1. Who is responsible for your data
Vuker is operated by Vuker Booking Services, Yakal Street, Block 35 Lot 25, Lumina Homes Subdivision, Maliwalo, Tarlac City 2300, Philippines, the personal information controller for the purposes of the Data Privacy Act of 2012 (RA 10173) and its implementing rules and regulations.
Data Protection Officer: asinobagojr2022@gmail.com, Yakal Street, Block 35 Lot 25, Lumina Homes Subdivision, Maliwalo, Tarlac City 2300, Philippines.
Vuker is a booking platform that connects Clients — people and organisations looking to book a service — with Service Providers, the professionals, freelancers and businesses offering services, currently across Creatives and Events and General Services. This notice explains how we handle personal information for both. It works alongside the Terms and Conditions, which use the same terms.
2. What we collect, and why
We collect only what a booking or a verification actually needs. Grouped by what it is for, because that is what determines how long we keep it.
2.1 If you only browse
Nothing that identifies you. You can search Service Providers, view portfolios and see prices without an account. Your approximate location is used only on your device to sort results by distance, and is not stored on our servers. Signed out, you cannot see any Service Provider's exact coordinates — the server returns a distance already rounded, not a position.
2.2 If you create an account
| Data | Why | Basis under RA 10173 |
|---|---|---|
| Name, email | To identify you to the other party in a booking | Contract |
| Password (hashed) or Google sign-in identifier | To let you sign in | Contract |
| Mobile number, if you add one | Booking notifications by SMS | Consent |
| City and approximate location, if you allow it | To match you with nearby Service Providers | Consent |
| Whether you are a Client or a Service Provider | Determines what you can do | Contract |
| Service preferences, if the app records them — such as the categories you browse or book | To show you relevant Service Providers | Legitimate interest |
We never see your Google password. If you sign in with Google we receive only your name, email address and profile picture.
2.3 If you are a Service Provider seeking verification
This is the most sensitive data we handle, and it is treated separately.
Vuker may verify Service Providers at different levels — basic profile, identity, business and professional — as described in the Terms. What we ask for depends on the level and on your trade.
| Data | Why |
|---|---|
| Full legal name, ID type, ID expiry date, last four digits only of the ID number | To check the ID is real and current (identity verification) |
| Photographs of your government ID (front, and back where the ID has one) | So a reviewer can confirm the document and the name |
| A selfie | To confirm the person holding the phone is the person on the ID |
| Business registration or permit, if you provide one | For business verification — optional |
| Professional licenses, certifications, permits or other credentials your trade requires | For professional verification, where the service legally requires authorization |
| For photography and video, three original camera files | To confirm the portfolio is your work. We read the camera make, model and capture date from the file's own metadata |
We never store your full ID number. Only the last four digits are written to the database.
Government IDs and biometric comparison are sensitive personal information under RA 10173 §3(l). We process them only with your explicit, separate consent — the tick box on the verification screen — and you cannot submit without it.
A verification badge records what we checked. It is not a guarantee of a Service Provider's future conduct, service quality or legal compliance.
2.4 If you pay a deposit
Card details never reach Vuker. When you save a card, the number, expiry and CVC go from your device directly to PayMongo, our payment processor, which returns a token. What we store is:
- the token (a reference that cannot be turned back into a card number);
- the card brand and the last four digits, so you can tell your cards apart;
- for e-wallets, the wallet type only.
We hold no full card numbers, no CVCs and no expiry dates. This is deliberate: it keeps your card data out of our systems entirely.
We also keep a record of each payment — amount, currency, method type, status and PayMongo's reference, and any Vuker fee charged — because we are required to account for money taken. If a payment fails, is reversed or is disputed, we keep the record of that too.
2.5 Messages and bookings
Messages between you and the other party, and the details of each booking (service, date, time, location, package, price, deposit, cancellation and refund terms, and status). Both parties to a booking can see it.
Vuker may also access them, but only when there is a reason to: to resolve a dispute between a Client and a Service Provider, to answer a support request, to investigate suspected fraud or misuse, or to keep the platform secure. In a dispute we may ask either party for messages, receipts, payment records, photos, documents or other evidence, and we use what is provided only for that dispute.
2.6 What a Service Provider's profile shows
If you are a Service Provider, your profile is public: it is shown to Clients and to anyone browsing, signed in or not. It shows your name or business name, your trade, your city or service area, your rates, your availability, your portfolio, your verification level, your reviews and ratings, and — if you set one — your office or shop address and hours, so Clients know where to meet you. Only put on your profile what you are happy to have seen.
2.7 Reviews and ratings
If you are a Client, you may review and rate Service Providers based on your genuine experience with them. Your review and rating are shown on that Service Provider's profile, to other users. We may remove or restrict reviews that break the Terms — for example fake, threatening or abusive reviews, or ones that post someone's personal information — and restrict accounts involved in manipulating reviews.
2.8 What we use it for
Beyond the purposes in each section above, we use personal information to: create and run accounts; verify identities and Service Providers; manage bookings; process payments; communicate with you; provide customer support; prevent fraud; keep the platform secure; resolve disputes; improve the service; and meet our legal obligations. We will tell you before using it for anything else.
