Privacy Policy

Bleuspace Properties Corp. ("Bleuspace", "we", "our") respects your privacy and protects your personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission. This Privacy Policy explains what data we collect when you use our direct booking platform at bleuspace.co, how we use it, who we share it with, and the rights you have over it.

1. Who we are

Bleuspace operates a direct booking platform for short-term, monthly, and long-term residential stays across the Philippines. We act as a personal information controller for your booking and account data.

Contact: privacy@bleuspace.co
Business registration details (registered office address, BIR TIN, and SEC/DTI registration number) are available on request. Email hello@bleuspace.co.

2. What personal data we collect

• Identity: first and last name, email address, phone number.
• Booking: dates of stay, party size, property selected, special requests, government-issued ID details collected by Guesty for check-in compliance.
• Payment: we do not store full card or wallet credentials. Payment information (card number, GCash/Maya/GrabPay account) is collected and tokenized directly by PayMongo, our PCI-DSS Level 1 payment processor. We retain only the PayMongo session reference, masked last-four digits where provided, and the payment status.
• Account: if you sign in with a magic link or Google OAuth, we store your email, the authentication provider, and a session token.
• Communications: messages you send to us through the website, email, or in-property channels.
• Technical: IP address, device type, browser type, pages visited, referrer, timestamps. Captured automatically through standard web logs and the analytics tools described below.

3. How we use your data

• To create, confirm, and service your reservation.
• To process payment and issue receipts.
• To communicate with you about your stay (confirmation, check-in instructions, support).
• To comply with Philippine tax, accommodation, and tourism regulations.
• To prevent fraud, abuse, and unauthorized access to the platform.
• To improve our services through aggregated, anonymized usage analytics.
• To send marketing communications, only if you have opted in. You may withdraw consent at any time using the unsubscribe link in our emails or by emailing privacy@bleuspace.co.

4. Legal bases for processing

We process your personal data on the following grounds under RA 10173:

• Contract: to perform the booking contract you enter with us.
• Legal obligation: to comply with tax, accommodation, and AML regulations.
• Legitimate interest: to secure the platform, prevent fraud, and improve our services.
• Consent: for marketing communications and for any sensitive data we may need to process for special requests.

5. Where your data is stored and how long we keep it

Personal data is stored on Supabase Postgres infrastructure in the ap-northeast-2 (Seoul) region, encrypted at rest, with row-level security enforced. Backups are encrypted. Access is limited to authorized Bleuspace personnel and audited.

We retain reservation records for the longer of (a) ten (10) years from the stay end date, in accordance with BIR record-keeping requirements, or (b) the duration of any open dispute or claim. Account-only records (no bookings) are deleted twenty-four (24) months after last sign-in.

6. Who we share your data with

We only share what is necessary to deliver your stay or comply with the law:

• Guesty: our property management system. Receives guest identity, booking details, and check-in/out timestamps.
• PayMongo: our payment processor. Receives the data needed to process your payment under PCI-DSS rules. We never receive raw card data.
• Resend: our transactional email provider. Receives the email address and templated message body.
• Supabase: our database and authentication provider.
• Mapbox: provides map tiles. Receives device IP and approximate location for tile rendering.
• PostHog: product analytics. Receives anonymized event data; we do not send raw email or payment fields.
• AI assistant: our concierge agent uses an AI language model to help draft replies to common guest questions on our team's behalf. The model receives the message text and recent thread context with personally identifying contact details (email, phone, card-style numbers) automatically redacted before transmission, plus the property name and check-in / check-out times. Door codes, Wi-Fi passwords, and access instructions are only shared with the model when your question is directly about access (for example check-in or lockout). The model provider does not retain prompts for training under the tier we use. Drafts are reviewed by our staff before any reply is sent. If you prefer not to have your messages processed by an AI assistant, write to privacy@bleuspace.co and we will route your conversation through a human-only path.
• Property owners and on-site staff: receive your name, party size, and arrival window so they can prepare the unit.
• Government and regulators: only when required by law or valid legal process.

We do not sell or rent personal data to third parties.

7. Cookies and similar technologies

We use a small number of essential cookies and local storage entries:

• Supabase authentication cookies, to keep you signed in.
• Mapbox cookies, to render interactive maps.
• PostHog anonymous ID, to distinguish anonymous sessions for analytics.

We do not use third-party advertising or cross-site tracking cookies.

8. Your rights under the Data Privacy Act

You have the right to:

• Be informed about what personal data we hold and how we use it.
• Access a copy of your personal data.
• Correct inaccurate or out-of-date data.
• Erase data when it is no longer necessary, subject to retention requirements above.
• Object to processing, including direct marketing.
• Receive a portable copy of your data in a structured, commonly used, machine-readable format.
• Lodge a complaint with the National Privacy Commission (privacy.gov.ph).

To exercise any of these rights, email privacy@bleuspace.co. We will respond within fifteen (15) working days, in line with NPC Circular 16-04.

9. Security

We apply industry-standard administrative, physical, and technical safeguards, including TLS in transit, encryption at rest, principle-of-least-privilege access, signed and verified webhook delivery, secret rotation, and continuous log review. No online platform is perfectly secure; if a breach occurs, we will notify affected guests and the National Privacy Commission within seventy-two (72) hours, in line with RA 10173 §38 and NPC Circular 16-03.

10. International transfers

Some service providers operate servers outside the Philippines, including Supabase (South Korea), Resend, Mapbox, PostHog (United States), and the AI language model used by our concierge agent (China). Where data is transferred abroad, we ensure comparable protection through contractual safeguards and, for the AI assistant specifically, through programmatic redaction of personally identifying contact details applied before any transmission.

11. Children

Bleuspace is not directed at children under 18. We do not knowingly collect personal data of minors except when included by their parent or guardian as part of a booking party.

12. Changes to this policy

We may update this Privacy Policy as our services evolve or as regulation changes. The "last updated" date at the top reflects the most recent revision. Material changes will be communicated via email to active account holders.

13. Contact

Data Protection Officer · Bleuspace Properties Corp.
privacy@bleuspace.co
Registered office address and statutory identifiers are available on request. Email hello@bleuspace.co.