Privacy Policy

This policy explains what personal data PropVela collects, why, who processes it for us, how long we keep it, and your rights under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).

Personal information controller: PropVela.
Data Protection Officer: Dominic Swinfield, dom@propvela.com.

1. What we collect

• Waitlist. Your email address, your name if you give it, what you are interested in PropVela as, and whether you asked for our article emails. We also record the IP address and browser (user-agent) details of each sign-up, to prevent abuse such as automated mass sign-ups. If you use "Share with a friend", we collect your name and your friend's name and email address, so we can tell them about PropVela once.
• Careers applications. Your name, email address, phone number, cover note and, if you attach one, your CV.
• Contact form. Your name, email address and message, and the IP address it was sent from. We store every message, to answer your enquiry and to prevent abuse of the form. Only PropVela administrators can read them.
• Enquiry forms. When you use the enquiry form on an agency's, a development's or a Classifieds business's page, we collect your name, email address, phone number if you give it, and your message. We store it and send it to the business concerned: the agency, the development's developer, or the Classifieds business. A sponsored article request collects your company name, the topic, any key points and your email address, and is sent to PropVela.
• Accounts. Your name, email address and phone number. Agents also give their agency, their PRC licence and accreditation details and a government-issued ID for verification; we treat these as sensitive personal information and ask for your explicit consent. Listings and their photos, saved searches, favourites, viewing requests and messages you send through PropVela are also stored with your account. Card details go directly to our payment processor and never reach our servers; we keep only a payment reference.
• Technical data. Standard request logs (IP address, browser type, pages visited, timestamps), rate-limit records that stop forms and AI search being abused (your IP address and, on forms limited per address, the email address you entered; kept for 30 days, see section 4), and error reports when something breaks.
• Banner advertising. When a banner ad is shown on PropVela, or clicked, we record that it happened, with a scrambled (hashed) code made from your IP address and browser details, and a random code your browser makes for that tab, which we cannot reverse to identify you. We use these only to bill advertisers for valid views and clicks and to detect robots and fraudulent repeat clicks, and keep them with the advertiser's billing records.
• Document reference codes (agents' documents). When an agent sends or downloads a generated document from AgentDesk, such as a tenancy agreement or a preview copy of one, we give that copy a reference code, print it on every page and in the file's hidden data, and record in a register the code, the kind of document, the date, how it left (email, download or link), the recipient's name and email address if the agent sent it to someone, and a scrambled fingerprint of its wording. We do this so a copy that turns up where it should not can be traced back, and to give the agent a record of what they sent. A preview copy also carries a watermark and small, meaning-identical differences in wording. The register does not hold the document itself.
• ID documents recorded by agents (AgentDesk). When an agent takes an identity or authority document from a landlord, tenant, occupant, buyer, seller or other contact, they record, with that person's consent, the type of document, the issuing country, the expiry date, the number (stored encrypted) and, if the agent photographs it, the front and back. We record who saw it and when, and every time the number or a photograph is opened. The agent, and the agency owner for compliance checks, can see that it is on file and in what state. Only the last four characters of a number, never the whole number or the photograph, ever appear in a generated document such as a tenancy agreement.

2. Why we use it

• To run the waitlist and tell you when PropVela launches.
• To consider your job application.
• To answer enquiries sent through our contact form, and to prevent abuse of it.
• To pass your enquiry to the agency, developer or Classifieds business you contacted, and to consider sponsored article requests.
• To create and manage your account, publish listings, and connect buyers and renters with agents and owners.
• To verify agents' professional credentials.
• To take payments and send receipts, alerts and account notices.
• To provide AI features such as listing description drafts and AI search.
• To keep PropVela secure and prevent fraud, spam and abuse.
• To meet our legal, tax and accounting obligations.

We do not sell your personal data. A published listing shows the agent's or owner's name and contact details to anyone browsing, and a viewing request shares your details with that listing's agent or owner. We disclose personal data to authorities only where the law requires it.

3. Who processes your data for us

These providers process personal data only on our instructions and only as needed for their service. Some are outside the Philippines, so your data may be processed in other countries; we use providers with appropriate contractual and technical safeguards.

