Privacy Policy

1. What we collect

• Your identity, from Google. Signing in hands us the name, email address and profile picture on your Google account. We never see your Google password.
• Your profile. A display name, a phone number and a picture, if you change what Google gave us.
• Your addresses. The addresses you save, including region and city, which is what decides the venues you are shown.
• Your bookings. Which venue and court, when, what it cost, whether it was confirmed, moved or cancelled, and what you told us about a payment you sent.
• Technical records. Ordinary server and security logs, which include an IP address.

2. Cookies

BooqaPlace sets two kinds of cookie and neither one follows you around the internet:

• Sign-in cookies, which keep you signed in and are refreshed on each request. Deleting them signs you out.
• Your chosen city, kept for a year in a cookie named booqaplace_city so that a visitor who has not signed in is not asked for their city on every visit.
• Analytics cookies, set by Google Analytics under names beginning _ga. They tell a returning visitor from a new one, so that ten visits from you are not counted as ten people. They are Google's cookies, set on this site.

We use no advertising cookies, and nothing here is set in order to follow you around other websites. Counting visitors is measurement rather than marketing, which is why you are not stopped by a consent banner on the way in. If you would rather not be counted, Google publishes a browser add-on that switches Analytics off on every site, and blocking cookies for this site does the same thing here.

3. Analytics

We use Vercel Analytics to count page views and Vercel Speed Insights to measure how quickly pages loaded for real visitors. Neither sets a cookie, and neither identifies you or follows you to other sites.

We also use Google Analytics, which is different in kind and worth spelling out. It sends Google the pages you open here, your IP address, your rough location and the site or search that sent you, together with the cookies described above. We read it to learn which pages people arrive on and where a booking gets abandoned, so we know what to fix next.

Google's advertising features are switched off on our property, so what it records here is not used to build an advertising profile of you, and we never send it your name, email address or phone number. What Google does with the data in its own right is governed by Google's privacy policy rather than this one.

4. Location

BooqaPlace never asks for your location on its own. If you press the button that finds your city, your browser asks your permission, and your coordinates are sent from your browser to BigDataCloud, a reverse-geocoding service, which turns them into a city and a region.

Only the place names reach us. Your coordinates are not sent to our servers and are not stored. What we receive is the same city you could have picked from the list yourself.

5. Maps

A venue's page embeds a Google map. Loading it tells Google that a browser at your IP address requested a map of that place, under Google's own terms and privacy policy rather than ours.

6. What we do with it

• To create your account and keep you signed in.
• To make, confirm, move and cancel bookings, which is the contract you asked us to help you enter.
• To send booking notifications by email and in the app. These follow the bookings you made and are not marketing.
• To take and reconcile payment, including our fee.
• To keep the service safe and working, and to investigate fraud and abuse.
• To meet accounting, tax and regulatory obligations we cannot decline.

The legal grounds are your contract with us, our legitimate interests in running a safe service, our legal obligations, and your consent where you gave it, such as for browser location.

7. Who else sees it

• The venue you book with. They receive your name, your phone number and the details of your booking, because they cannot confirm or run the slot otherwise. They are a separate controller of what they then do with it, and are bound by our Merchant Agreement.
• Supabase, which hosts our database, sign-in and file storage.
• Vercel, which hosts and serves the site.
• PayMongo, which processes card and wallet payments made through the app.
• Hostinger, which hosts our mailboxes and delivers our email.
• Google, for sign-in, for the maps on venue pages and for analytics.
• Government agencies and courts, where we are legally required to hand something over.

We do not sell personal data and we do not share it for anybody else's advertising.

8. Data leaving the Philippines

Some of the services above run on servers outside the Philippines. We remain accountable for your data when it is with them, and require them by contract to protect it to the standard the Data Privacy Act expects.

9. How long we keep it

Booking and payment records are kept for retention period, to be set against BIR record-keeping rules. Your profile and addresses are kept while your account is open. Closing your account removes your profile and addresses; booking records are retained where accounting rules require it, and are then disconnected from your account.

10. Your rights

Under the Data Privacy Act you may:

• be told what we hold about you, and ask for a copy;
• have anything inaccurate corrected;
• object to processing, or withdraw a consent you gave;
• ask us to erase or block data we no longer have grounds to keep;
• ask for your data in a portable form;
• be told if a breach puts you at risk;
• claim damages, and complain to the National Privacy Commission.

Ask through the contact form or at privacy contact address. We answer within number of days, and we may need to confirm who you are first.

11. Keeping it safe

Sign-in is handled by Supabase and every request to our API is verified against it. Database rows are protected by row-level security, so an account can only read what belongs to it. Traffic is encrypted in transit. No system is perfect, and if a breach is likely to harm you we will notify you and the National Privacy Commission as the law requires.

12. Children

BooqaPlace is not for people under 18, and we do not knowingly collect their data. If a minor's data has reached us, write to us and we will remove it.

13. Our Data Protection Officer

Name, title and contact details of the Data Protection Officer, and the NPC registration number once the processing system is registered.

14. Changes

We will post a changed policy here and update the date at the top. A change that materially affects you will be announced in the app before it takes effect.