Privacy Policy

Effective and last updated: October 16, 2026

Information you provide and how we use it

Purchase-detail validation: if you select Validate in the purchase preview, your entered email address and selected guide are sent to our server to check the details and return the result. This validation does not save the email in our application database, create an order, or send it to PayMongo. The email may remain visible in the open preview until it is closed.

Support and privacy requests: when you email us or message the linked ZC Tap Facebook page, we receive the contact details, message, attachments, and any profile information you choose to share through that service. We use them to answer your request, resolve the issue, and handle applicable privacy obligations. The website has no message-submission form and does not automatically copy those communications into its database. Please do not send passwords, access codes, payment credentials, or unnecessary sensitive information.

Private guide access: when you enter an access code on the access page, our server checks it against access records to decide whether a download may be provided. The submitted code is used for that request and is not saved by the form in browser storage or retained as a new application record. Temporary download links are not saved by the application for later use. Your browser may keep downloaded files or download history under its own settings.

Administration: authorized administrators provide an email address and password to sign in. Supabase processes authentication and maintains account, session, and authentication-event records so that we can restrict administrative access and investigate security issues. This is separate from customer access; the site does not currently offer customer accounts.

Hosting and technical information

Vercel hosts this website and processes requests needed to serve and protect it. Technical information can include IP address, request path, request time, browser or device information, response status, and diagnostic or security information. This infrastructure processing is separate from visitor analytics. We do not intentionally log checkout email addresses, passwords, or access codes in application diagnostics.

Do not put private information in links or campaign parameters. Information sent in a request may be processed by the hosting infrastructure even when the application does not retain it in its database.

Browser storage and analytics

On the homepage, the site stores limited arrival-source information in session storage in your browser. It can record direct arrival, a referring website's hostname, or recognized campaign labels for source, medium, campaign, term, and content. This keeps the first qualifying source context for the current page session. The stored context excludes the full page URL, full referring URL, and advertising click IDs. It does not contain a persistent visitor identifier or create a customer profile.

Session storage is different from a cookie. It normally lasts for the page session; browser session restoration or tab duplication can preserve or copy it. You can clear it through your browser's site-data controls. Blocking storage does not prevent you from reading the public pages.

Visitor analytics collection is currently disabled. This source context is not currently sent to PostHog, our staged analytics provider, or associated with an order. The site adds no analytics cookies or analytics local storage. Administrative sign-in uses authentication cookies. Hosting and security services may also apply their own necessary controls; this policy does not claim that every visit is cookie-free.

Why processing is permitted

We use requested purchase-detail validation and access checks to take steps you request in connection with the guides or to provide access where an entitlement exists. We answer ordinary support enquiries for our legitimate interest in responding to people who contact us, using only information relevant to their request.

We rely on legitimate interests to operate and secure the website and administrator access. This includes limited technical diagnostics and authentication records, with restricted access and retention. Session-scoped source context supports our limited interest in understanding arrival sources without a persistent identity or current analytics transmission. These interests must be balanced against your rights; you may contact us to object.

We process privacy requests to meet applicable legal obligations. Where particular processing requires consent, we must obtain that consent separately. Reading this policy or using the website is not blanket consent to unrelated processing.

Who receives information

People specifically authorized by ZC NFC to handle a request or administer the service may access information needed for that work. Vercel provides hosting and request processing. Supabase provides database, private-file access, and administrator authentication services.

Google processes email sent to our Gmail support address. If you contact us through Facebook, Meta processes the communication through that platform. Following an external link does not itself submit a support message. Those services also have their own privacy practices.

Public purchasing and payment are currently disabled. Customer email automation is inactive. The site does not currently send visitor checkout details to PayMongo or send automated customer messages through Resend. PostHog does not currently receive visitor analytics from the site.

We may disclose relevant information where a legal obligation requires it or where necessary to establish, exercise, or defend a specific legal claim. We assess the request and limit disclosure to what is appropriate.

Our service providers operate internationally, so information may be processed outside the Philippines. We remain responsible for the processing we control and use appropriate access restrictions and provider arrangements. External providers' own independent processing is governed by their privacy notices.

How long information is kept

Routine support communications are kept while the request is open and for up to 120 days after resolution for follow-up, then reviewed for deletion. We review retention monthly. A minimal record of a privacy request, our decision, and its completion is kept for up to 12 months after resolution to demonstrate how we handled it. Unnecessary identity-verification material is removed when verification is complete.

Administrator account information is kept while administrative access is needed and is reviewed for removal within 30 days after that need ends. Authentication and security records under our control are kept for up to 120 days. Relevant evidence of a specific security incident may be kept until the incident is resolved and for up to 120 days afterward.

Provider-managed technical logs follow the applicable service's rolling retention and legal or security requirements. Vercel's current Hobby runtime-log access window is one hour; that window is not a promise that every provider-held record is erased within one hour. Copies we deliberately retain for investigation follow our security-record rule.

Checkout validation and submitted access codes are processed transiently without new application records, as described above. Arrival-source context follows the browser's session-storage lifetime. We do not apply a future customer-order retention period while public order storage is disabled.

If a specific legal requirement or unresolved claim requires longer retention, we restrict the affected records, document the reason, and review them until that requirement ends. We do not retain information simply for an unspecified future use. Deletion from systems we control does not erase another person's copies or independently retained provider records.

Protecting information

We use reasonable organizational and technical safeguards, including encrypted connections, restricted administrative access, private file storage, and server-side handling of secrets. Access is limited to the work being performed. No online system can guarantee complete security.

Your privacy rights

Under the Philippine Data Privacy Act, subject to applicable conditions and exceptions, you have rights to be informed, access your information, object to processing, correct inaccurate information, seek erasure or blocking, obtain data portability where applicable, file a complaint, and seek damages where legally available.

Email us to exercise a right or ask about processing. Describe your request without including passwords or access codes. We may reasonably verify your identity before disclosing or changing information. We assess requests under applicable law and explain any relevant limits rather than promising immediate deletion of every record.

You may also raise a complaint with the Philippine National Privacy Commission using its official website linked below. The website does not currently use personal information for solely automated decisions producing legal or similarly significant effects.

Changes to this policy

We will review this policy when processing practices or legal requirements change and display the updated date. New processing, including customer payments, automatic customer emails, or analytics collection, requires a fresh privacy review and any notice or consent required by law before activation.