Privacy Policy

Smart Comfy Tour
Effective date: November 11, 2026
Last updated: November 11, 2026

Smart Comfy Tour ("the app", "we", "us") helps people discover and book places to stay, eat and explore in Catanduanes. This policy explains what personal information we collect, why, who can see it, and the choices you have. It covers the Smart Comfy Tour mobile app and the website at smartcomfytour.com.

We follow the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

1. Who we are

Smart Comfy Tour is operated by Catanduanes Provincial Tourism Office, with address at Virac, Catanduanes, Philippines. We are the personal information controller for the information described in this policy.

Email: privacy@smartcomfytour.com

2. Information we collect

2.1 When you create an account

• Name (first and last) and email address.
• Password — stored only in hashed form by our authentication provider; we never see it.
• If you sign in with Google: your name, email address and Google profile picture, as shared by Google.
• Account type — traveler or business.
• Profile picture, if you add one.

2.2 When you book or order

• Contact name and mobile number for the booking.
• Booking details — dates, number of guests, party size, items, notes you write, and a delivery address if you choose delivery.
• Payment details you give us: the payment method you chose (cash, GCash, Maya, InstaPay or bank), the reference number and/or a receipt screenshot. We do not collect card numbers, e-wallet PINs or bank passwords, and we do not process payments ourselves.

2.3 When you review, save or complain

• Reviews — star ratings, criteria scores and comments.
• Saved places — businesses you saved with ♥.
• Complaints — the topic, title, details, what you would like to happen, and any photos you attach.

2.4 If you register a business

• Business name, categories, description, photos, amenities, opening hours, policies, FAQs, address and map location, and contact details (phone, email, website, social media).
• Permits you upload (business permit, sanitation permit, DOT accreditation) and their expiry dates.
• Payment accounts you add for guests to pay you (account name, account number, QR code image).

2.5 Collected automatically

• Device push token and platform (Android or iOS), so we can send notifications.
• App activity — a single record per day that you opened the app or website, used to count active users. We do not track which screens you view.
• Business page visits — when you open a business's page we record one visit per business per day and where you came from (for example Explore or Search), so the business can see how many people found it. You're stored only as a scrambled code (a hash) of your account, or of a random ID kept in the app or your browser if you're not signed in. Businesses only ever see totals; visits by the business itself, other businesses and the tourism office aren't counted.
• Location — only when you use Nearby businesses or set a business's map pin with I'm here now, and only if you allow it. Your location is used to find nearby places at that moment; we do not store your location history.
• Technical logs kept by our service providers (for example IP address, time of request and errors) for security and troubleshooting.

2.6 Stored only on your device

• Your sign-in session, a copy of your basic profile, your appearance setting (light or dark), and the last mobile number you used at checkout (to fill it in next time). Signing out or uninstalling the app removes these.
• On the website: sign-in cookies (needed to keep you signed in), your appearance setting, recent searches, and a random browser ID used only to count business page visits. These stay in your browser; clearing your browser data removes them. We don't use advertising or analytics cookies.

We do not use advertising trackers, and we do not sell your personal information.

3. Why we use your information

4. Who can see your information

• Other travelers and the public see your reviews with your first name and last initial (e.g. "Maria S."). Your email, phone and full name are never shown publicly.
• The business you book with sees your contact name, mobile number, booking details, notes, delivery address, and the payment reference and receipt you sent. If you file a complaint about them, they see your name, the complaint and its photos.
• The Catanduanes tourism office (authorized staff) sees bookings for tourism statistics and oversight, without your mobile number, delivery address or payment receipts. They see complaints (including photos) to resolve them, and they can hide reviews that break the rules. Their actions are recorded in an audit log.
• Businesses' information you see in the app (name, photos, address, contact details, prices) is published by the business for the public.

We may also disclose information when required by law, a court order, or a lawful request from government authorities, or to protect someone's life or safety.

5. Where your information is stored

Our service providers may store and process information on servers outside the Philippines (our database and website servers are in Singapore). When this happens we make sure the information stays protected as required by the Data Privacy Act.

6. How long we keep it

After these periods we delete the information or make it anonymous.

7. How we protect it

• Data is sent over encrypted connections (HTTPS).
• Access rules in our database let each person see only what they are allowed to: you see your own bookings; a business sees only bookings and complaints about it; payment receipts and complaint photos are in private storage.
• Passwords are hashed; staff cannot read them.
• Office actions on businesses, reviews and complaints are recorded in an audit log.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the National Privacy Commission as the law requires.

8. Your rights

Under the Data Privacy Act you have the right to:

• Be informed about how your information is used (this policy).
• Access your personal information and get a copy.
• Correct inaccurate information. You can edit your name and photo in Profile.
• Object to processing, and withdraw consent — for example, turn off notifications or location in your device settings.
• Erasure or blocking — ask us to delete your account and information.
• Data portability — get your information in a commonly used format.
• Damages if you are harmed by inaccurate, unlawfully obtained or misused information.
• Lodge a complaint with the National Privacy Commission (privacy.gov.ph).

To use any of these rights, email privacy@smartcomfytour.com from the email address on your account. We will reply within 15 working days.

Deleting your account

Go to Profile → Delete account (businesses: menu → My account → Delete account). You'll see exactly what will happen before you confirm.

• Deleted right away: your profile, name, email and photo; saved places; notifications and device tokens; your reviews; your reports and their photos.
• Kept, without your details: bookings you made stay in the business's records (for their accounting and tax obligations) with your name replaced by "Deleted account" and your phone number, notes and delivery address removed. Payment receipts you sent stay with the business for the periods in section 6.
• Businesses: a business with no bookings is deleted with its listings, photos, permits and payment accounts. A business with booking history is hidden from travelers and unlinked from your account; its permits are deleted and its payment accounts turned off.
• You can't delete your account while a booking is still waiting for confirmation or is confirmed and hasn't happened yet. Cancel or finish it first.

If you can't sign in, email privacy@smartcomfytour.com from your account's email address with the subject "Delete my account".

9. Children

Smart Comfy Tour is meant for people 18 and older. Younger travelers should book through a parent or guardian. We do not knowingly collect information from children under 18; if you believe a child has given us information, contact us and we will delete it.

10. Device permissions

You can change these at any time in your device settings.

11. Changes to this policy

We may update this policy. If the changes are significant we will tell you in the app before they take effect. The "Last updated" date above shows the latest version.

12. Contact us

Email: privacy@smartcomfytour.com