Privacy Policy

Last updated 30 September 2026

chacha is a delivery service for Sablayan, Occidental Mindoro, operated by Apoio Labs. This page explains what we collect when you use chacha as a customer, a rider or a store owner, why we need it, who can see it, and how long we keep it. We follow the Data Privacy Act of 2012 (Republic Act No. 10173).

Questions or requests about your data: chacha@apoiolabs.com.

What we collect

Everyone with an account

Your name, mobile number and email address.
If you sign in with Google: your name and email address from your Google account. We never see your Google password.
A profile photo, if you add one.
Your push notification subscription, if you turn notifications on.

Customers

An identity check: one photo of you holding a valid ID, before your first order. We delete this photo as soon as it has been reviewed, whether it was approved or not. We keep only the result.
Delivery addresses: the pin you drop on the map, the address and landmark you type, and a label such as “Home”.
Your orders: what you ordered, from where, prices, fees, tips, delivery notes and the status history.
Payment details: for GCash, Maya or bank transfer, the screenshot of your payment and its reference number.
For bill payments (Pabayad): the biller, account number, amount, due date and a photo of your bill.
For parcels (Padala): the sender’s and recipient’s names and mobile numbers, both addresses, and a description of the parcel.
Photos you attach to an errand (Pasuyo) or to a review, and the reviews themselves.
Promo codes you use, and your personal invite code.

Riders

Your vehicle type and plate number, and photos of your driver’s licence, your vehicle and its OR/CR.
Your application history, the review decision, and your attendance at the onboarding seminar.
When you are online, and the jobs you accept, complete or give up.
At each delivery: a photo as proof of delivery, and your phone’s location at the moment you mark it delivered.
Your earnings, and cash you collect or remit.

Store owners

Your store’s details, menu, prices, photos and opening hours, and the orders your store receives.
What we settle with you, and how.

Messages

Chat messages between a customer and a rider about an order.

What we do not collect

No tracking of where you go. We use your phone’s location only when you tap “Use my location” or pick a spot on the map, and, for riders, at the moment of delivery.
No advertising or analytics trackers. The only cookies chacha sets keep you logged in and remember which login page you used.
We do not sell your data, and we do not share it for anyone’s advertising.

Why we use it

To take, price, deliver and support your orders.
To let a rider find you and call you if they can’t find your gate.
To keep chacha safe: checking that customers are real people, that riders are licensed, and that payment screenshots are not reused.
To stop promo abuse. Promo limits follow the mobile number, so accounts that share a number share their promo limits.
To pay riders and stores correctly, and to keep business records.
To send you updates about your orders, if you allow notifications.

Who can see it

Riders: an order’s delivery address and pin are shown to online riders so they can decide whether to take it. Your name and mobile number are shown only to the rider who accepts it. For a parcel, the rider also sees the sender’s and recipient’s names and numbers.
You and your rider see each other (name, number, photo and chat) while the order is active and for one hour after it is delivered. A cancelled order closes this straight away.
Store owners see the items and status of orders placed with their store. They do not see your address or your profile.
Other chacha users can read reviews, including review photos. Profile photos and review photos are stored as public images.
chacha staff can see what is needed to review accounts, check payments, settle money and resolve problems. Identity photos, licences, OR/CRs, payment screenshots and bills are kept in private storage and opened only through links that expire after two minutes.

Companies that run parts of chacha for us

Supabase: our database and login system.
Cloudflare: hosts the app and stores photos and documents.
Google: Google sign-in, if you use it, and Google Maps for the map and for looking up locations.
Resend: sends our emails, such as account confirmation.
Your browser’s push service (for example Google or Apple) delivers notifications.

They process data only to provide these services to us. Some of them store data outside the Philippines. We may also disclose information when the law requires it.

How long we keep it

Identity check photos: deleted as soon as they are reviewed.
Orders, payments and settlements: kept as business and tax records, and to resolve disputes.
Chat messages: hidden from you and the rider one hour after delivery, but kept so we can look into a complaint.
Addresses you remove disappear from your list but stay attached to past orders that used them.
Rider documents are kept while you ride with chacha, and until you ask us to delete them.
Everything else is kept while your account is open, or until you ask us to delete it.

Your rights

Under the Data Privacy Act you can ask us to tell you what we hold about you, give you a copy, correct it, stop using it or delete it. You can change your name, number and photo in the app yourself.

To delete your account, email chacha@apoiolabs.com from the address you signed up with. We will delete your account and personal details, except records we must keep by law or to settle an order, a payment or a dispute that is still open.

If you think we have mishandled your data, tell us first so we can fix it. You can also complain to the National Privacy Commission.

Age

You must be 18 or older to create a chacha account.

Changes

If we change this policy, we will update the date at the top. If a change affects how your data is used in a significant way, we will tell you in the app before it takes effect.