1. Information we collect
From everyone with an account:
- Your email address and password (the password is stored in hashed form, never in readable text).
- Profile details you add, such as your name, phone number, gender, date of birth and photo.
- Sign-in records: the date and time, device and browser type, and IP address of each sign-in, and your active sessions.
- If you choose "Continue with Google", the email address Google confirms for you.
From spa owners, for verification:
- A government-issued ID (front and back) and a face scan taken in the app to confirm the ID is yours.
- Business documents: the DTI Business Name Certificate and each branch's mayor's permit, with the business name, address and location.
From spa businesses, as they use Servora:
- Staff records: names, contact details, roles, schedules, attendance, the services each staff member performed and their commission.
- Client records the spa keeps: names, contact details, appointments, bills, payments recorded and program balances.
- Subscription and billing records for the business's plan. Card and e-wallet details are handled by our payment provider; we do not store full card numbers.
From clients using the mobile app:
- Your bookings, queue status, receipts, reviews, and your points, vouchers and memberships with each spa.
- Your location, only while you use the app and only if you allow it, to show spas near you. It is not shared with spas.
2. Why we use it
- To create and secure your account, including email verification and, where enabled, two-factor sign-in.
- To confirm that a spa business and its owner are real before it can operate on Servora.
- To run the features you use: bookings, queues, billing, staff management, reports and customer programs.
- To process subscription payments and send receipts and reminders.
- To send service messages, such as verification emails, booking updates and security alerts.
- To keep an audit trail of important actions, prevent fraud and abuse, and fix problems.
- To meet legal obligations.
We rely on your consent, on what is needed to provide the service you asked for, on our legitimate interest in keeping Servora safe and working, and on legal requirements, as the case may be.
3. Who we share it with
- Spas you book with: when a client books, the spa sees the client's name and phone number and the booking details, so it can serve and contact the client.
- Staff of the same business: owners, managers and front-desk staff see the records of their own business and branches, according to the permissions the owner sets.
- Service providers that process data for us: a payment provider (Xendit) for subscription payments, a file-storage provider (Cloudinary) for uploaded documents and images, an email delivery provider for emails, and our hosting and database providers.
- Map services: showing maps and looking up addresses sends map requests to OpenStreetMap-based services.
- Authorities, when the law requires it.
We do not sell personal information. Some providers may store or process data outside the Philippines; where they do, we require them to protect it.
4. Verification documents
IDs, face scans and business documents are used only to verify the owner and the business. They are stored privately and can be opened only by the owner who submitted them and by Servora administrators who review verifications.
5. How long we keep it
We keep personal information for as long as your account or your business's account is active, and afterwards for as long as needed for legal, tax, accounting and dispute purposes.
When a client deletes their account in the mobile app, their sign-in details are anonymised and the account is deactivated. Records a spa needs to keep, such as past bills, remain with that spa.
6. How we protect it
- Passwords are hashed.
- Connections to Servora are encrypted in production.
- Access inside a business is limited by role and permission. What Servora administrators can do is limited by permission, and their actions are recorded in an audit log.
- Administrators can protect their accounts with two-factor authentication.
- Repeated sign-in and verification attempts are rate-limited.
No system is completely secure. If a breach affects your personal information, we will notify you and the National Privacy Commission as the law requires.
7. Your rights
Under the Data Privacy Act you have the right to be informed, to access your personal information, to correct it, to object to or withdraw consent for its processing, to have it erased or blocked where the law allows, to receive a copy in a portable format, and to complain to the National Privacy Commission.
You can see and change most of your details in your profile. For anything else, write to [Contact email]. If your information was entered by a spa (for example as its client or staff member), we may refer your request to that spa, which decides how its records are kept.
8. Children
Servora is not intended for children. We do not knowingly collect personal information from anyone under 18.
9. Cookies and device storage
The web app uses a cookie to keep you signed in and small amounts of browser storage to remember preferences such as theme and table view. The mobile app stores your sign-in and preferences on your device. We do not use advertising cookies.
10. Changes to this policy
We may update this policy. The date at the top shows when it last changed. If a change is significant, we will tell you in the app or by email.
11. Contact
For privacy questions or requests, contact our Data Protection Officer: [DPO name], [Company name], [Business address]. Email: [Contact email].