data

2.3 Two-Factor Authentication

If you enable two-factor authentication (2FA), we store an encrypted version of your TOTP secret. This is used solely for verifying your identity during login and is never shared with third parties.

3. How We Use Your Information

We use your information to:

• Provide and maintain our Platform and services
• Process and display your event, restaurant, marketplace, housing, professional, job, service, recipe, and creator listings
• Enable event registration, ticketing, and RSVP functionality
• Process payments for Kabayan Pro subscriptions, event tickets, and advertising
• Operate the Kabayan Points loyalty programme, including tracking check-ins, awarding points, and processing reward redemptions
• Send transactional and notification emails (see Section 4)
• Provide analytics to listing owners about their listings' performance
• Display events, restaurants, and other listings on our interactive map
• Facilitate messaging between users and listing owners
• Enable the community marketplace for buying and selling items
• Connect users with housing, flatshare, and accommodation opportunities
• Facilitate connections between community members and Filipino professionals, service providers, and employers
• Share and discover Filipino recipes within the community
• Showcase Filipino content creators and their work
• Publish and distribute community news articles
• Personalize your experience with recommendations based on your preferences and activity
• Display relevant advertising on the Platform
• Detect and prevent fraud, spam, and abuse, including rate-limiting and GPS verification for loyalty features
• Comply with legal obligations

4. Email Communications

We send emails from noreply@notifications.kabayanconnect.com using the Resend email service. We send the following types of email communications:

4.1 Authentication Emails

Essential emails for account security that cannot be opted out of:

• Welcome email upon registration
• Email verification
• Password reset links

4.2 Transactional Notifications

Emails triggered by your actions or relevant to your listings and bookings:

• Listing submission confirmations, approvals, and rejections (events, restaurants, marketplace, housing, services, recipes, creators, professionals, and jobs)
• New review notifications for listing owners
• Listing expiry reminders
• Event registration confirmations and reminders
• Event cancellation notices
• Ticket purchase confirmations
• New message notifications
• Kabayan Points milestone achievements
• Reward redemption confirmations and expiry reminders
• Kabayan Pro welcome, cancellation, and renewal reminders
• Mention and follower notifications
• Contact form auto-reply confirmations
• Advertising slot purchase confirmations and expiry reminders

4.3 Email Data

We log email delivery data (recipient address, template used, delivery status, and third-party message IDs) for operational monitoring and troubleshooting. Email logs are retained for up to 12 months.

5. Kabayan Points & Rewards

Our Kabayan Points loyalty programme collects the following data:

• Check-in Records: Date, time, and location of QR code check-ins at participating restaurants
• Points History: Complete record of points earned and spent, including action type and descriptions
• Reward Redemptions: Discount codes generated, reward values, and expiry dates
• GPS Data: When checking in via QR code, your device's GPS location may be collected to verify proximity to the restaurant and prevent abuse
• Streak Data: Visit frequency calculations for bonus point awards

This data is used to operate the programme fairly, prevent abuse, and provide you with an accurate points balance and history.

6. Kabayan Pro Subscription

If you subscribe to Kabayan Pro, we collect and process:

• Subscription Status: Active, cancelled, or expired status and billing cycle dates
• Payment Data: Processed securely via Stripe. We store your Stripe customer ID and subscription ID but never your full payment card details.
• Redemption History: Records of Pro discount usage at participating restaurants, including timestamps and GPS location for verification

7. Community Marketplace & Services

When you use our community features, we collect and process the following:

• Marketplace Listings: Item details, images, pricing, condition, and seller contact information are publicly visible to facilitate transactions between community members
• Housing Listings: Property descriptions, images, pricing, location details, and agent/landlord contact information are publicly visible to help community members find accommodation
• Professional Profiles: Professional qualifications, specialisations, contact details, and service areas are publicly displayed to connect community members with Filipino professionals
• Job Postings: Job descriptions, requirements, salary ranges, and employer details are publicly displayed to help community members find employment
• Kabayan Services: Service descriptions, pricing, availability, and provider contact information are publicly displayed
• Recipes: Recipe content, images, ingredients, ratings, and contributor information are publicly visible
• Creator Profiles: Creator information, social media statistics, content portfolios, and platform links are publicly displayed
• News Articles: Published news content and author information are publicly visible

Contact information provided on these listings is intentionally public to facilitate communication between community members. We do not mediate transactions between buyers and sellers, landlords and tenants, or employers and job seekers.

