Privacy Policy

1. Data Controller Identity

RentFlow operates as the Personal Information Controller (PIC) for data collected directly through account registration and platform use. Property owners who collect and process their tenants' personal data through RentFlow operate as Personal Information Controllers in their own right and are responsible for ensuring their data processing practices comply with RA 10173. RentFlow, in processing such data on their behalf, acts as a Personal Information Processor (PIP).

2. Categories of Personal Data Collected

We collect the following categories of personal data:

• Account data: Name, email address, organization name, password (stored as a one-way hash), IP address at registration.
• Property & tenant data (entered by landlords): Tenant names, contact numbers, email addresses, move-in/move-out dates, rental contract terms, payment history, and security deposit records.
• Financial data: Invoice amounts, utility readings, payment receipts, and penalty records — as entered by the subscribing organization.
• Usage & technical data: Login timestamps, browser user agent, session data, and in-platform activity logs for security and audit purposes.
• Consent records: Timestamp, IP address, and policy version accepted at registration or re-consent, in compliance with RA 10173 Section 13.

3. Purpose & Legal Basis for Processing

We process personal data for the following purposes:

• Providing and operating the property management platform (contractual necessity).
• Generating invoices, receipts, contracts, and utility calculations on behalf of subscribing landlords.
• Security monitoring, fraud prevention, and platform integrity (legitimate interest).
• Compliance with legal obligations, including audit trail requirements.
• Sending critical service notifications (transactional email only; no marketing without separate opt-in).

The legal bases for processing under RA 10173 are: (a) consent of the data subject; (b) fulfillment of a contract to which the data subject is a party; and (c) compliance with a legal obligation.

4. Multi-Tenant Data Isolation

All property records, tenant registries, billing data, and documents are strictly isolated within your organization's partition using database-level tenancy controls. No other landlord, manager, or third party can view, access, query, or export your data. Platform super administrators may access organization data solely for the purpose of resolving support issues and do so only with appropriate access logs recorded.

5. Data Retention

We retain account and transactional data for the duration of your active subscription plus 30 days after account termination, to allow data export. Financial and audit records may be retained for up to 5 years in accordance with applicable Philippine tax and commercial record-keeping requirements. Inactive accounts (no login for 24 months) will be notified and scheduled for deletion unless renewed.

6. Third-Party Sharing

We do not sell, rent, or share your personal data with third-party advertisers or data brokers. We engage the following categories of data processors under appropriate data processing agreements:

• Cloud infrastructure: Servers hosted with reputable cloud providers (data stored within the Philippines or equivalent-protection jurisdictions).
• Transactional email: Email delivery services for verification, invoices, and critical notifications.
• Payment processors: If online payment features are used, card and payment data is processed by PCI-DSS compliant providers and is never stored on our servers.

We require all processors to maintain security standards commensurate with RA 10173 and to process data only on our documented instructions.

7. Data Subject Rights (RA 10173, Chapter IV)

As a data subject, you have the following rights under RA 10173:

• Right to be informed: You have the right to know how your data is being collected and processed, as described in this policy.
• Right to access: You may request a copy of the personal data we hold about you via the platform settings or by contacting support.
• Right to correction: You may update inaccurate or incomplete data through your profile and organization settings.
• Right to erasure: You may request deletion of your account and associated data, subject to our retention obligations.
• Right to data portability: You may request an export of your data in a structured, commonly used format.
• Right to object: You may object to certain processing activities, including direct marketing.
• Right to file a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) at privacy.gov.ph if you believe your rights have been violated.

8. Cookies & Session Data

We use essential session cookies required for authentication and security (CSRF protection). We do not use third-party advertising, tracking, or analytics cookies. Session data is encrypted and stored server-side. You may configure your browser to block cookies, but this will prevent you from logging in to the platform.

9. Security Measures

We implement the following security controls in compliance with RA 10173 Section 20:

• Passwords stored using industry-standard one-way hashing (bcrypt).
• All data in transit encrypted via TLS 1.2 or higher.
• Database-level multi-tenant isolation preventing cross-organization data access.
• Full audit trail of all sensitive operations including login, data modification, and financial records.
• Regular automated database backups with point-in-time recovery capability.
• Access to production systems restricted to authorized personnel with appropriate logging.

In the event of a personal data breach that is likely to give rise to a risk to your rights and freedoms, we will notify the NPC within 72 hours of discovery and notify affected data subjects without undue delay, as required by RA 10173 and NPC Circular 16-03.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date and version above. For material changes, active subscribers will be notified via email and prompted to review and accept the updated policy on their next login. Continued use of the platform constitutes acceptance of the revised policy.

11. Contact & Complaints

For data privacy inquiries or to exercise your data subject rights, contact us via the in-platform support channel or help center. If you are not satisfied with our response, you may escalate to the National Privacy Commission: