1. Who We Are
benta.app is operated by Tempestra Information Technology Services (DTI-registered sole proprietorship), providing a multi-tenant e-commerce platform for Filipino small sellers ("Merchants") to build and manage online stores.
This Privacy Policy explains how we collect, use, store, and protect personal information of Merchants (store owners) and their Customers (buyers) in compliance with the Philippine Data Privacy Act of 2012 (RA 10173) and related regulations.
2. Information We Collect
From Merchants (you, the store owner)
- Account information: email address, display name, profile photo (when signing in via Google, Facebook, or Microsoft)
- Store information: store name, store URL slug, theme preferences, product listings, pricing
- Payment gateway credentials: we store your gateway account IDs (PayMongo, Xendit) but never your full secret keys in our database
- Usage data: pages visited, actions taken, AI quota usage
From Customers (buyers on merchant storefronts)
- Order information: name, email address, phone number, delivery address
- Payment data: payment is processed by PayMongo or Xendit directly — benta.app never stores card numbers or full payment credentials
- Session data: temporary cart data stored in browser sessionStorage only
Automatically collected
- IP address, browser type, device type (for security and analytics)
- Cookies necessary for authentication (Supabase session cookies, locale preference)
3. How We Use Your Information
- To create and maintain your merchant account and online store
- To process orders and facilitate payments between buyers and sellers
- To send transactional emails (order confirmations, account verification)
- To provide AI-powered features (product auto-fill from photos) — images are sent to Google AI for processing and are not retained
- To improve the platform, debug issues, and prevent fraud
- To comply with legal obligations under Philippine law
We do not sell your personal data to third parties. We do not use your data for advertising.
4. Third-Party Services
We use the following third-party services to operate benta.app:
| Service | Purpose | Data shared |
|---|---|---|
| Supabase (USA) | Authentication, database hosting | Account data, store data |
| Cloudflare R2 (USA) | Product image storage | Images you upload |
| PayMongo (Philippines) | Payment processing | Order amount, buyer email |
| Xendit (Indonesia/Philippines) | Payment processing | Order amount, buyer email |
| Google AI Studio (USA) | AI photo auto-fill feature | Product images (not retained) |
| Google OAuth | Optional sign-in method | Email, name, profile photo |
| Meta (Facebook OAuth) | Optional sign-in method | Email, name, profile photo |
| Microsoft (Azure OAuth) | Optional sign-in method | Email, name, profile photo |
| Resend (USA) | Transactional email (order confirmations, account emails) | Buyer email address, merchant email address |
| remove.bg (EU) | Product image background removal feature | Product images you upload (processed, not retained) |
| Vercel (USA) | Web hosting and CDN | Request logs |
5. Cookies
We use only essential cookies:
- sb-* — Supabase authentication session (required to stay logged in)
- benta-locale — Your language preference (Taglish / English)
We do not use advertising cookies, tracking pixels, or third-party analytics cookies.
6. Data Retention
- Merchant account data: retained while your account is active and for 30 days after deletion request
- Order data: retained for 7 years to comply with BIR record-keeping requirements
- Waitlist emails: retained until you request removal or we launch publicly
- Product images on Cloudflare R2: deleted when you delete the product or your account
7. Your Rights (Under RA 10173 / PDPA)
As a data subject, you have the right to:
- Access — Request a copy of your personal data we hold
- Correction — Request correction of inaccurate data
- Erasure / Right to be Forgotten — Request deletion of your data (subject to legal retention requirements)
- Data Portability — Request your data in a machine-readable format
- Object — Object to certain types of processing
- Withdraw Consent — Withdraw consent at any time where processing is based on consent
To exercise any of these rights, email us at privacy@benta.app. We will respond within 15 business days.
8. Facebook / Meta Data Deletion
If you signed in to benta.app using Facebook and wish to have your data deleted, you can:
- Email us at privacy@benta.app with subject line "Facebook Data Deletion Request" and include the email address associated with your Facebook account.
- We will delete your benta.app account and associated data within 30 days and send you a confirmation.
You can also remove benta.app's access to your Facebook account by going to Facebook Settings → Apps and Websites → Remove benta.app. This revokes our access to your Facebook login but does not automatically delete data already stored — please email us if you also want stored data deleted.
9. Children's Privacy
benta.app is not directed at children under 18. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a child under 18, we will delete it promptly.
10. Security
We implement industry-standard security measures including: encrypted connections (HTTPS/TLS), Row Level Security (RLS) in our database so each merchant can only access their own data, and server-only secret keys stored as environment variables (never exposed to the browser).
No system is 100% secure. In the event of a data breach that affects your rights, we will notify the National Privacy Commission (NPC) and affected users within 72 hours as required by law.
11. Changes to This Policy
We may update this policy from time to time. When we make material changes, we will notify registered Merchants via email and update the "Last updated" date at the top of this page. Continued use of the platform after changes constitutes acceptance of the updated policy.
12. Contact Us
For privacy-related concerns, data requests, or complaints:
- Email: privacy@benta.app
- Platform: https://benta.app
- Business: Tempestra Information Technology Services (DTI-registered sole proprietorship)
You also have the right to lodge a complaint with the National Privacy Commission of the Philippines at privacy.gov.ph.