Roompal
Privacy Policy
This policy explains what personal data Roompal collects, why, who sees it, how long we keep it, and your rights under the Data Privacy Act of 2012 (RA 10173). It covers the Roompal mobile app and the website at roompal.ph.
1. Who we are
Roompal Real Estate Intermediary Services ("Roompal", "we") is the personal information controller for the data described here. Our Data Protection Officer is [Data Protection Officer to be provided], reachable at roompal.ph@gmail.com or [business address to be provided], Philippines.
When a landlord receives an applicant's information through Roompal, that landlord also becomes responsible for it under the Data Privacy Act, and must follow the Landlord Policy.
2. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email, phone number, profile photo, date of birth, sign-in method, roles, landlord business name, notification settings | You; Google or another sign-in provider you choose (name, email, photo) |
| Identity verification | ID type; photos of the front and back of your government ID; one selfie; the result of an on-device blink check; your profile name at the time; a fingerprint (hash) of each image; the review outcome | You, through the in-app camera |
| Renter Resume | Personal details and address; employer, position and monthly income; rental history, including past landlords' names; up to 2 references (name, relationship, phone); emergency contact; social media links; documents you upload, such as a government ID, proof of income, proof of billing, payslip, employment certificate, bank statement or NBI clearance | You |
| Guarantor profile | Relationship to the renter, employer, position, years employed, monthly net income, income documents (ITR, BIR Form 2316, bank statement, payslip), and when you accepted guarantor liability | You; the renter who invited you (your name, relationship, email and phone) |
| Listings | Property address, photos, videos, description, price, fees, house rules, amenities, questions for applicants, and property documents (title or deed, barangay clearance, fire safety certificate) | Landlords |
| Applications and viewings | Move-in date, answers to the landlord's questions, status, viewing date and type, change requests, when the landlord opened your application, and the landlord's decline reason and notes | Renters and landlords |
| Messages | Text of messages, who sent them, and when they were sent and read | You and the people you message |
| Leases | Lease terms, the typed name and drawn signature of each signer, a hash of the signed text, signing time, IP address and device details, and rent payments the landlord records | Renters, landlords and guarantors |
| Purchases | Store, transaction ID, product, price, currency and subscription status. We never receive your card or bank details. | Apple App Store or Google Play |
| Support and safety | Support requests (name, email, message), reports you file or that are filed about you, warnings, and moderation decisions | You, other users, Roompal staff |
| Device and usage | Push notification token, device platform, app integrity check (App Check), IP address and server request logs, saved favourites, notification inbox | Your device and our servers |
| Website | Your email address, if you ask to be told when the app launches | You |
We do not read your precise device location, contacts, call logs or microphone. The app uses the camera only when you take photos for verification, and your photo library only for files you pick. Map searches are used to show results and are not saved to your account.
Some of this is sensitive personal information under the law, such as government ID numbers and your age or date of birth. We process it only with your consent or where the law allows.
3. How identity verification works
- Before you photograph your ID, we ask you to accept the Identity Verification Consent, and we record which version you accepted.
- The blink check runs only on your phone. No video or camera frames leave your device; only the result is sent.
- A trained Roompal reviewer compares your selfie with your ID photo by eye. We do not use automated facial recognition or create a face template.
- We remove all image metadata, including GPS location, as soon as a photo arrives. Images are never given a link, so no one can open them outside our review tools, and every view is logged.
- We delete the images soon after a decision (see section 8). We keep only the outcome.
4. Why we use your data
| Purpose | Lawful basis under RA 10173 |
|---|---|
| Create and run your account, publish listings, send applications, schedule viewings, deliver messages and notifications | Needed to provide the service you asked for (contract) |
| Verify your identity and property documents, and show verification badges | Your consent |
| Share your Renter Resume and documents with landlords you apply to, and a guarantor's profile with the renter's landlord | Your consent, given when you apply or co-sign, and the contract |
| Record e-signatures and keep lease records | Contract; establishing or defending legal claims |
| Verify store purchases, apply credits and Premium, and prevent payment fraud | Contract; our legitimate interest in preventing fraud |
| Investigate reports, prevent scams and abuse, keep audit logs of who viewed documents | Our legitimate interest in keeping users safe; legal claims |
| Show ads in the free version of the app | Your consent |
| Send news and offers | Your consent; marketing is off until you turn it on |
| Answer support requests and improve the service | Contract; our legitimate interest |
| Comply with the law, court orders and lawful requests from authorities | Legal obligation |
We do not sell your personal data. We do not use it for automated decisions that have legal or similarly significant effects on you.
