Sulpot · Legal
Privacy Policy
How Sulpot collects, uses, stores, and deletes your personal data — and the rights you have over it under the Data Privacy Act of 2012.
- Version
- 1.4
- Effective
- 2026-08-15
Privacy notice at a glance
The full detail is below. This is the short version of what matters most.
| Question | Short answer |
|---|---|
| Who runs Sulpot? | Four Adamson University BSIT students, as a capstone project. Not a company. |
| What is most sensitive? | Your government ID number, ID images, and selfie — if you apply to be a vendor or host. |
| How long do you keep my ID? | The images are deleted after review: straight away if your application is rejected, 15 days after approval if it is approved. What you typed, ID number included, stays until you delete your account. |
| Do you sell my data? | No. Never, to anyone, for any purpose. |
| Do you track me with ads? | No. There are no analytics tools, no advertising, and no tracking pixels of any kind. Sulpot counts how often each profile is viewed, and never records who looked. |
| Where is my data stored? | Supabase, on servers in Mumbai, India. |
| Does Sulpot handle my money? | No. Sulpot never receives, holds, or transfers any payment. |
| Can I delete everything? | Yes — from Settings. You get 30 days to change your mind, then it is permanently erased, uploaded documents included. |
| Who do I contact? | christianvirgiltorres@gmail.com |
1. Who we are
Sulpot is an academic capstone project, not a registered company. It was developed by Christian Virgil Torres, Derone Ligutan, Danielle Angeli Blanco, and John Kerby Basa, students of the Bachelor of Science in Information Technology program at Adamson University, under the supervision of Charlene Vergara.
Sulpot is not incorporated, has no business registration, and does not trade. Nothing on Sulpot is a commercial offering.
For anything in this document, contact the project team at christianvirgiltorres@gmail.com.
Under the Data Privacy Act of 2012 (Republic Act No. 10173), the project team acts as the Personal Information Controller for the data described here.
2. What personal data we collect
We collect only what the application actually needs to work. Everything below corresponds to a real field in the system — nothing is collected speculatively.
| Category | Specific data | When it is collected |
|---|---|---|
| Account | Email address, full name, display name, username, profile photo, cover photo, short bio, social media links | When you sign up and when you edit your profile |
| Sensitive personal information | Government ID type and ID number, image of the front and back of your ID, a photo of you holding your ID, business name and address, contact number, and — for Event Hosts only — either a business permit or the authorisation letter permitting you to hold your event | Only if you apply to become a Pop-Up Vendor or Event Host. The images and documents are deleted after review — see §4 |
| Event | Event titles, descriptions, photos, venue names and addresses, and map coordinates | When you create a pop-up or hosted event |
| Payment-related | For hosts: the account name and number of your GCash, Maya, or bank channel, and your payment QR image. For vendors: the proof-of-payment receipt you upload, its reference number, and the amount | When you add a payment channel or submit proof of payment |
| Messages | The content of direct messages and event-room messages, and who is in each conversation | When you send a message |
| Activity | Events you save, accounts you follow, applications and invitations, notifications, and any abuse reports you file | As you use the application |
| Ratings | The stars and short review you give after an event, the event it was about, and any reply you post to a review of you | When you rate someone or reply to a review |
| Location | Your device's precise location — only if you press the locate button on a map and your browser asks you to allow it | Only on your explicit action; never in the background |
We do not collect
We do not collect your password (Supabase Authentication handles it and we never see it), your payment card details, your device contacts, your browsing history outside Sulpot, or your location in the background.
3. Why we collect it, and our lawful basis
The Data Privacy Act requires us to have a lawful basis for each purpose. Ours are set out below.
| Purpose | Data used | Lawful basis (RA 10173) |
|---|---|---|
| Create and operate your account | Account data | Consent, and necessity for a service you requested (§12(b)) |
| Show your public profile and events to other users | Username, display name, photo, bio, socials, event details | Consent (§12(a)) |
| List the vendors a host has approved for a public event on that event's page, to signed-in users | Username, display name, photo, verification badge | Legitimate interests (§12(f)) — you can switch it off at any time in Settings → Privacy |
| Show ratings after an event: the reviews you write, and the reviews others write about you | Stars, review text, replies; the writer's username, display name and photo, and the event, shown to signed-in users only | Necessity for a service you requested, for reviews you write (§12(b)); legitimate interests, for reviews of you (§12(f)) — you can reply to any review, and report one that breaks the rules |
| Verify that vendors and hosts are real people | Sensitive personal information | Your separate, explicit consent (§13(a)) |
| Keep a record of which ID a verified account was checked against, after the images are deleted — consulted only if the account is reported for impersonation or one person appears to hold more than one verified account | ID type and ID number, and the business details from your application | Your separate, explicit consent (§13(a)) |
| Let vendors and hosts communicate and coordinate | Messages, applications, invitations | Necessity for a service you requested (§12(b)) |
| Let a host confirm that a vendor paid them | Payment channel details, proof-of-payment receipts | Necessity for a service you requested (§12(b)) |
| Send you notifications about your activity | Email address, notification preferences | Consent, withdrawable at any time in Settings (§12(a)) |
| Keep Sulpot safe and handle abuse reports | Report contents, account data | Legitimate interests of the project (§12(f)) |
| Academic evaluation of the capstone project | Aggregate and anonymised usage only — see §9 | Legitimate interests (§12(f)) |
4. Your identity documents — special protection
This is the most sensitive data we hold
Your government ID number, the images of your ID, and your photo holding it are sensitive personal information under RA 10173 §3(l). The law protects these more strictly than ordinary data, and so do we.