• Supabase — our database, sign-in and file storage, holding the account, listing, waitlist and application data described above.
• Vercel — hosts PropVela and provides cookieless, aggregate page-view counts.
• Resend — sends our emails.
• Sentry — receives error reports so we can fix faults. Hosted in the European Union; reports are deleted after 90 days.
• PayMongo — processes card payments and subscriptions. Card details are entered directly with PayMongo.
• Anthropic (Claude) — powers listing description drafts, AI search and the support chat. The property details, search text or chat messages you send are processed to answer them.
• Cloudflare — Turnstile bot protection on our forms (section 7).
• Amazon Web Services — screens uploaded listing photos and message attachments for inappropriate content, and stores our encrypted off-site database backups.
• Google — Google Maps on agency pages, which loads from Google in your browser (so Google receives your IP address), and travel-time estimates calculated from place names only.

We also use OpenWeatherMap (local weather, from place names), Pexels (stock photos for articles), and Facebook, Instagram and X (to post our own articles). None of these receives personal data about you.

4. How long we keep it

• Waitlist entries, including the IP address and browser details, are kept while the waitlist is in use. You can ask us to remove yours at any time.
• Job applications and CVs are deleted 12 months after you apply, unless you are hired.
• Contact-form messages are deleted 12 months after they are sent.
• Enquiries to an agency, development or Classifieds business are kept while that page is on PropVela and deleted with it. Sponsored article requests are kept while we consider them. You can ask us to delete yours at any time.
• Account data is kept while your account is open, and afterwards for as long as legal, tax and accounting rules require.
• Agent verification documents are kept while the agent account is open, then for 12 months after it closes, then deleted.
• ID documents recorded by agents are kept until the agent's dealings with that person have ended and a retention period has passed. The agent is then asked to confirm the deletion of the record and its photographs. Nothing is deleted without the agent's confirmation, and each deletion is logged without any personal details. You can ask the agent, or us, to see, correct or erase yours at any time.
• Rate-limit records: the IP and email addresses our forms' rate limiter keeps are deleted after 30 days, and AI search records after 24 hours.
• Error reports are deleted after 90 days, and page-view counts after 30 days.
• Backups are kept for a limited period and then deleted, so data you delete from PropVela can remain in a backup until it expires.

5. Your rights

Under the Data Privacy Act you have the right to:

• be informed about how your personal data is processed;
• access the personal data we hold about you;
• have inaccurate or out-of-date data corrected;
• object to processing, including for direct marketing;
• have your data erased or blocked, subject to what the law requires us to keep;
• withdraw consent at any time, where we rely on it;
• receive a copy of the data you gave us in an electronic format (data portability);
• claim damages for harm caused by inaccurate or unlawfully processed data; and
• complain to the National Privacy Commission at privacy.gov.ph.

To use any of these rights, email our Data Protection Officer at dom@propvela.com.

6. Cookies and analytics

We use essential cookies only: one that keeps you signed in, and one ("pv_currency") that remembers the currency you chose for prices. Your cookie choice itself is stored in your browser. Our page-view counts (Vercel Web Analytics) set no cookies and do not follow you between websites.

Our cookie banner asks whether you allow optional analytics cookies. Optional analytics is not switched on at present, so no analytics cookie is set even if you accept; we will update this policy to name the provider before it is. We do not use advertising cookies.

7. Bot protection (Cloudflare Turnstile)

We use Cloudflare Turnstile to tell people apart from automated bots on these forms:

• login;
• sign-up, including agency, Classifieds, promoter, advertiser and Early Access sign-ups;
• password reset;
• waitlist, including the For agents page;
• job application;
• share-with-a-friend;
• contact;
• valuation request;
• developer enquiry;
• viewing request;
• agent rating;
• send-details (sending a property's details from a viewing request);
• agency enquiry;
• development enquiry;
• Classifieds enquiry;
• sponsored article request.

When one of these forms is used, Cloudflare receives your IP address and signals from your browser, such as its type and settings, to decide whether the request comes from a person. Cloudflare sets no advertising cookies, and we use the result only to block automated abuse.

8. Changes to this policy

We will update this policy as PropVela changes, and change the "Last updated" date above when we do. For material changes we will tell you directly where we can.