Privacy Policy
Last updated: November 5, 2026 · Version 2026-11-05
DOHTAP (“we”, “us”) makes NFC and QR cards and the online hub that runs them. We respect your privacy and follow the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules, and the issuances of the National Privacy Commission (NPC). This page explains what personal data we collect, why, who we share it with, how long we keep it, and your rights.
1. Who is responsible for your data
The personal information controller is DOHTAP (sole proprietorship), Talisay City, Cebu, Philippines. Our Data Protection Officer (DPO) is Data Protection Officer, DOHTAP, reachable at privacy@dohtap.com.
2. What we collect
| When | What we collect |
|---|---|
| You create an account | Name, email, password (stored scrambled, we cannot read it), the date you accepted these terms. |
| You order or ask for a quote | Name, business name, mobile number, email, delivery address, Google Maps link, notes, payment method, and payment proof you upload (e.g. GCash or bank screenshot). |
| You set up your card or business page | Business name, logo, photos, links, social media, address or location, menu, and other details you choose to publish. |
| Someone taps or scans a card | The card ID, time, which link was opened, and basic device information (browser type, language, approximate country). We count link clicks; we do not see what people write on Google. |
| You share your contact on a card, join a loyalty program, or join the Community | The name, email, phone, note or business details you type in, and your points or referral history. |
| You use the website | Cookies needed for login and your cart, and, only if you click “Accept all”, anonymous page-visit statistics. |
We do not ask for sensitive personal information (such as health, religion, government ID numbers) and ask you not to send it to us.
3. Why we use it (and our legal basis)
- To provide what you ordered: make and deliver your cards, set up your hub, confirm payments, and give support. (Needed to fulfil our contract with you.)
- To run your card and show you your link-click reports. (Contract.)
- To pass on a contact or message that a visitor chose to send to a card owner. (Consent of the visitor.)
- To keep DOHTAP safe: stop fraud, spam and abuse, and keep records of orders and payments as the law requires. (Legitimate interest and legal obligation.)
- To improve DOHTAP using page-visit statistics. (Only with your consent through the cookie banner.)
- To send you news or offers, only if you agreed. You can stop anytime.
We do not sell your personal data.
4. Who we share it with
We only share what is needed, with service providers that are bound to protect it:
- Supabase (database, login and file storage), servers in Singapore.
- Vercel (website hosting and, with consent, anonymous visit statistics), servers in Singapore and other regions.
- Couriers (e.g. LBC, J&T) when you choose delivery: your name, number and address.
- Resellers / partners who sold you your card: only your order and customer details for that sale.
- Government authorities, when the law requires it.
Because some providers store data outside the Philippines, your data may be transferred abroad. We stay responsible for it and choose providers that use strong security.
5. How long we keep it
- Account and hub data: while your account is active, then deleted or anonymised within 1 year after you close it.
- Orders, receipts and payment records: up to 10 years, for tax and accounting rules.
- Tap and link-click logs: up to 3 years, then deleted or kept only as totals.
- Contact-exchange, loyalty and quote messages: until you or the card owner asks us to delete them, or 3 years of no activity.
6. How we protect it
- All connections use HTTPS encryption.
- Database rules (row-level security) make sure each customer and reseller can only see their own data.
- Passwords are stored scrambled (hashed). Secret keys are kept on the server, never in the website code.
- Only authorised DOHTAP staff can open admin pages, and access is logged.
If a personal data breach happens that may cause serious harm, we will notify the NPC and the affected people within 72 hours of finding out, as the law requires.
7. Your rights
Under RA 10173 you have the right to: be informed; access your data; object to processing; correct wrong data; have it erased or blocked; get a copy in a common format (data portability); withdraw consent anytime; claim damages; and file a complaint with the National Privacy Commission (privacy.gov.ph).
To use any of these rights, email privacy@dohtap.com. We reply within 15 working days. We may ask you to prove it is you first.
8. Cookies
| Type | What it does | Can you turn it off? |
|---|---|---|
| Essential | Keeps you logged in (Supabase login cookies), remembers your cart and your cookie choice, remembers a loyalty card you joined. | No, the site does not work without them. |
| Statistics | Vercel Analytics counts page visits without ads or cross-site tracking. | Yes. It only runs if you click “Accept all”. |
Change your choice anytime: .
9. Children
DOHTAP is for businesses and adults. We do not knowingly collect data from children under 18. If you think a child gave us data, contact us and we will delete it.
10. Changes
We may update this policy. We will change the date above and, for big changes, tell account holders by email or in the hub.
Questions? Email privacy@dohtap.com or message us on Instagram. See also our Terms of Service.