Data Privacy Policy

1Introduction and Scope

The Crazy Bite Co. ("Crazy Bite," "we," "us," or "our") operates the Crazy Bite online food ordering and delivery web application. We are committed to protecting the privacy, confidentiality, and security of your personal data in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and issuances of the National Privacy Commission (NPC) of the Philippines.

This Privacy Policy applies to all customers, website visitors, registered members, riders, and staff accessing or using our platform. As a Personal Information Controller (PIC) under Philippine law, we uphold the general principles of transparency, legitimate purpose, and proportionality in all processing activities.

2Personal Data Collected

We collect personal information (PI) and, where applicable, sensitive personal information (SPI) strictly necessary to fulfill your orders, provide customer service, and comply with legal requirements.

3Purpose and Legal Basis for Processing

We process personal data based on the following legal grounds provided under the DPA:

4Disclosure and Data Sharing

We do not sell, rent, or trade your personal data. Data is shared only with verified third parties under strict Data Sharing Agreements (DSAs) or Outsourcing Agreements adhering to NPC standards:

1. Delivery Personnel & Riders: Assigned riders receive only the recipient's name, delivery address, landmarks, and contact number necessary to fulfill delivery.
2. Third-Party Infrastructure & Technology Processors:
   • Supabase Inc.: Cloud database, session management, and backend storage. Data is hosted in secure, ISO 27001/SOC 2 Type II certified data centers with end-to-end encryption.
   • PayMongo Payments Inc.: Tokenized payment processing, fraud screening, and financial settlement under BSP regulations, including wallet top-up transactions.
   • Resend Inc.: Transactional email delivery and authentication OTP dispatches.
   • Render Services Inc.: Application hosting, web service execution, and backend routing.
3. Law Enforcement and Regulatory Agencies: Information may be disclosed where required by a valid subpoena, court order, or lawful request from government authorities (e.g., BIR, NPC, Philippine National Police).

5Technical and Organizational Security Measures

To maintain data integrity, confidentiality, and availability, we enforce defense-in-depth security measures:

• Row Level Security (RLS): Database queries are isolated at the database engine level. Customers can only read and write their own profile and order records. Administrative access requires role-based authentication (staff or owner).
• Encryption Standards: All network transmissions are protected using Transport Layer Security (TLS 1.3/HTTPS). Cryptographic webhook signatures (HMAC-SHA256) are validated on all financial notifications, including wallet top-up confirmations.
• Server-Side Financial Enforcement: All order prices, discounts, delivery rates, service fees, and wallet balances are computed and written only by our secure backend server using the service-role key; client-side price or balance overrides are rejected.
• Zero Localized PII Storage: Sensitive customer profiles and transaction records are not maintained in plain text across browser local storage.
• Access Controls & Audit Trails: Administrative operations in the management console are restricted to authorized personnel, with automated logging of status updates, stock adjustments, wallet transactions, and account approvals.

6Data Retention and Disposal

• Active Accounts: Personal data is retained for as long as your account remains active or as needed to provide services.
• Accounting and Tax Records: In compliance with the National Internal Revenue Code (NIRC) and BIR regulations, transaction records, receipts, wallet transaction logs, and order histories are archived for ten (10) years.
• Voice and Audio Streams: Peer-to-peer audio communications during support calls are processed in real time and are not recorded or persisted to persistent disk storage.
• Deleting Your Account: You may delete your account at any time in the app under Profile › Settings › Delete account. Your sign-in, profile, mobile number, saved addresses, reviews, company ID file and notifications are permanently deleted from our systems and cloud storage at once. Order and wallet records that tax regulations require us to keep are retained without your name, contact details, address or notes.
• Disposal: Upon expiration of the required retention period or upon valid request for erasure, digital data is permanently deleted using secure overwrite techniques, and electronic database records are de-identified or anonymized.

7Rights of the Data Subject

Under the Data Privacy Act of 2012, you possess the following rights regarding your personal information:

1. Right to Be Informed: You have the right to know whether your personal data is being processed, the purposes thereof, and the entities to whom it may be disclosed.
2. Right to Access: You may request reasonable access to your personal data, order histories, and profile details held on our platform.
3. Right to Rectification: You have the right to correct any inaccurate, incomplete, or outdated data through your account settings or by contacting us.
4. Right to Erasure or Blocking: You may suspend, withdraw, or order the blocking, removal, or destruction of your personal data from our active systems upon legitimate grounds (e.g., unlawful processing, expired retention).
5. Right to Object: You may object to the processing of your personal data for direct marketing, automated profiling, or processing based solely on legitimate interest.
6. Right to Data Portability: You have the right to obtain an electronic copy of your personal data in a structured, commonly used, and machine-readable format.
7. Right to Damages: You may claim compensation for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data.
8. Right to File a Complaint: If you believe your privacy rights have been violated, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) at complaints@privacy.gov.ph or via their official portal.

8Cookies, Local Data, and Browser Permissions

• Session Storage & Cookies: We use strictly necessary browser storage mechanisms to maintain active authentication sessions, theme preferences, and cart states.
• Revoking Device Permissions: You can enable or disable location and microphone permissions at any time via your browser or operating system settings. Revoking location permission requires manual entry of delivery addresses; revoking microphone access disables voice search and in-app support calling.

9Updates to this Policy

We may revise this Privacy Policy periodically to reflect technological advancements, operational changes, or new regulatory issuances from the NPC. Substantial amendments will be announced through an in-app banner or via email notification prior to implementation. Continued use of the service constitutes acknowledgment of the updated policy.

10Data Protection Officer (DPO) Contact Information

For inquiries, requests for access or deletion, or concerns regarding the processing of your personal information, contact our Data Protection Officer: