Privacy Policy

Last updated: 2 August 2026

Balik Ka is a digital loyalty platform for local businesses in the Philippines. This policy explains what personal information we collect, why we collect it, who can see it, and what you can ask us to do with it.

We are committed to handling your information in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173).

Registered business name: [registered business name pending] Business address: [business address pending] Data Protection Officer: [data protection officer pending] Contact email: hello@balikka.com

1. Who is responsible for your information

Balik Ka operates the mobile app and the platform behind it. We are the personal information controller for the account you create with us.

The cafés and businesses whose loyalty programmes you join are separate controllers for the information they see about their own customers. When you join a business's loyalty programme, you are choosing to share certain information with that business. Section 4 sets out exactly what they can see.

2. What we collect

Information you give us

Information created as you use the app

• Loyalty activity. Each time a stamp is issued or a reward redeemed, we record which business and branch, the type of transaction, the number of stamps or points, the purchase amount if the staff member entered one, the date and time, and which staff member performed it.
• Membership records. Which loyalty programmes you have joined, your current balances, and your membership code.
• Device information for notifications. If you allow notifications, we store a push token, whether the device is iOS or Android, and a device identifier. This is used only to deliver notifications to your device.
• Notification preferences. Which kinds of messages you have chosen to receive.

What we do not collect

We want to be specific, because many apps do collect these and we do not:

• We do not track your location. The app does not request or store your GPS position. Café addresses are stored so you can find them; your own whereabouts are not recorded.
• We do not collect payment card details from customers. Using a loyalty card is free. Businesses pay us separately.
• We do not read your contacts, photos, or messages. The app asks for camera access to scan a code, and photo access only if you choose to upload a profile picture.
• We do not sell your information to anyone, ever.

3. Why we collect it, and on what basis

Marketing messages are opt-in. We do not send promotional messages unless you have specifically agreed, per business. You can withdraw that consent at any time in the app, and it takes effect immediately.

4. Who can see your information

The businesses whose programmes you join

Only businesses you have joined can see you, and only within their own café — a business can never see your activity at another business.

What a staff member at the counter can see:

• Your first name
• Your current balance and whether a reward is ready

What an owner or manager can additionally see:

• Your full name, email address and profile photo
• Your visit history and balances with that business

We deliberately limit counter staff to a first name. They need to serve you correctly, not to hold a list of customer contact details.

Service providers

We use third parties to run the platform:

• Supabase — database and account hosting
• Expo — delivery of push notifications
• An email provider for account and service emails

They process information only on our instructions and only to provide these services.

Others

We may disclose information if required by law, a court order, or a lawful request from a government authority, and to protect the rights or safety of our users or the public.

We do not sell your personal information.

5. How long we keep it

• Your account information — for as long as your account exists.
• Loyalty transaction records — retained while your membership is active, and afterwards for as long as needed for accounting, tax and dispute-resolution purposes.
• Push notification tokens — deleted when you sign out or turn off notifications.

When you ask us to delete your account, we remove your personal information within 30 days. Some records may be retained where the law requires it, or in a form that no longer identifies you.

6. Your rights under the Data Privacy Act

You have the right to:

• Be informed — know what we hold about you and why.
• Access — request a copy of your personal information.
• Correct — have inaccurate or incomplete information fixed. Your name, mobile number and birthday can be edited in the app at any time.
• Object — refuse the processing of your information, including withdrawing consent to marketing.
• Erasure or blocking — ask us to remove your information where there is no lawful reason for us to keep it.
• Data portability — receive your information in a commonly used electronic format.
• Damages — be compensated for harm caused by inaccurate, unlawfully obtained or unauthorised use of your information.

To exercise any of these rights, email hello@balikka.com. We will respond within 15 working days.

If you believe your rights have been violated, you may complain to the National Privacy Commission at privacy.gov.ph.

7. Deleting your account

You can request deletion at any time:

• In the app, under Profile → Delete account, or
• By emailing hello@balikka.com from your registered address

Deleting your account removes your profile, your loyalty cards and balances, and your notification settings. Any unused stamps or rewards will be lost and cannot be restored. We will confirm by email once it is done.

8. How we protect your information

• Passwords are stored encrypted and are never readable by us or by any business.
• Access is restricted at the database level, so a business can only ever reach its own customers' records. This is enforced by the system, not by policy alone.
• Administrator accounts require two-factor authentication.
• Sign-in credentials are held in your device's secure storage.

No system is perfectly secure. If a breach occurs that puts you at real risk of serious harm, we will notify you and the National Privacy Commission as the Data Privacy Act requires.

9. Children

Balik Ka is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will delete it.

10. Changes to this policy

If we change this policy in a way that materially affects you, we will notify you in the app or by email before it takes effect. The date at the top shows when it was last revised.

11. Contact us

Email: hello@balikka.com

Data Protection Officer: [data protection officer pending]

Address: [business address pending]