PRIVACYPOLICY

This Privacy Policy explains how TUGS collects, uses, shares, and protects your personal information, and describes the choices and rights you have. It should be read together with our Terms & Conditions.

For personal information submitted to TUGS, TUGS acts as the personal information controller. This policy is written to align with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.

We aim to handle personal information responsibly and to describe our actual practices plainly. We do not claim absolute compliance with every requirement of applicable law, and we do not promise that our systems are free from risk.

We collect information in the following categories:

• Account and profile information — your name, email address, sign-in credentials (stored by our authentication provider in hashed form), role, and any profile details you choose to add.
• Identity and verification information — which may include government-issued identification, photographs or selfies submitted for identity verification, supporting identity documents, and guardian-related verification records where applicable.
• Organizer and event information — organizer profiles, event details you create or manage, venue and location information, and event-verification documents such as venue proof, authorization, permit, and other supporting documents.
• Booking and artist-service information — booking requests, structured offers and agreements, booking messages and conversations, completion records, and concerns or disputes submitted through the platform.
• Transaction information — order and ticket records, credit purchases and credit movements, payment status, and payment identifiers returned to us by our payment provider. Your full card number is not stored by TUGS.
• Community content — posts, images and videos you upload, comments and replies, reactions, and reports or moderation records.
• AI assistant messages — prompts and conversation content you voluntarily submit to TUGS AI BOT, processed to provide the assistant functionality.
• Technical information — device and browser details, IP address, and diagnostic logs, which we use to keep the service secure and reliable.
• Communications — emails and support messages you send to us.

Certain identity-verification information processed by TUGS may constitute sensitive personal information under applicable Philippine data protection law. This may include information concerning age or date of birth, government-issued identification records, and other information classified as sensitive under the Data Privacy Act.

We handle this information with heightened care and for the specific purposes described in this policy. Not all personal information we process is classified as sensitive; ordinary contact details and account information are treated as personal information and handled according to the purposes and safeguards described here.

We use personal information to:

• provide, operate, and maintain the TUGS platform and your account;
• verify identity, review artist and organizer applications, and process required consent for minors;
• process payments, issue tickets, and record credit movements accurately;
• facilitate booking requests, structured offers, agreements, completion, and dispute resolution;
• moderate community content, review reports, and enforce our Terms;
• prevent fraud, abuse, and unauthorised access, and enforce our Terms;
• send transactional messages — such as booking replies, ticket delivery, application status, and security notices;
• respond to your AI assistant messages and operate the assistant feature;
• respond to support requests and improve the platform; and
• meet legal, accounting, and regulatory obligations.

For ordinary personal information, we may rely on one or more of the following bases: your consent; performance of a contract with you or steps you request before entering into one; our legitimate interests in operating and securing the platform; and compliance with a legal obligation.

For sensitive personal information — such as government-issued identification and date-of-birth information — we process this information only where a lawful basis under the Data Privacy Act applies, such as your consent or compliance with a legal obligation. We do not rely on legitimate interest as a basis for processing sensitive personal information.

Where we rely on consent, you may withdraw it at any time. Please note that withdrawing consent for information we must process — such as identity verification for a submitted application — may mean we can no longer continue that request or provide the related feature.

We do not sell your personal information. We share it only where it is needed to run the service:

• Supabase — authentication, database, and file storage for the platform.
• PayMongo — payment processing for ticket and credit purchases.
• Vercel — hosting and delivery of the TUGS application.
• A Gmail-based email delivery service — transactional email such as tickets and verification notices.
• A geocoding service (Nominatim / OpenStreetMap) — venue search queries sent through TUGS servers. The provider receives the search text and returns location results; it does not receive your TUGS profile or account information.
• Other users, where the platform's purpose requires it — for example, an organizer receives the booking details you submit for their event.
• Authorities, where disclosure is required by law, a lawful order, or is necessary to protect the rights, safety, and property of users and of TUGS.

Payments are handled by PayMongo. When you pay, PayMongo processes your payment details under its own privacy policy. TUGS receives confirmation of the outcome of the payment and the identifiers needed to match it to your order or credit purchase — not your full card number.

Never send card numbers, PINs, or one-time passwords to TUGS through email, chat, or booking notes.

Our providers host and process information on infrastructure that may be located outside the Philippines. Where information is transferred or processed abroad, we take reasonable steps consistent with applicable law, including using providers that offer appropriate safeguards for the data they handle.

We keep personal information only for as long as it is needed for the purposes described in this policy, and for a reasonable period afterwards where records must be kept for dispute resolution, accounting, security, or legal obligations. When information is no longer needed, we delete it or remove it from identifiers.

We do not publish fixed retention periods for each record type at this time. If you want to know how long a specific category of information is kept, ask us using the contact details in Section 15.

We use reasonable organisational and technical measures to protect personal information, including server-side authorization for privileged actions, database-level access controls, encrypted transport, and restricted handling of identity documents.

No method of transmission or storage is completely secure. We cannot guarantee that information will never be accessed, disclosed, altered, or lost by unauthorised parties, and we will notify affected users and regulators as required by applicable law if a breach occurs.

TUGS uses cookies and similar browser storage that are required to keep you signed in and to make the platform work — for example, the session cookies used by our authentication provider.

If we introduce optional analytics or marketing cookies, we will update this policy and ask for your consent where the law requires it.

Subject to applicable law, you have the right to be informed about how your information is processed, to object to processing, to access your information, to have inaccurate data corrected, to have information erased or blocked where it is unlawfully obtained or no longer needed, to data portability where applicable, to be compensated for damage caused by a privacy violation, and to file a complaint with the National Privacy Commission of the Philippines (npc.gov.ph).

These rights are subject to applicable legal exceptions. We may need to retain certain information to meet legal obligations, resolve disputes, enforce our agreements, or protect the rights and safety of others. Account closure does not necessarily mean immediate deletion of every transaction, fraud, dispute, accounting, or legal record.

To exercise these rights, email us using the details in Section 15. We may need to confirm your identity before acting on a request, and some requests may be limited where we must retain information to meet legal obligations or where another person's privacy would be affected.

TUGS is not directed at children. Where an applicant is a minor, we require the consent of a parent or guardian before identity verification, and we may collect the guardian details needed to record that consent.

Events may be designated as age-restricted by the organizer. TUGS does not guarantee that minors are technically prevented from purchasing tickets to or attending age-restricted events. Organizers and venues may impose their own entry requirements, and users are responsible for providing accurate information.

If you believe a minor has provided personal information without that consent, contact us and we will review and remove it where appropriate.

We may update this policy to reflect changes in the platform or in applicable law. The effective date at the top of this page tells you when this version started to apply. For material changes we will give notice through the platform or by email.

Privacy questions, requests, or concerns can be sent to tugs-support@gmail.com.

This email is monitored for general support and privacy-related requests. An official Data Protection Officer designation has not yet been established; this is an unresolved governance requirement that will be addressed before formal commercial deployment.