Privacy Policy

• Your account. For the landlords and team members who use BahaySuite, we are the personal information controller.
• Your tenants, guests and staff. When a landlord records a tenant, a guest or a cleaner in BahaySuite, the landlord is the controller and we process that information on their behalf, only to provide the service to them. If you are a tenant or guest, questions about your information should go first to your landlord or host; we’ll help them answer.

• Account details: name, email address, a securely hashed password (we never see the password itself), your role in an organization, and sign-in sessions. If you sign in with Google, Google shares your name, email address and profile photo with us; we never get your Google password or access to your Gmail, Drive or contacts.
• What landlords enter: properties and units, reservations, leases, charges and payments; tenants’ and guests’ names, email addresses and phone numbers; meter readings; cleaning and maintenance tasks and photos; payment receipts and screenshots that tenants or guests upload.
• Booking and pay pages: the name, email, phone number and message a guest types into a booking request, and the payment details a tenant or guest submits.
• Payments: for online payments we store the amount, date, status and PayMongo’s reference. We never receive or store card numbers, GCash or bank log-ins. Landlords’ own PayMongo keys are stored encrypted.
• Contact form: your name, email and message.
• Technical data: the IP address and browser information our servers receive with each request, kept in short-lived server logs for security and troubleshooting.

• to run BahaySuite: calendars, rent schedules, pay links, bookings and tasks;
• to send the emails the service depends on: sign-up verification, password resets, rent reminders and booking updates the landlord has switched on, and plan renewal reminders;
• to confirm payments and keep billing records required by tax law;
• to keep the service secure, prevent abuse and fix problems;
• to answer your questions.

We don’t sell personal information and we don’t show ads in BahaySuite. To measure our own ads on Facebook and Instagram, our public website pages and the sign-up page use the Meta Pixel (see sections 5 and 9). It never runs inside the app, on hosts’ booking sites or on tenants’ pay links, and nothing about tenants or guests is shared with Meta for ads. The only guest or tenant information that goes to Meta is a Messenger reply a landlord sends through their own connected Facebook Page (see section 5).

To see where BahaySuite is hard to use, we record how people move through our website, sign-up and the BahaySuite web app (clicks, taps and scrolling) with Microsoft Clarity (see sections 5 and 9). Inside the app, everything on screen is hidden before the recording leaves your browser, so it never contains your tenants’, guests’ or your own names, numbers or messages. What you type is never recorded anywhere. Clarity doesn’t run on hosts’ booking sites, tenants’ pay links or owners’ pages.

We process account information to perform our contract with you, and billing records to comply with the law. Information about tenants and guests is processed on the landlord’s instructions and under the landlord’s own lawful basis (usually their lease or booking with that person). Where we rely on consent, you can withdraw it at any time.

We share personal information only with the providers we need to run BahaySuite:

• OVHcloud, which hosts our servers and database in Singapore;
• Cloudflare, for our domain, the routing of email sent to our support address, and storage of our encrypted offsite backups;
• Resend, which delivers the emails BahaySuite sends;
• PayMongo, which processes QR Ph payments for BahaySuite plans, and for landlords who connect their own PayMongo account;
• Google, if you choose to sign in with your Google account;
• Sentry, which receives reports of errors in BahaySuite so we can fix them. Names, email addresses, cookies, form contents and private links are removed from these reports before they are sent;
• Meta (Facebook and Instagram), to measure our own ads. When you visit our public pages, Meta’s Pixel records which pages you viewed. When you create an account, we also tell Meta that an account was created, with your email address in a scrambled (hashed) form, your device’s IP address and browser type, so Meta can count sign-ups from our ads. Meta handles this under its own privacy policy;
• Microsoft Clarity, to see how our website and app are used: which pages you open, where you click, tap and scroll, and your device and browser type. On our public pages it sees the page’s text; inside the app all text, numbers and images are hidden in your browser first, and typed text is never sent. If you’re signed in, Clarity gets your account number (not your name or email) so your visits can be grouped. Microsoft keeps this data for up to 13 months under its own privacy policy;
• Meta Messenger, if a landlord connects their Facebook Page to the Messenger Inbox. Messages people send to that Page, with their Messenger name and profile picture, are stored in BahaySuite so the landlord can answer them next to their bookings, and the landlord’s replies and automatic messages are sent through Messenger. The Page’s access key is stored encrypted. Disconnecting the Page in Settings stops this and can delete the saved conversations; removing BahaySuite from your Facebook account, or asking Meta to delete your data, deletes the Pages you connected and their conversations;
• OpenAI, which powers the optional AI Assistant. When a landlord uses it, their question and the rental records needed to answer it (or the payment screenshot being checked) are sent to OpenAI to produce the answer. OpenAI does not use this information to train its models.

Because some of these providers store or process information outside the Philippines, we choose providers with appropriate security and contractual safeguards. We may also disclose information when the law requires it.

• all traffic to BahaySuite is encrypted (HTTPS);
• each organization’s data is kept separate, and team members only see what their role allows;
• payment keys and calendar links are encrypted in the database;
• backups are made every night and the offsite copies are encrypted with a key that is not kept on our servers.

If a security incident affects your personal information, we will notify you and the National Privacy Commission as the law requires.

We keep an organization’s information while its account is open. When a landlord closes their account, we delete their organization’s data within 30 days; copies in our backups are overwritten within a further 30 days. Billing records are kept as long as tax law requires. Data entered in the public demo is deleted every night.

Under the Data Privacy Act you have the right to:

• be informed about how your information is processed, and access it;
• correct inaccurate information;
• object to processing, and ask for your information to be erased or blocked;
• receive a copy of your information in a usable format (data portability);
• complain to the National Privacy Commission (privacy.gov.ph) and claim damages for violations.

Account owners can download all their data and close their account themselves, under Settings → Your account → Your data.

To use these rights, email support@bahaysuite.com. We reply within 15 days. If you’re a tenant or guest, we may pass your request to the landlord who holds your information.

Inside BahaySuite, we use only the cookies it needs to work: a session cookie that keeps you signed in, and a setting that remembers light or dark mode. Our public website pages and the sign-up page also set Meta’s advertising cookies (_fbp, and _fbc when you arrive from one of our ads), and remember which link or ad brought you to us. Our website, sign-up and the BahaySuite web app also set Microsoft Clarity’s cookies (such as _clck and _clsk), which link the pages of one visit together. You can block or clear these in your browser settings, or turn off ad personalization in your Facebook or Instagram settings.

BahaySuite is meant for adults running a rental business. We don’t knowingly collect information from children for their own accounts.

We’ll post changes to this policy here and tell account holders about important ones. Our data protection contact is RUPERT I.T. SOLUTIONS, reachable at support@bahaysuite.com or through the contact form.