Privacy Policy

Yaygo is a booking platform for affordable stays in the Philippines — motels, apartelles, and bed & breakfasts — bookable by the hour or overnight. This policy covers the Yaygo mobile app, the Yaygo websites at yaygo.ph, and everything we do behind them.

The service is operated by Yaygo, a sole proprietorship registered with the Department of Trade and Industry (DTI) of the Republic of the Philippines. For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173), Yaygo is the personal information controller for the data described here. You can reach us any time at yaygoph@gmail.com.

Yaygo is a marketplace. The people who actually run the properties — we call them hosts — receive some of your information so they can let you in and honour your booking. Where that happens, it is described in section 5, and the host handles that information under their own responsibility.

Information you give us

• Your account. Name, email address, mobile number, and a profile photo if you add one. If you sign in with Google, Facebook or Apple, we receive your name, email address and profile picture from that provider — nothing else, and never your password.
• Your bookings. The property and room you chose, dates and times, number of guests, the rate you booked, and any special request or note you add for the host.
• Payment and payout details. A label for each saved payment method (for example “Visa •••• 4242”), your Yaygo wallet balance and transaction history, and — for hosts — the bank or e-wallet account we send payouts to. See section 6 for card numbers, which we deliberately never hold.
• Host verification documents. If you list a property, we collect the documents needed to verify you and the property — a government-issued ID, business permit, and DTI or SEC registration. These are stored in a private, non-public location and are visible only to the Yaygo staff who review them.
• Your ID, if you choose to add one. You can keep a photo of a government-issued ID on your account (the front, and the back if you like) with its type, so you don’t have to hand the card over at the front desk. It is optional: you can book without it and show your ID at check-in instead. Before we store the photos we strip the hidden data phones attach to pictures, such as where the photo was taken.
• What you write on Yaygo. Reviews and ratings, reports you file about a listing, support tickets and the messages inside them.

Information we collect automatically

• Device and app information. Device model, operating system version, app version, language, and a push notification token so we can reach your device.
• Usage and logs. Pages and screens you open, searches you run, IP address, and the date and time of requests. We keep these to operate the service, debug problems, and detect fraud and abuse.
• Location. Only if you grant the permission, and only while the app is open — used to show stays near you and sort results by distance. Denying it costs you the “nearby” sort and nothing else; you can still search any area by name. See section 7.

What we do not collect

We do not buy personal information from data brokers, and we do not run third-party advertising or cross-site tracking inside Yaygo. Government-issued IDs (the documents hosts submit for verification, and the ID a guest may choose to add) count as sensitive personal information under the Data Privacy Act. We collect them only for the purposes in this policy and protect them as section 10 describes. Beyond that, we do not ask for sensitive personal information — race, health, religion, political affiliation, or the like — and you should not send it to us.

Running your bookings

Creating, confirming, changing and cancelling reservations; passing the host what they need to let you in; sending confirmations and check-in reminders.

Faster check-in

If you add your ID, showing it to the host of a booking at a listing that asks for one, so they can confirm who is checking in without handling your card.

Taking and settling payments

Charging for a booking, applying vouchers and promo codes, crediting your wallet, and paying hosts out.

Support

Answering your questions, investigating a bad stay, and mediating between guests and hosts when something goes wrong.

Safety, fraud and abuse

Verifying hosts and listings, reviewing reports, blocking fraudulent payments, and enforcing our Terms.

Improving the product

Understanding which features are used, finding and fixing bugs, and measuring whether a change made things better. Aggregated wherever it can be.

Messages we send you

Service messages you cannot switch off (booking confirmations, payment receipts, security alerts), and marketing you can — see section 7.

Legal obligations

Keeping tax and accounting records, responding to lawful requests from authorities, and establishing or defending legal claims.

The Data Privacy Act requires us to have a lawful basis for processing your information. Ours are:

• Contract. Most processing exists because you asked us to book you a room. We cannot deliver the booking without it.
• Consent. Used for the things that are genuinely optional and separately asked for — location access, push notifications, marketing messages, and adding your ID for faster check-in, which you agree to on the screen where you add it. You can withdraw consent at any time without affecting your bookings; for your ID, removing it is withdrawing.
• Legitimate interests. Keeping the platform safe, preventing fraud, and improving the service — weighed against your interests, and never where your rights override them.
• Legal obligation. Tax, accounting, and lawful requests from government authorities.

We do not sell your personal information. We share it only in these situations:

• The host of the stay you book. They receive your name, contact number, and the details of the booking, so they can expect you and let you in. They do not receive your payment details. Before you book, a host sees nothing about you.
• Your ID, with the host of that booking only. If you added an ID and the listing asks for one, the host can view it, and print a copy, for that booking: from the moment it is confirmed until 24 hours after check-out, never for another booking or listing. They open it through a link that stops working after a minute. Every view and print is recorded first, and you can see each one in the app under Profile, Valid ID. A printed copy carries your booking reference and “for check-in use only”. Once printed, the copy is in the host’s hands and their responsibility, and hosts are asked to shred it after you check in.
• Guests, if you are a host. Your property details, photos, house rules and contact information are shown to the guest who books, and your public listing is visible to everyone.
• Our service providers, who process data on our instructions and nothing more: PayMongo (payments), Supabase (database, authentication and file storage), Google Firebase (push notifications), and our SMS and email providers (one-time codes, receipts and notices).
• Authorities, when we are legally required to disclose — a valid subpoena, court order, or lawful request — or where disclosure is necessary to protect someone’s life or safety.
• A future buyer of the business, if Yaygo is ever sold, merged or reorganised. We will tell you before your information becomes subject to a different privacy policy.