Because of that, the following rules apply and are enforced by the system itself, not merely by policy:
- We ask for these only if you choose to apply to become a Pop-Up Vendor or Event Host. You can use Sulpot indefinitely — browsing, saving, and following events — without ever providing them.
- You give a separate, specific consent for them. It is its own checkbox on the verification form, deliberately not bundled into the general Terms you accept at sign-up, so that agreeing to use Sulpot never implies agreeing to hand over identity documents.
- They are stored in a private area, not on the public internet. They have no public web address. Even the review team can only open them through a temporary link that expires after five minutes.
- They are used for one purpose only — confirming you are who you say you are. They are never used for marketing, never shared with other users, never shown on your profile, and never sold.
- The images do not outlive the review. If your application is rejected, your ID images, your photo holding your ID, and any business permit or authorisation letter are deleted the moment the decision is made — you upload new ones if you apply again. If it is approved, they are kept for 15 days, so a reviewer can look again if a question comes up, and are then deleted. What stays is what you typed: your business details, your ID type, and your ID number, for the purpose set out in §3.
- You can withdraw this consent at any time by emailing us, and we will delete the ID details you typed and any images we still hold.
5. How your data is stored and protected
Sulpot is built on Supabase, which provides the database, sign-in, and file storage. Data is encrypted in transit (HTTPS) and encrypted at rest by the hosting provider.
Beyond that baseline, the application is designed so that access rules are enforced by the database rather than by application code:
- Row Level Security on every table. Each record carries a rule about who may read or change it, enforced by the database itself. A bug in the application cannot bypass it.
- No master key in the application. Sulpot deliberately holds no administrative database key. Every operation runs with the permissions of the signed-in person, so there is no all-access credential that could leak.
- Identity documents and payment receipts sit in private storage. They are reachable only through short-lived links that expire after five minutes, and identity images are deleted after review (§4).
- Passwords are never seen by us. Sign-in is handled by Supabase Authentication; the project team has no access to your password.
An honest limitation
Sulpot is a student project, not a hardened commercial platform. It has not undergone independent penetration testing or third-party security certification. We have applied the protections described above in good faith, but you should weigh that context when deciding what to upload. It is also why we delete identity images as soon as the review no longer needs them, rather than keeping them for as long as your account exists.
6. Who can access your data
| Who | What they can see |
|---|---|
| You | Everything in your own account. |
| Other users | Only your public profile — username, display name, photo, bio, social links, verification badge — plus events you publish. If a host approves you as a vendor for a public event, signed-in users can also see your name, username and photo in that event's list of vendors; your application itself is never shown. You can remove yourself from these lists in Settings → Privacy. If you rate someone after an event, anyone, including visitors who are not signed in, can read your stars and review, but only signed-in users see your name, your photo and which event it was about; reviews others write about you appear on your profile the same way. Never your identity documents, email address, or messages you did not send them. |
| Event hosts you apply to | Your application: business name, pitch, product photos, and any proof of payment you submit to them. Not your ID documents. |
| The project team | Administrative access for review and moderation, limited to the four named students. There is currently one administrator account. |
| Charlene Vergara (adviser) | Project supervision. The adviser does not routinely access user data. |
| Service providers | Only what each needs to function — see §7. |
| Law enforcement | Only if we receive a valid legal order under Philippine law. |
We never sell your personal data, and we never share it for advertising.
