Privacy Policy

Last updated: June 15, 2026 (clarified retention of trust-score events, dispute submissions, and dispute evidence files: kept for the lifetime of the account plus 2 years to support audit trails and possible re-opening; dispute evidence is uploaded to our Lovable Cloud storage and accessible only to the uploader and our moderation team.)

365 MotorSales Philippines ("we", "us", "the Platform") respects your privacy and complies with the Philippines' Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations. This policy explains what we collect, why, who we share it with, and the rights you have. It works together with our Terms & Conditions.

Appointment bookings. When you book a service through a business mini-site, we collect your name, contact details, requested time, and any notes you provide, and disclose them to that business so they can fulfil the appointment. The business is a separate Personal Information Controller for the booking. We retain booking records for service history, dispute resolution, and tax compliance.

Trust-score & disputes. We record every moderation action against your listings (accept, dismiss, hide, restore, reverse) and every change to your trust score, with the reason and a timestamp. When you file a dispute we collect your written explanation and any evidence files you upload. This data is retained for the lifetime of your account plus two (2) years, is visible to our moderation team and to you (via My disputes and My trust score), and is not shared with other users or third parties except where required by lawful authority. See /help/trust-score for how the score works.

1. Who we are (Data Controller)

365 MotorSales Philippines is the Personal Information Controller for data collected through the Platform. Our Data Protection Officer (DPO) can be reached at dpo@365motorsales.com.

2. Information we collect

• Account data: name, email, phone number, password (hashed), authentication provider (e.g. Google).
• Profile data: avatar, display name, business name, location, optional government ID and business permits submitted for verification.
• Listing data: photos, descriptions, prices in ₱, vehicle details (make, model, year, plate area), parts/services details, contact preferences.
• Business directory & mini-site data: business address, location pin, operating hours (including separate convenience/sari-sari hours), services & products catalog, any prices you publish, photo galleries you upload, embedded videos you link, and contact channels you list (phone, WhatsApp, Viber, Telegram, Instagram, TikTok, email, Facebook, X, LinkedIn).
• Transactions: billing details, transaction IDs, plan/boost purchases, payment status. Card numbers are handled by our payment processors — we do not store full card numbers.
• Messages & leads: in-platform messages, inquiries, and lead replies between buyers, sellers, and businesses.
• Device & usage data: pages viewed, searches, clicks, device type, browser, IP address, approximate location, referral source.
• Location (optional): precise location when you opt in for "near me" search, map features, or pinning a business.
• Cookies & similar tech: see Section 6.

3. How we use your data

• Operate the marketplace and business directory and display listings to other users.
• Verify identity, business ownership, and reduce fraud or impersonation.
• Show accurate operating-hour indicators ("Open", "Closing soon", "Opens soon").
• Process payments for listings, boosts, subscriptions, and advertising.
• Send transactional emails (account, listing status, messages, receipts).
• Send optional marketing emails — you can unsubscribe at any time.
• Improve search, rankings, recommendations, and platform performance.
• Comply with legal obligations and respond to lawful requests from authorities.

4. Legal bases for processing

• Contract: to provide the services you signed up for.
• Consent: for optional features such as precise location, analytics cookies, and marketing emails.
• Legal obligation: tax records, anti-fraud, lawful disclosures.
• Legitimate interest: securing the platform, preventing abuse, and improving the product.

Mini-site analytics: when you visit a public business page on 365 MotorSales, we record aggregated events (page view, contact-channel click, share, booking click) so the business owner can see how their page performs. Along with each event we may store a coarse device type(mobile, tablet, desktop, bot) derived from the User-Agent header and an approximate city, region, and country derived from the request headers our hosting provider attaches based on IP. We do not store raw IP addresses or precise location, and events are de-duplicated per browser session using a random identifier so individual visitors are not tracked across sessions.