The same applies to e-wallet payments such as GCash and Maya: you authorise the payment with the provider, and we receive the result, not your credentials. Where a stay is paid in cash on arrival, no payment details reach us at all.

We keep records of what was charged, refunded, credited to your wallet and paid out — the amounts, dates and status. We are required to keep those records for tax and accounting purposes even after your account closes.

The Yaygo app asks for a small number of permissions. Every one of them is optional, requested only when the feature needs it, and can be revoked in your device settings at any time.

Location (while using the app)

Shows stays near you and sorts results by distance. We do not track you in the background and we do not build a location history.

Notifications

Booking confirmations, check-in reminders, and host messages. Turn off marketing notifications in the app; turn off all of them in your device settings.

Camera and photos

Only when you upload something — a profile picture, a property photo, a verification document, or a photo of your ID if you choose to add one. We never open the camera on our own.

Marketing emails always carry an unsubscribe link. Service messages — a booking confirmation, a payment receipt, a security alert — are part of the service and cannot be switched off while you hold an account.

Our websites use cookies to keep you signed in and to remember basic preferences such as your search. These are strictly necessary for the site to work — sign-in cannot survive a page load without them. We do not use advertising or cross-site tracking cookies.

Your browser can block or delete cookies. Blocking ours will sign you out and keep you signed out.

We keep personal information only as long as there is a reason to, then delete or anonymise it:

• Your account and profile: while your account is open, and for up to 30 days after you close it — a grace period in case you change your mind.
• Bookings, payments and payout records: at least ten (10) years from the transaction, because Philippine tax and accounting rules require it.
• Host verification documents: while you are an active host, and for as long afterwards as regulation requires.
• Your ID on file: until you remove it or delete your account; either one deletes the photos straight away. The record of each time a host viewed or printed it is kept while your account exists, so you can check it, and deleted with your account.
• Support tickets and reports: up to three (3) years, so we can see the history if a dispute resurfaces.
• Server logs: up to twelve (12) months.

Reviews you left stay visible after your account closes, but are detached from your name and shown as from a former user — removing them entirely would misrepresent a host’s rating history.

• All traffic between your device and Yaygo is encrypted in transit (HTTPS/TLS), and data is encrypted at rest by our hosting provider.
• Database access is row-restricted: the rules are enforced by the database itself, so one account cannot read another’s bookings even if a client tries. The apps cannot write to the database at all; every change goes through our server, which checks who you are and what you are allowed to do.
• Verification documents and guest IDs are held in private storage that is never publicly readable and needs a signed, expiring link to view. A host's link to a guest's ID expires within a minute and is only created after the view is recorded.
• Staff access is least-privilege and limited to the people who need it for support, verification or fraud review; sensitive administrative actions are logged.
• Card data never touches our servers (see section 6), which removes an entire category of risk.

No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that puts you at real risk of serious harm, we will notify you and the National Privacy Commission as the Data Privacy Act requires. Keep your password and one-time codes to yourself — no one from Yaygo will ever ask you for them.

Under the Data Privacy Act of 2012, you have the right to:

• Be informed that your personal information is being processed, and how.
• Access a copy of the information we hold about you.
• Correct anything inaccurate or out of date — most of it you can edit yourself in the app.
• Object to processing, including withdrawing consent for location, notifications or marketing.
• Erasure or blocking, where the information is incomplete, outdated, unlawfully obtained, or no longer necessary.
• Data portability — receive your information in a commonly used, machine-readable format.
• Damages, if you suffer harm from a violation of your rights.
• Lodge a complaint with the National Privacy Commission.

You can get a copy of your data yourself at any time: use Download my data in Settings in the Yaygo app, or Download your data in Settings on yaygo.ph. You get a readable document (PDF) right away, and on yaygo.ph also a machine-readable data file (JSON) for moving your data to another service. You can also delete your account from the same place.

If you added an ID, you can replace or remove it at any time under Profile, Valid ID, and see there every time a host viewed or printed it. Your data export lists the ID you have on file (its type and dates, not the photos) and that same record of views and prints.

For anything else, or if you can’t sign in, email yaygoph@gmail.com from the email address on your account, or tell us the mobile number you signed up with. We will respond within thirty (30) days. We may need to verify your identity first, and we may have to keep some records even after a deletion request where the law requires it — if so, we will tell you which and why.

If you are not satisfied with our response, you may complain to the National Privacy Commission at privacy.gov.ph.

Yaygo is for adults. You must be at least eighteen (18) years old to create an account or make a booking. We do not knowingly collect personal information from children. If you believe a child has given us their information, email us and we will delete it.

Some of our providers — our database and storage host, our push notification provider, and our payment processor — operate servers outside the Philippines. Your information may therefore be stored or processed abroad.

Where that happens, we remain accountable for it under the Data Privacy Act, and we use providers who contractually commit to protection at least equivalent to what Philippine law requires.

We will update this policy as the product changes. The effective date at the top always reflects the current version. If a change materially affects how we use your information, we will tell you in the app or by email before it takes effect — not quietly, and not afterwards.

Questions, requests, or a complaint about how we handled your information — write to us and a person will read it.

Email

yaygoph@gmail.com

Operator

Yaygo

Regulator

National Privacy Commission — privacy.gov.ph