Privacy Policy
Last updated: 2026-10-31
Draft
This policy explains how OrbitPass handles personal data, in line with the Philippine Data Privacy Act of 2012 (RA 10173). Policy version: 2026-10-31.
If you are a loyalty member
The business whose card you joined is the controller of your data. OrbitPass is the processor that stores and processes it for them.
- What we collect: first name, mobile number, optional birthday (month and day), your stamps, visits and rewards, and your consent choices with a timestamp.
- Why: to run your stamp card, show it in your wallet, and — only if you opted in — send offers from that business.
- Marketing is optional. You can turn it off anytime from your card page. Service messages (like “stamp added” or “reward ready”) are part of the card itself.
- Who sees it: the business's owners and managers. Staff see a masked phone number. Apple or Google receive the card content if you add it to their wallet.
- Your rights: you can ask to access, correct, or delete your data. Ask the business at the counter or email support@orbitpassph.com.
If you run a business on OrbitPass
- We collect your account details (name, email), business details, and billing records.
- We don't store card numbers or e-wallet credentials. Payments are handled by our payment provider.
- If your subscription expires, your business data is deleted 60 days later.
- Images you upload (logo, stamp icons and shapes, backgrounds) are checked for harmful content by OpenAI's moderation service in the United States, and a person on our team may review them. Only the image is sent, not your account or customer details. Images that aren't approved are deleted.
Service providers
We use trusted providers to run OrbitPass: database and file hosting, email delivery, payment processing, Apple Wallet and Google Wallet, and OpenAI for image screening. Some of them process data outside the Philippines. They may only use it to provide their service to us.
Security
Each business's data is isolated at the database level. Access is logged, admin access requires two-step verification, and data is encrypted in transit.
Retention
We keep member data while the business is active. Delivery and system logs are deleted after 90 days.
Contact
Data protection questions: support@orbitpassph.com