5. Sharing & processors

We share data only with processors bound by confidentiality and data-processing agreements, including:

• Cloud hosting & database: our managed backend provider.
• Payments: Stripe and other licensed processors for cards, GCash, Maya, and bank transfer.
• Email: transactional and notification emails are sent through our managed email infrastructure on the verified subdomain notify.365motorsales.com.
• Maps & geocoding: map tiles via OpenStreetMap (Leaflet) and address geocoding via OSM Nominatim. Google Places is used by admins to seed the business directory with publicly available listings (name, address, phone, website, hours, rating, place ID, and one cover photo with attribution). Seeded businesses are marked Unclaimed until the real owner claims the page; rightful owners can claim their listing from the business page, or request removal at any time via Support.
• Analytics: Google Analytics 4 (with IP anonymization), loaded only after you accept optional cookies via the cookie banner.
• Customer support tools: to handle your tickets and inquiries.

We do not sell your personal data. We may disclose data when required by Philippine law, a valid subpoena, or to protect rights and safety.

6. Cookies & similar technologies

• Essential cookies: login, session, security, CSRF.
• Preference cookies: language, currency, theme.
• Analytics cookies (optional): aggregate usage stats.
• Advertising cookies (optional): only if you opt in.

You can decline non-essential cookies through the banner shown on first visit and change your choice anytime from your browser settings.

7. Public information

Some data is public by design: your listing details, business profile, business hours, published services and prices, public reviews, and your seller display name. Do not include sensitive personal information in public fields.

8. International transfers

Some processors may store or process data outside the Philippines. When this happens we rely on contractual safeguards and provider security certifications consistent with the NPC's guidance on cross-border transfers.

9. Retention

We keep account and listing data while your account is active. After deletion we retain limited data (transaction records, dispute history, fraud signals) for up to 5 years to comply with tax, accounting, and legal requirements. Backups roll off on a fixed cycle.

10. Security

We protect your data with HTTPS, encrypted storage at rest, role-based access control, row-level security on our database, audit logging, and routine security reviews. Sign-in is available via email/password or Google, with leaked-password protection (HIBP) on new and changed passwords and optional two-factor authentication (TOTP) for every account. Two-factor authentication is required for administrator accounts. No system is 100% secure — please use a strong, unique password and enable 2FA where available.

11. Children

The Platform is not directed to children under 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, contact our DPO and we will remove it.

12. Your rights under RA 10173

• Right to be informed about how your data is processed.
• Right to access, correct, or update your data.
• Right to object to or withdraw consent for certain processing.
• Right to data portability (export your account data).
• Right to erasure or blocking, subject to legal retention.
• Right to damages for violations.
• Right to file a complaint with the National Privacy Commission (NPC).

13. Contact

For privacy questions or to exercise your rights, contact our Data Protection Officer at dpo@365motorsales.com. We respond within 15 business days.

13a. 365 Learn (education portal)

When you enrol in or interact with a 365 Learn course we collect lesson-completion timestamps, watch-time per lesson, quiz answers and scores. This data is used to track your progress, gate access to subsequent modules, and issue certificates of completion. Certificate records (your display name, course title and issue date) are made publicly verifiable at /c/<code> so third parties can confirm authenticity — do not enrol under a name you do not wish to appear there. Clicks on Partner Training listings are logged anonymously (no account identifier) and are used only to bill sponsors and surface aggregate analytics.

13b. Export brokerage, referrals & organisation accounts

When you use the export-brokerage flow we collect the data needed to introduce you to overseas buyers and logistics partners (shipping address, contact details, vehicle or parts info, and any documents you upload). This information is shared only with the parties you select for an introduction. Referral participation stores your referral code, attributed sign-ups, and resulting credit balances; we use this to detect self-referral and fraud. Organisation accounts record which user performed each action inside the org (audit log) and which members can see shared listings or messages; the account owner can view this activity for users they invite.

We may update this policy when the Platform changes — for example new processors, new analytics tools, new data fields (such as business hours or pricing catalogs), or updated payment methods. Material changes will be announced on the site and the "Last updated" date above will be bumped. Continued use of the Platform after changes are posted means you accept the updated policy.