Privacy Policy

HomeBazaarPH (“HomeBazaar,” “we,” “us”) is a sole proprietorship registered in Metro Manila, Philippines. We operate the HomeBazaar online marketplace connecting home cooks with customers. This policy explains how we handle personal data of users of the Service.

We collect the following categories of personal data:

• Account information: name, email address, phone number (if provided)
• Customer profile: delivery addresses, barangay, city, dietary preferences and allergens
• Cook profile: kitchen name, bio, kitchen location, hours, cuisine tags, dish catalog (names, descriptions, photos, prices, allergens), order cutoff times
• Order data: dishes ordered, prices, quantities, order timestamps, scheduled delivery times, status history
• Subscription data: tiffin plan selections, delivery dates, billing dates, cancellation events
• Technical data: IP address, browser type and version, device type, session cookies, pages visited within the Service
• Communications: the content of any messages or emails you send us when you contact support

We use personal data to:

• Provide, operate, and improve the Service
• Process orders, payments, and tiffin subscriptions
• Send transactional notifications (order status updates, one-time-code (OTP) sign-in emails, subscription reminders)
• Route orders to the correct Cook and delivery destination
• Diagnose technical problems, monitor service health, and prevent fraud or abuse
• Respond to support requests and resolve disputes
• Comply with legal obligations under Philippine law

We share limited personal data with carefully selected service providers strictly to operate the Service:

• Supabase — database and authentication hosting (Singapore region)
• Resend — transactional email delivery (one-time-code sign-in emails, order notifications)
• PayMongo — payment processing (used once the payments integration is live)
• Meta WhatsApp Cloud API — order notifications to Cooks and Customers (used once the notifications integration is live)
• Vercel — application hosting and infrastructure analytics
• Anthropic — used for the AI menu parser feature on the cook side; only the menu image or text you submit is sent for parsing, not your account data

We do not sell personal data to advertisers or third-party marketers. We do not share personal data for third-party advertising purposes.

We may disclose personal data when required by Philippine law, a valid court order, or to protect the rights, property, or safety of our users or the Platform.

We retain account data for as long as your account remains active. When you request account deletion, we retain a limited copy of your data for up to 90 days for legal, fraud-prevention, and dispute- resolution purposes, after which it is deleted or anonymized.

Order and transaction records may be retained for longer periods where required by applicable Philippine tax, accounting, or consumer-protection law.

We use essential cookies to keep you signed in and to maintain your session. We do not currently use third-party advertising trackers, and we do not use cookies for behavioural advertising at this stage. If we add additional analytics or tracking technologies in the future, we will update this policy and provide appropriate disclosure or consent mechanisms where required.

Under the Philippines Data Privacy Act of 2012 (RA 10173), you have the following rights regarding your personal data:

• Right to be informed about how your personal data is being processed
• Right to access the personal data we hold about you
• Right to object to processing of your personal data
• Right to erasure or blocking of your personal data
• Right to rectification — correction of inaccurate data
• Right to data portability — a copy of your personal data in a structured, commonly-used format
• Right to damages in the event of an unlawful processing of personal data
• Right to file a complaint with the National Privacy Commission (NPC) of the Philippines at privacy.gov.ph

To exercise any of these rights, contact us at the email below. We will respond within a reasonable time and in accordance with the timelines required by law. Specific NPC contact details and complaint procedures are subject to verification at npc.gov.ph.

We protect personal data with industry-standard safeguards including HTTPS for all data in transit, row-level security on our database, and access controls limiting who within the operation can view personal data.

We use passwordless email one-time-code (OTP) authentication, meaning we do not store user passwords at all. This eliminates an entire class of credential-leak risk.

No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If we become aware of a security breach affecting your personal data, we will notify you and the NPC as required by law.

The Service is not directed at users under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data to us, please contact us so we can delete it.

Some of our service providers operate from countries outside the Philippines (for example, Supabase's Singapore region, and various US-based or EU-based infrastructure providers). By using the Service, you acknowledge that your personal data may be transferred to and processed in countries other than the Philippines, in accordance with the security and contractual safeguards we maintain with those providers.

We may update this Privacy Policy from time to time. When we do, we will post the updated policy on the Platform and update the “Last updated” date. Material changes will be communicated to users at least 30 days in advance, where reasonable.

Our designated Data Privacy Officer can be contacted for any privacy questions, requests, or complaints:

Data Privacy Officer
HomeBazaarPH
Metro Manila, Philippines
support@homebazaarph.com