Privacy Policy

1. What we collect

• Account info: name, email, phone, role (buyer / fabricator / contractor).
• Verification documents: DTI cert, PCAB licence, business permit, TIN. Stored encrypted.
• Transaction data: RFQs, bids, contracts, escrow ledger entries, reviews.
• Uploaded files: CAD drawings, photos, dispute evidence — virus-scanned on upload.
• Technical: IP, user-agent, audit-log timestamps. No third-party trackers.

2. How we use it

• Run the Platform: match bids to RFQs, gate construction projects by PCAB class, escrow the funds.
• Verify identity (KYC) and licence validity (DTI / PCAB / insurance).
• Generate invoices, BIR-compliant receipts, and audit trails.
• Send transactional notifications: bid awarded, milestone approved, dispute filed, etc.
• Improve the Platform — aggregated, anonymised analytics only.

3. Who we share with

• The other transaction party (buyer ↔ vendor) sees what's needed to complete the deal.
• Payment processors (PayMongo, Maya Business) for charging and refunds.
• SMS provider (Semaphore) for OTP and order updates.
• Cloud storage (DigitalOcean Spaces) for file uploads.
• Government agencies when required by Philippine law (BIR, DTI, etc.).
• We do not sell your personal data to advertisers.

4. Reviews are anonymised

Public reviews show only your initial + region (e.g. J***z · NCR), never your full name or email.

5. Data retention

• Audit logs are append-only; we keep them for 5 years (BIR / commercial-records best practice).
• Closed-account profile data is anonymised within 90 days of closure.
• Uploaded files are deleted 30 days after the related contract is closed or disputed-resolved.

6. Your rights (Data Privacy Act of 2012)

• Access — request a copy of what we hold on you.
• Rectify — correct inaccurate data via your profile or by emailing us.
• Erasure — close your account; subject to retention rules above for active disputes.
• Object — opt out of non-transactional communications.
• File a complaint with the National Privacy Commission (privacy.gov.ph).

7. Security

Passwords are hashed (bcrypt). All traffic is TLS-encrypted. Uploaded files are virus-scanned. Audit logs scrub passwords and tokens before persistence.

8. Contact

Privacy questions? Email privacy@bidfabricate.com.