7. Service providers and international transfers
Sulpot relies on the third-party services below. Each receives only what it needs to perform its function.
| Provider | Purpose | What it receives | Location |
|---|---|---|---|
| Supabase | Database, sign-in, file storage | All account, event, message, and uploaded file data | Mumbai, India |
| Vercel | Application hosting | Technical request data including your IP address | Global edge network |
| Resend | Notification emails | Your email address and the message content | United States |
| “Continue with Google” sign-in | Your sign-in request; Google returns your name, email, and profile photo | Global | |
| CARTO | Map background tiles | Your IP address and which map area you are viewing | Global |
| OpenStreetMap | Address search when creating an event | Your IP address and the address text you type | Europe |
Your data leaves the Philippines
Sulpot's database is hosted in Mumbai, India, and other providers operate internationally. Using Sulpot therefore involves a cross-border transfer of your personal data. Under RA 10173 the project team remains accountable for your data wherever it is processed, and we disclose this so your consent is genuinely informed.
9. How long we keep your data
| Data | Retention period |
|---|---|
| Account and profile | Until you delete your account. |
| Events, messages, applications | Until you delete your account, or until you delete the item. |
| Ratings and reviews | Until the writer withdraws it or deletes their account. A review stays if the event is later cancelled or deleted, because it is the writer's account of what happened. A review removed by an admin is hidden from everyone and kept on record until the account is deleted. |
| ID images, your photo holding your ID, and any business permit or authorisation letter — rejected application | Deleted as soon as the application is rejected. |
| The same files — approved application | 15 days after approval, then deleted. |
| What you typed when applying — business details, ID type, and ID number | Until you delete your account or withdraw consent. |
| Deactivated accounts awaiting deletion | 30 days, then permanently erased. |
| All personal data, at project close | Deleted within 30 days of the capstone concluding — see below. |
What happens when the capstone ends
Sulpot exists to fulfil an academic requirement. Whether it continues afterwards has not yet been decided. If the project is concluded and shut down, all personal data — including every uploaded document — will be deleted within 30 days, and only anonymised, aggregate statistics that cannot identify any individual will be retained for the academic report. If instead the project continues in any form, we will notify registered users by email before any change to this policy takes effect. This will be reviewed no later than 31 December 2026.
10. Your rights over your data
The Data Privacy Act of 2012 gives you the following rights. We will not charge you for exercising any of them.
| Right | What it means | How to use it |
|---|---|---|
| To be informed | To know that we hold your data and why. | This document. Ask us for anything it does not answer. |
| To access | To obtain a copy of the personal data we hold about you. | Email christianvirgiltorres@gmail.com. We respond within 15 working days. |
| To rectify | To correct anything inaccurate or incomplete. | Edit it directly in Settings, or email us. |
| To erasure or blocking | To have your data removed. | Delete your account in Settings, or email us. |
| To object | To refuse a particular processing, including notifications. | Turn notifications off in Settings, or email us. |
| To data portability | To receive your data in a portable electronic format. | Email christianvirgiltorres@gmail.com. |
| To damages | To be compensated for harm caused by misuse of your data. | Through the National Privacy Commission or the courts. |
| To complain | To escalate beyond us. | See §13. |
11. Deleting or correcting your data
To correct your data, open Settings and edit your profile. For anything you cannot change yourself, email us and we will correct it within 15 working days.
To delete your account, go to Settings and choose to delete. What happens then:
- Immediately — your account is deactivated. Your profile, events, and pop-ups stop appearing anywhere on Sulpot to anyone.
- For 30 days — nothing is erased. Log back in at any point in that window and everything is restored exactly as it was.
- After 30 days — permanent erasure. Your account, profile, events, applications, messages, bookmarks, and every file you uploaded — identity documents, business permits, and payment receipts included — are destroyed and cannot be recovered.
You may also ask us to delete only your verification details while keeping your account — the ID type and number you typed, and any images we still hold — which withdraws your sensitive-data consent. Email us and we will do it within 15 working days.
What survives deletion, and why
Messages you sent to other people remain visible to those recipients, shown as coming from a deleted account — we cannot reach into another person's inbox and rewrite their conversation history. Anonymised statistics that cannot identify you (for example, “the platform hosted 40 events”) may be retained for the academic report.
12. Age requirement
Sulpot is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, email us and we will delete it and its data promptly.
13. Contact and complaints
Start with us. Email christianvirgiltorres@gmail.com with any privacy question, request, or complaint. We will acknowledge within 5 working days and respond substantively within 15.
Escalate to the regulator. You always have the right to complain directly to the National Privacy Commission, the independent body enforcing the Data Privacy Act. Their website is privacy.gov.ph, which lists their current contact details and complaint procedure.
14. Changes to this policy
If we change this policy we will update the version and effective date at the top. For any change that materially affects your rights or how we use your data, we will notify registered users by email before it takes effect, and where the law requires it we will ask for your consent again.