Privacy Policy

1. Who we are and our role

WaterApp (“WaterApp”, “we”), operates the WaterApp website and app at getwaterapp.com.

We act in two roles:

• Personal information controller for the data of station owners and staff who create a WaterApp account (their name, email, mobile number, login and billing details).
• Personal information processor for the data a station collects from its own customers (name, mobile number, address, orders). The station is the controller of its customers' data and decides what to do with it. We process it only to provide the service to that station.

2. What we collect

• Account data (owners and staff): name, email, mobile number, role, a hashed password (we never store the password itself), profile photo if added.
• Station data: station name, address, hours, logo and cover photo, products and prices, delivery areas, payment QR details the station chooses to show.
• Customer data entered by stations or by customers ordering online: name, mobile number, delivery address and notes, order history, credit (utang) records, and, if a customer chooses to save their details, a hashed 4–6 digit PIN (never the PIN itself).
• Payment records: receipts or screenshots uploaded as proof of GCash/Maya payment, and records of subscription payments. For card payments, the card details are entered on our payment partner's page and are never seen or stored by us.
• Support messages you send us, and images you attach.
• Technical and security data: login and activity records (who did what and when), and our server logs. We do not store IP addresses in our database.
• Notification data: if staff turn on phone notifications, a notification address issued by their browser or phone maker. It contains no personal details.
• Anonymous visit statistics about our homepage (page visits, which button was tapped, device type, browser, how the visitor arrived). These use a random per-tab code, are not linked to any person, and are not collected at all if your browser sends “Do Not Track”.

3. Why we use it

• To create and run your account and your station's online store, orders, deliveries, inventory and reports (contract).
• To take and confirm subscription payments, and to send billing statements and service notices (contract and legitimate interest).
• To keep the service secure, prevent abuse and fraud, and keep an audit trail (legitimate interest and legal obligation).
• To answer support requests (legitimate interest).
• To improve the homepage and product using anonymous statistics (legitimate interest).
• Where the law requires your consent, we ask for it, and you may withdraw it at any time.

We do not sell personal data and we do not use it for advertising.

4. Who we share it with

Only with service providers who help us run WaterApp, under agreements that require them to protect the data:

• Hosting and database providers (Vercel for the website, Supabase for the database and file storage).
• Creem, our payment partner and merchant of record, for card subscription payments. Creem receives the payer's email and payment details and has its own privacy policy.
• Browser and phone push services (for example Google, Apple, Mozilla) only to deliver notifications you turned on.
• The station you order from sees the details you give when ordering.
• Government or law enforcement when the law requires it.

Rider names and photos are shown to customers whose orders they deliver. Station reviews show only a shortened customer name (for example “Maria S.”).

5. Storage and transfers outside the Philippines

Our providers run data centers outside the Philippines, so your data may be stored and processed abroad. We use providers that apply appropriate security measures, and we remain responsible for the data we transfer to them.

6. Cookies and similar tools

We use only what is needed for WaterApp to work:

• Sign-in cookies that keep staff and customers logged in on their device. These are essential and cannot be turned off without signing out.
• Local storage on your device for your shopping cart, your notification and sound choices, and to remember that you have seen the privacy notice.

We do not use advertising or cross-site tracking cookies.

7. How long we keep it

We keep account and station data while the account is active. When a station deletes its account or asks us to, we delete its records, except what we must keep for legal, tax or audit reasons (for example the record that the deletion took place). Anonymous visit statistics may be kept in aggregate form. Station owners can delete or correct their customers' records in the app.

8. How we protect it

• Connections are encrypted (HTTPS). Passwords and customer PINs are stored only as one-way hashes.
• Each station can only see its own data. Staff see only what their role allows.
• Repeated wrong PIN or password attempts are limited, and sign-in sessions can be ended.
• Important actions are recorded in an audit log.

If a personal data breach occurs that is likely to harm you, we will notify the NPC and the affected people within the time the law requires (72 hours from knowledge of the breach).

9. Your rights under the Data Privacy Act

As a data subject you have the right to:

• Be informed how your data is collected and used (this policy).
• Access the personal data we hold about you.
• Object to processing, including for direct marketing, or withdraw your consent.
• Correct inaccurate or outdated data.
• Erase or block data that is incomplete, outdated, false, unlawfully obtained, or no longer needed.
• Data portability: get your data in a common electronic format where it is processed electronically.
• Claim damages if you were harmed by inaccurate, unlawfully obtained or unauthorized use of your data.
• Lodge a complaint with the National Privacy Commission (privacy.gov.ph).

To use these rights, contact us (see section 12). If your data is held by a station as its customer, you may also ask that station directly; we will help it respond. We may need to verify your identity first.

10. Children

WaterApp is for businesses and is not directed to anyone under 18. Please do not create an account if you are under 18.

11. Changes to this policy

If we change this policy in an important way we will show a notice in the app or on the website. The date at the top shows when it was last updated.

12. Contact and complaints

Questions, requests or concerns about your data:

• Through our Help center.

You may also contact the National Privacy Commission: privacy.gov.ph.