8. Information Sharing

We do not sell your personal information. We share information only in these circumstances:

• Public Listings: Event, restaurant, marketplace, housing, professional, job, service, recipe, creator, and news content you publish is visible to all users
• Public Profiles: Your display name, avatar, and activity posts are visible to other users
• Contact Information: Contact details on listings are intentionally public to facilitate communication
• Leaderboard: Display names, avatars, and point totals of top Kabayan Points earners are visible on the monthly leaderboard
• Service Providers (Processors): With trusted third-party services to operate our Platform, including:
  • Stripe — payment processing for Pro subscriptions, ticketing, eGifting and advertising
  • Resend — transactional email delivery
  • Mailchimp — newsletter sign-ups and marketing emails (only where you have opted in)
  • Google Maps & Places — location services, transit lookups, and address autocomplete
  • Google AdSense — third-party advertising (see Section 10)
  • Google Analytics & Google Ads — usage analytics and conversion tracking
  • Giftaway.ph — eGifting gift card fulfilment and SMS delivery to Philippine recipients
  • Shopify — discount code generation for Pro/loyalty rewards redeemable at partner retailers
  • YouTube Data API and TikTok oEmbed — importing publicly available creator content where you have provided creator handles
  • Firecrawl — scraping publicly published remittance/Balikbayan rates for our comparison tools (no personal data shared)
  • Supabase — our managed database, authentication and file storage provider (data hosted in the EU/UK)
• Legal Requirements: When required by law or to protect our rights and safety
• Business Transfers: In connection with a merger, acquisition, or sale of assets

9. Messaging & Social Features

Our Platform includes direct messaging and social features:

• Messages: Direct messages are encrypted in your browser using AES-256-GCM before being stored, so message content cannot be read by Kabayan Connect staff or third parties; only the participants in the conversation can decrypt them. Metadata (sender, recipient, timestamp) is stored unencrypted to deliver and display the conversation.
• Activity Feed: Posts, comments, reactions, and mentions are visible to other users on the Platform
• Follows: Your follower and following relationships are stored and may be visible to other users
• Mentions: When you mention another user using @username, that user receives a notification
• Reporting: If you report a message, listing, or post, the reported content and your report may be reviewed by our moderation team.

9a. Newsletter, Analytics & Tracking

We use the following additional services to operate, measure, and improve the Platform:

• Mailchimp Newsletter: If you sign up to our newsletter, your email address is sent to Mailchimp using double opt-in. You can unsubscribe at any time via the link in any newsletter.
• Google Analytics: We use GA to understand how visitors use the Platform (pages viewed, traffic sources, device type). GA may set cookies and collect a truncated IP address.
• Google Ads Conversion Tracking: We measure which marketing campaigns result in sign-ups, ticket purchases, gift card orders, and Pro subscriptions.
• Session Tracking: Anonymous session identifiers are used to count listing views without double-counting and to provide listing owners with analytics.
• Native Mobile Bridge (WebWrap): When you use the Android app, our native bridge exchanges authentication tokens, push notification tokens (FCM), and (with your permission) geolocation data with the web Platform to enable native sign-in, billing, and notifications.

9b. eGifting, Marketplace, Ticketing & Other Transactional Features

In addition to the features described above, the Platform offers the following transactional services. Personal data collected for these features is processed only as necessary to fulfil your order or facilitate the service:

• Event Ticketing & QR Check-in: Buyer name, email, ticket order details, QR code data and check-in timestamps are stored to issue, validate and scan tickets at the venue. Event organisers can see the attendee list for their own events.
• Marketplace & Housing: Listing content and contact details you provide are public to facilitate buyer/seller and landlord/tenant communication. We do not process payment for these transactions.
• Remittance & Balikbayan Comparisons: We display publicly published exchange rates and shipping prices scraped from third-party providers. We do not share your personal data with these providers when you view a comparison.
• Creator Imports: Where a creator profile links public YouTube or TikTok content, we periodically refresh that content via official public APIs. No private creator data is accessed.
• Banner & Native Ads: Listing owners can purchase banner and native ad placements; payment and slot reservation data is stored to fulfil the booking.