5. Who sees your data
Other Roompal users
- Anyone can see a published listing, the landlord's display name and photo, and the approximate area. The exact address is shared only with a renter whose application is approved.
- A landlord you apply to can see your application, your full Renter Resume and its documents. Images are watermarked with the viewer's ID and the time, and every view is logged.
- A landlord sees a guarantor's name, relationship, photo, employment, income, verification status and the titles of their documents, but not the documents themselves.
- People you message see your messages and your display name.
Service providers, who process data only on our instructions:
| Provider | What they do | Where |
|---|---|---|
| Google Cloud and Firebase | Hosting, database, file storage, sign-in, push notifications, app integrity checks | Singapore (asia-southeast1); sign-in and push run on Google's global network |
| Google Maps Platform | Maps and address search; the text you type into an address search is sent to Google | Google's global network |
| Google AdMob | Ads in the free version of the app | Google's global network |
| Apple and Google | App store purchases and subscriptions | Their global networks |
Others, only when needed: Roompal staff whose role requires it (for example, only verification and trust and safety staff can see ID images); professional advisers; authorities when the law requires it or to protect someone's safety; and a buyer or successor if Roompal's business is transferred, under the same protections.
6. Ads
The free version of the app shows ads from Google AdMob on renter screens. Premium members see none. Google may use your device's advertising ID and information about the app to choose and measure ads, and may personalise them. Google never receives your messages, documents or verification photos. You can reset or delete your advertising ID in your phone's settings (Android: Settings, Google, Ads; iPhone: Settings, Privacy and Security, Tracking). See Google's policy at policies.google.com/technologies/ads.
7. Transfers outside the Philippines
Our servers and files are stored in Singapore. Some providers above process data elsewhere. We use providers that protect data to a standard comparable to Philippine law, under written agreements, as RA 10173 requires.
8. How long we keep your data
| Data | How long |
|---|---|
| ID verification photos | Deleted automatically: unfinished attempts after 7 days, after approval within 7 days, after rejection after 30 days (the appeal window), and at once if you withdraw. Never kept more than 80 days after first upload. |
| Verification outcome (result, reason, ID type, image hashes, name if approved) | Until you delete your account |
| Account, Renter Resume, documents, guarantor profile, favourites, notifications, push tokens | Until you delete them or your account |
| Applications, listings and messages shared with another user | Kept after you leave, for the other person's records and for legal claims, for up to 5 years; your name is shown as "Deleted user" |
| Leases, signatures and rent records | 10 years after the lease ends (the period for claims on written contracts) |
| Purchase and credit records | As long as tax and accounting law requires, currently 10 years |
| Audit logs of who viewed documents | 5 years |
| Reports and moderation decisions about an account | 5 years, to prevent banned users returning |
| Support requests | Until you delete your account; requests sent while signed out, 1 year |
| Website launch list | Until we send the launch email, then deleted |
| Backups | 7 days |
9. How we protect your data
- Data is encrypted in transit and at rest.
- The app cannot read or write our database directly; every request goes through our servers, which check who you are.
- ID photos are kept in a separate store and deleted on a fixed schedule.
- Staff access is limited by role and logged.
- Documents shown to landlords are watermarked and their views logged.
If a breach is likely to put you at real risk of harm, we will notify the National Privacy Commission and you within 72 hours of learning of it, as NPC Circular 16-03 requires.
10. Your rights
Under RA 10173 you have the right to:
- Be informed about how your data is processed
- Access your data and get a copy of it
- Object to processing, including marketing
- Correct inaccurate data
- Have your data erased or blocked
- Receive your data in a portable electronic format
- Withdraw consent at any time (this does not affect processing already done, and some features may stop working)
- Claim damages, and complain to the National Privacy Commission at privacy.gov.ph
You can edit most data in the app, and delete your account from Profile, Delete Account. For anything else, email roompal.ph@gmail.com. We may ask you to confirm your identity first, and we will reply within 15 working days.
11. Children
Roompal is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has an account, report the profile with the reason "Under 18" or email roompal.ph@gmail.com, and we will delete it.
12. Changes to this policy
We will post any update here and in the app. If a change is significant, we will notify you and ask you to accept it before it applies to you.
13. Contact
Data Protection Officer: [Data Protection Officer to be provided], Roompal Real Estate Intermediary Services, [business address to be provided], Philippines. Email: roompal.ph@gmail.com.