Privacy Policy

This Privacy Policy explains how LifePlace Retreat and Events Center ("LifePlace", "we", "us") collects, uses, shares, and protects your personal information when you use our website, mobile applications, and event services. We comply with the Philippines Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

1. Who we are

LifePlace Retreat and Events Center is a Department of Tourism accredited venue at Brgy. Sulsugin Ibaba, Alfonso, Cavite, Philippines. We operate the website at lifeplacealfonso.com, the client portal at app.lifeplaceretreatandevents.com, and the LifePlace mobile applications for iOS and Android.

2. Personal information we collect

We collect the following categories of personal information directly from you:

• Contact information. Name, email address, phone number, organisation, and the address you provide for billing.
• Booking details. Event date, guest count, ceremony or event type, dietary preferences, accessibility requirements, and any other information you choose to share with your coordinator.
• Payment information. Card brand and last four digits, billing postal code, and payment receipts. Full card numbers are collected by Stripe and PayMongo — we never see or store them.
• Account information. Email address and authentication factors (passwords are stored as salted hashes via Supabase Auth; magic-link tokens are short-lived).
• Account content. Free-text feedback, comments, drawn signatures on contracts, file uploads attached to your event, calendar feed token.
• Identifiers. Internal user ID, device push token, mobile-app version, and a hashed device identifier.
• Diagnostics. Crash reports (via Sentry), in-app interaction events, and network state. Crash reports never include card data and we scrub email addresses before transmission.

3. How we use your information

We process your personal information for the following purposes, each grounded in the legal bases recognised by the DPA:

• Performance of contract. Managing your booking, accepting your payments, issuing invoices and receipts, communicating about your event, and providing customer support.
• Legitimate interests. Diagnosing crashes and performance issues, detecting and preventing fraud, securing our infrastructure, and improving the product.
• Consent. Marketing communications, optional photo uploads, and submissions to public reviews (we only show your name on a review if you opt in).
• Legal obligation. Tax-record retention, BIR documentation, and responding to lawful government requests.

4. How we share your information

We share your information only with the following categories of recipients, and only for the specific purpose listed:

• Payment processors. Stripe (cards) and PayMongo (GCash / Maya / GrabPay). Card data flows directly to them; we receive only the brand, last four digits, and a payment receipt.
• Infrastructure providers. Vercel (hosting), Supabase (database, authentication, and file storage), Cloudflare (DNS and asset delivery), Resend (transactional email), Inngest (background jobs), Sentry (crash reporting), Expo (mobile push notification relay).
• Vendor partners when your event explicitly requires sharing — e.g., we will pass dietary requirements to your caterer when you have booked one through us, and we will give your photographer the run-of-show with your consent.
• Legal and regulatory authorities when required by law, court order, or to protect the rights, property, or safety of LifePlace, our clients, or the public.

We do not sell, rent, or trade your personal information. We do not use your information for behavioural advertising.

5. International transfers

Some of our infrastructure providers process data outside the Philippines (Stripe, Sentry, Vercel, Resend). When this occurs, we rely on the contractual safeguards each provider commits to (standard contractual clauses or equivalent), and we limit transferred data to what is strictly necessary for the service to function.

6. How long we keep your information

We keep your personal information only as long as we need it for the purposes described above, plus any retention period required by Philippine tax and accounting law (typically ten years for financial records). Specifically:

• Active account data is retained as long as your account is active.
• Booking and event records are retained for ten years from the event date.
• Payment records and invoices are retained for ten years per Bureau of Internal Revenue rules.
• Marketing consents and preferences are retained until you withdraw consent or the account is deleted.
• Crash reports and diagnostic data are retained for 90 days then aggregated.

7. Your rights under the Data Privacy Act

You have the following rights as a data subject, and we have built tooling into the LifePlace mobile app and client portal to make them easy to exercise:

• Right to be informed. This policy.
• Right to access. Request a copy of the personal information we hold about you — Settings → Privacy → Download my data in the app, or email us.
• Right to rectification. Update any inaccurate information directly via Settings → Edit profile, or by contacting your coordinator.
• Right to erasure. Request deletion of your personal information — Settings → Privacy → Delete account. We honour all valid deletion requests within the timelines set by the DPA, subject to legal retention obligations (tax records).
• Right to object. Withdraw marketing consents at any time via Settings → Notifications.
• Right to data portability. Receive your data in a machine-readable JSON export.
• Right to file a complaint. Lodge a complaint with the National Privacy Commission at privacy.gov.ph.

8. How we secure your information

We protect your personal information with industry-standard administrative, technical, and physical safeguards:

• TLS encryption in transit for every connection between your device, the LifePlace app, and our servers, with SSL public-key pinning on the mobile app.
• Encryption at rest for all databases and file storage via Supabase.
• Role-based access controls and row-level security on every database table; only authenticated clients see their own records.
• Two-factor authentication and biometric unlock (Face ID / Touch ID) options on the mobile app.
• Audit logs for every administrator action that touches a client record.
• An incident response runbook and a breach register reviewed quarterly.

9. Cookies and similar technologies

We use first-party authentication cookies to keep you signed in. We use Supabase session cookies and a small set of preference cookies (theme, language). We do not use third-party advertising cookies or behavioural-tracking pixels.

10. Children's privacy

LifePlace services are intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.

11. Changes to this policy

We will post the current version of this policy at /privacy and notify active clients by email at least 30 days before any material change takes effect.

12. Contact our Data Protection Officer

Questions, requests, or complaints about this policy can be sent to:

Data Protection Officer
LifePlace Retreat and Events Center
Brgy. Sulsugin Ibaba, Alfonso, Cavite, Philippines
Email: reservations.lifeplace@gmail.com
Phone: (046) 889-0844