10. Advertising

We display advertising on our Platform in two forms:

• Promoted Listings: Listing owners can purchase advertising slots to feature their events or restaurants in prominent positions. We track ad slot purchases, display periods, and payment data.
• Third-Party Advertising: We use Google AdSense, which may use cookies and tracking technologies to serve personalised ads. Please refer to Google's privacy policy for details on how they process data.

11. Cookies & Tracking

We use cookies and similar technologies for:

• Essential Cookies: Authentication, session management, and security
• Analytics Cookies: Understanding how you use our Platform
• Preference Cookies: Remembering your settings such as preferred location, currency, and theme
• Advertising Cookies: Delivered by Google AdSense for personalised advertising

You can manage your cookie preferences through our cookie consent banner. For more details, see our Cookie Policy.

12. Data Retention

We retain your information for as long as your account is active or as needed to provide services:

• Account data is retained until you delete your account
• Event listings are retained until the event date passes or you remove them
• Restaurant listings are retained while active; expired listings are archived
• Marketplace, housing, professional, job, and service listings are retained while active or until removed by the creator
• Recipes and creator profiles are retained until removed by the creator
• News articles are retained indefinitely unless removed by administrators
• Analytics and view tracking data is retained for 2 years
• Email delivery logs are retained for 12 months
• Kabayan Points history is retained for the lifetime of your account
• Reward redemption records are retained for 2 years after expiry
• Messages are retained for the lifetime of the conversation participants' accounts
• Payment records are retained as required by applicable tax and financial regulations
• Rate-limiting data is automatically purged after 1 hour
• We may retain certain data as required by law or for legitimate business purposes

13. Data Security

We implement industry-standard security measures to protect your information:

• Encrypted connections (HTTPS) for all data transmission
• Secure password hashing
• Row-level security policies on database tables
• Encrypted storage of sensitive data such as 2FA secrets
• Rate limiting on sensitive endpoints to prevent brute-force attacks
• Regular security reviews and updates
• Limited access to personal data by authorised personnel only
• Payment processing handled by PCI-DSS compliant providers (Stripe)

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data.

14. Your Rights (UK GDPR / EU GDPR)

Under the UK GDPR, EU GDPR and the Data Protection Act 2018, you have the following rights in relation to personal data we hold about you:

• Right of access: Request a copy of your personal data
• Right to rectification: Update or correct inaccurate information
• Right to erasure ("right to be forgotten"): Request deletion of your account and associated data
• Right to data portability: Receive your data in a portable, machine-readable format
• Right to restrict or object to processing: Including the right to object to direct marketing at any time
• Right to withdraw consent: Where we rely on consent for processing (such as the newsletter)
• Opt-out of emails: You may disable specific transactional email notifications through your account settings. Authentication emails (password resets, email verification) cannot be opted out of for security reasons.
• Opt-out of advertising: Manage personalised ad preferences through Google's ad settings

To exercise these rights, email us at hello@kabayanconnect.com. We will respond within one month.

Right to complain: If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113. Our ICO registration number is ZC182413.

15. International Data Transfers

Kabayan Connect serves Filipino communities worldwide. Your data may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for international transfers in accordance with applicable data protection laws.

16. Children's Privacy

Kabayan Connect is not intended for children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

17. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on our Platform or sending you an email. Your continued use of Kabayan Connect after changes constitutes acceptance of the updated policy.

18. eGifting Gift Cards

When you purchase a digital gift card through our eGifting service, we collect and process additional information solely to fulfil your order:

• Recipient details: The recipient's mobile phone number (Philippines) and optional personalised message, used only to deliver the gift card by SMS.
• Sender details: Your name and email address for order confirmation and receipts.
• Order data: Retailer, denomination, quantity, currency conversion rate (PHP→GBP) applied at checkout, service fee, Pro discount (if applicable), and Stripe payment reference.
• Third parties: Recipient phone numbers and order data are shared with our gift card fulfilment partner (Giftaway.ph) strictly for the purpose of issuing and delivering the gift card. Payment information is processed by Stripe.

Recipient phone numbers are not used for marketing and are retained only as long as needed for delivery, support, and our legal record-keeping obligations.

19. Contact Us & Company Details

For questions about this Privacy Policy, to exercise your data rights, or to contact our data protection lead, please email hello@kabayanconnect.com or write to us at the registered office below.