3. How long we keep it
| Data | Retention |
|---|---|
| ID photographs and your selfie | Deleted 30 days after the verification decision. Only the outcome — verified or not, and at what level — is kept |
| Licenses, certifications, permits and business documents | While they support your verification, and afterwards only for as long as needed to resolve a dispute or meet a legal obligation |
| Verification outcome and audit trail | While your account exists, and afterwards only for as long as needed to resolve a dispute or meet a legal obligation |
| Account details | While your account exists |
| A Service Provider's public profile | While the account exists; it is taken down when the account is deleted |
| Bookings, payment records and invoices | [10] years after the booking, to meet BIR record-keeping requirements — confirm this figure with your accountant |
| Messages | While your account exists, and longer only where they are needed for an open dispute or legal claim |
| Reviews and ratings | As long as reasonably necessary for the purpose they were collected for, and for any dispute, security matter or legal claim |
| Approximate location | Not stored on our servers |
As the Data Privacy Act requires, we do not keep personal information longer than its purpose needs, except where the law or a dispute, security matter or legal claim requires it.
Deleting your account withdraws your verification consent and removes your profile. Records we are legally required to retain — chiefly financial ones — survive deletion, and only for as long as that requirement lasts. See Deleting your account and data.
4. Who else sees your data
We do not sell your data, and we do not use it for third-party advertising. We share it only with the following, and only for the purpose named.
| Who | What they get | Where they process it |
|---|---|---|
| Supabase — database, authentication and file storage | Everything above | Sydney, Australia (ap-southeast-2) |
| PayMongo — payments | Card and wallet details you enter at payment, and the deposit amount | Philippines |
| Semaphore — SMS | Your mobile number and the message | Philippines |
| Google — if you use Google sign-in | Only what is needed to authenticate you | Global |
| The other party to your booking | Your name, and the booking details | — |
| Anyone browsing Vuker | A Service Provider's public profile (§2.6) and published reviews (§2.7) | — |
We share with the other party to a booking only what the booking needs. If we add another provider — for example for maps, analytics or notifications — we will add it to this table, with what it receives and where, before it starts processing your data. We may also disclose information where the law requires it.
On sending your data abroad. Your data is stored on Supabase infrastructure in Sydney, Australia, not in the Philippines. RA 10173 holds us responsible for it wherever it is processed, and we remain accountable for it there. We rejected one face-matching provider specifically because it would have sent Philippine government IDs to servers in China, which we judged an unreasonable cross-border transfer for this purpose. If we adopt automated face matching we intend to use a provider processing within ap-southeast-1 (Singapore) or the Philippines, and we will update this notice before doing so.
Automated face matching is not currently enabled. Verification is decided by a human reviewer.
Messages from us. We send messages needed to run your account and bookings — confirmations, reminders, payment notices, cancellations, security alerts and changes to our policies. We may also send you promotional messages about Vuker, with your consent where the law requires it, and every one lets you opt out. Opting out does not stop the messages your bookings need.
5. Automated decisions
We do not make solely automated decisions that significantly affect you. Verification is decided by a person. If face-matching software is enabled later, it will produce a score for the reviewer, not a verdict — and you may ask for the reasoning and contest the outcome.
6. Your rights
Under RA 10173 you may:
- be informed — this notice, and any change to it;
- access the data we hold about you;
- object to processing, and withdraw consent for anything based on it — including promotional messages, at any time;
- correct anything inaccurate;
- erase or block data processed unlawfully or no longer needed;
- damages for a violation that harms you;
- data portability — receive your data in a portable electronic format;
- complain to the National Privacy Commission.
To exercise any of these, contact our DPO at asinobagojr2022@gmail.com. We will respond within [15] working days.
One limit worth stating plainly: whether you signed up as a Client or a Service Provider cannot be changed after your account is created. It determines what you are permitted to do throughout the service. If you need the other role, create a separate account.
You may complain to the National Privacy Commission, 5th Floor, Delegation Building, PICC Complex, Pasay City, or at privacy.gov.ph.
7. How we protect it
- Every request is authorised per-row in the database, so one account cannot read another's bookings, messages or documents.
- Verification documents live in private storage. They are reachable only through short-lived links issued to you or to a reviewer.
- Payment card data never enters our systems (§2.4).
- Deposits can only be marked paid by our payment server after the processor confirms the money moved — not by any app or device.
- Verification verdicts cannot be written from a device, only by review.
- Access by Vuker staff to messages and booking records (§2.5) is limited to the purposes stated there.
No system is perfectly secure. If a breach puts you at risk we will notify you and the NPC within 72 hours of becoming aware, as RA 10173 requires.
Your part. Personal information you receive through Vuker — another user's name, number or address — is for the booking it came with. The Terms prohibit misusing, selling, publishing or passing it on.
8. Children
Vuker is not for under-18s and we do not knowingly collect their data. If you believe a child has given us personal information, contact our DPO and we will delete it.
9. Changes
We will post changes here and update the date above. For anything that materially changes how we use your data, we will tell you in the app before it takes effect — and where the law requires consent, we will ask again rather than assume it.
10. Contact
Vuker Booking Services · Yakal Street, Block 35 Lot 25, Lumina Homes Subdivision, Maliwalo, Tarlac City 2300, Philippines Data Protection Officer · asinobagojr2022@gmail.com