1. Introduction
Tulugan is a rental marketplace that connects renters with hosts offering bed spaces, rooms, apartments, condos, and transient or short-term rentals across the Philippines. This Privacy Policy explains how we collect, use, store, and protect personal information when you use our website and services.
This policy applies to everyone who uses Tulugan, including hosts who list properties and renters who browse listings or send inquiries. By using Tulugan, you acknowledge that you have read and understood this policy.
We process personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations.
2. Information We Collect
We collect information you provide directly and information generated when you use the platform.
Account information
When you create an account, we collect your name, email address, and phone number. You may sign in using a one-time password (OTP) sent to your email or phone, or through Google sign-in. Authentication and session management are handled through Supabase Auth.
Profile information
You may add a profile photo, cover photo, bio, city, and contact methods such as WhatsApp, Viber, or Messenger numbers. Host profiles may be visible to other users when you publish listings or respond to inquiries.
Listing information (hosts)
When you create or manage a listing, we collect property details including type, title, description, photos, pricing, contract terms, furnishing, house rules, bills included, amenities, and location information such as street, barangay, city, province, postal code, and map coordinates. Active listings and their associated content are displayed publicly on Tulugan.
Inquiry information (renters)
When you inquire about a listing, we collect your name, phone number, email address, message, and preferred move-in or stay dates. This information is shared with the specific host whose listing you contacted so they can respond to you.
Tenant records (hosts)
Hosts may record tenant names, phone numbers, rent amounts, stay dates, and payment status within their dashboard for private property management. These records are visible only to the host who created them and are not published on the public marketplace.
Location data
If you choose to use features such as “Use my current location” when searching for listings or creating a listing, we access your device’s GPS coordinates with your permission. Location data is used to show nearby listings, pre-fill address fields, or place your listing on a map. We do not continuously track your location in the background.
Technical and usage information
We automatically collect certain technical information when you use Tulugan, including your IP address, browser type, device information, and pages visited. We use this information to operate, secure, and improve the platform, including rate limiting and abuse prevention through Upstash.
3. How We Use Your Information
We use the information we collect to:
- Create, authenticate, and manage your account
- Connect renters with hosts by delivering inquiries to the relevant listing owner
- Display listings publicly, including photos, pricing, location, amenities, and host name or avatar
- Help hosts manage tenants, inquiries, and rent or payment status within their dashboard
- Provide maps, location search, and geocoding through MapTiler
- Store listing photos and profile images securely through Supabase Storage
- Protect the platform through HTTPS encryption, database access controls, and rate limiting
- Respond to support requests and communicate important service updates
We do not use your personal information for third-party advertising, and we do not sell your data to advertisers or data brokers.
4. Information Sharing
With other users
When you send an inquiry, your contact details and message are shared with the host of that listing. Public listing pages display listing content and limited host profile information to all visitors. Tenant records you create as a host remain private to your account.
With service providers
We use trusted third-party providers to operate Tulugan. These providers process data on our behalf and only as needed to deliver their services:
- Supabase — database, authentication, and file storage
- MapTiler — maps, geocoding, and location search
- Upstash — rate limiting and security
- Vercel — website hosting and delivery
We require these providers to handle personal data appropriately and only for the purposes described in this policy.
What we do not do
- We do not sell your personal information to third parties
- We do not share your data with advertising networks
- We do not use cross-site tracking cookies for marketing purposes
5. Your Rights
Under the Philippine Data Privacy Act, you have the following rights regarding your personal data:
- Right to access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of your account and associated personal data
- Right to object — object to certain processing of your personal data
- Right to data portability — request your data in a structured, commonly used format where applicable
To exercise any of these rights, visit our Contact page or email us at hello@tulugan.com. We will respond within a reasonable time as required by applicable law.
6. Data Security
We take reasonable measures to protect your personal information, including:
- Encrypted connections (HTTPS) for all data transmitted between your browser and our servers
- Row-level security policies on our Supabase database to restrict access to authorized users
- Rate limiting through Upstash to reduce abuse, spam, and automated attacks
- Authentication and credential management handled by Supabase using industry-standard security practices
No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security.
7. Data Retention
We retain your personal information for as long as your account is active or as needed to provide our services. If you request account deletion, we will delete or anonymize your personal data within a reasonable period, except where we are required to retain certain records by law or for legitimate business purposes such as resolving disputes or enforcing our terms.
8. Children’s Privacy
Tulugan is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe a minor has provided us with personal data, please contact us and we will take steps to delete that information.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we make changes, we will revise the “Last updated” date at the top of this page. Your continued use of Tulugan after changes are posted constitutes your acceptance of the updated policy. We encourage you to review this page periodically.
10. Contact Us
If you have questions or concerns about this Privacy Policy or how we handle your personal data, please visit our Contact page or email hello@tulugan.com.
