The short version
- We collect only what we need to run Gotchu safely: your account details, the requests and gifts you make, and the files you upload.
- Bills, account numbers and ID checks are never public. Helpers only see your first name, general location, story and the photos you chose to share.
- We don’t sell your personal data, and we don’t use your bills or ID to target ads.
- You can see, correct, download or delete your data. Email contact@gotchupay.com.
1. Who we are
Gotchu (“we”, “us”) operates the Gotchu website and apps from the Philippines and is the personal information controller for the data described here. We follow the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules, and, where they apply to you, other privacy laws such as the EU/UK GDPR.
Data Protection Officer: contact@gotchupay.com (subject: “Privacy”).
2. What we collect
| Data | Examples | Why |
|---|---|---|
| Account | Name, email, password (stored only as a secure hash), country, preferred currency, optional phone, username, bio, social links you add | To create and secure your account and show your profile |
| Security | Sign-in times, IP address, device/browser type, two-step verification settings (never your codes) | To protect your account and detect fraud |
| Help requests | Bill photo or PDF, amount, due date, biller, account reference (encrypted), story, optional photos and video | To review, publish and pay the bill |
| Gifts | Amounts, currency, recipient request, your optional message, payment status and references | To process gifts, give receipts, handle refunds and keep financial records |
| Identity checks | The result of the check (approved/declined), document type and country, and warning codes | To verify requesters and prevent fraud |
| Support | Messages in support tickets and emails | To help you and resolve disputes |
We remove location and camera data (EXIF/GPS metadata) from photos and videos when you upload them, and we compress files to store less.
3. Partners we share data with
We share only what each partner needs, under contracts that require them to protect it:
- Payment processing — PayMongo Philippines processes card and e-wallet payments. They receive payment details directly from you on their page.
- Identity verification — Didit performs ID document, selfie and liveness checks. Your ID images and selfie go to Didit, not to Gotchu; we receive the result.
- Hosting and email — our servers and email delivery providers store and send data on our behalf.
- Analytics and ads — if we turn on Google Analytics or ads in our apps, they receive device and usage information, never your bills, ID or gift amounts. We ask for consent where the law requires it.
- Authorities — when the law requires it, or to prevent fraud or protect someone’s safety.
Some partners process data outside the Philippines. When that happens we use contractual and technical safeguards as required by law.
4. What other people can see
- On a published request: your first name, city/country, story, amount raised, and only the photos/video you marked “Show to helpers”.
- On your public giving profile (on by default, can be turned off): name, username, bio, badges, number of people helped, and social links you made public. Gift amounts are hidden unless you choose to show them.
- Never shown: your bill documents, account numbers, email, phone, ID checks, or anonymous gifts.
5. How we protect your data
- Encryption in transit (HTTPS) and encryption of sensitive fields such as bill account numbers and integration keys.
- Files are stored outside the public website and are only reachable through short-lived signed links after a permission check.
- Staff access is limited by role, requires two-step verification, and is recorded in an audit log.
- Passwords are hashed with Argon2id; we never see them.
No system is perfectly secure. If a breach affects you, we will notify you and the National Privacy Commission as the law requires.
6. How long we keep data
- Account data: while your account is open.
- When you delete your account, we remove your profile, uploads and personal details. We keep the minimum financial and anti-fraud records (gift amounts and references, linked to an anonymised account) for as long as tax, accounting and anti-money-laundering laws require.
- Identity check results: up to 1 year after the check unless a longer period is required by law.
- Security logs and backups: rolled over automatically, usually within 14–90 days.
7. Your rights
Under the Data Privacy Act you have the right to be informed, to access, to object, to correct (rectification), to erasure or blocking, to data portability, to file a complaint, and to damages. You can:
- edit your profile and privacy settings in the app;
- delete your account in the app (Profile → Settings & Privacy);
- email contact@gotchupay.com to get a copy of your data or ask us anything about it. We reply within 30 days.
If you’re not satisfied, you can complain to the National Privacy Commission (privacy.gov.ph).
8. Cookies
Gotchu uses a small number of strictly necessary cookies — for example a secure sign-in cookie that keeps you logged in. We don’t use advertising cookies on the website. If we add analytics cookies we will ask for your consent where required.
9. Children
Gotchu is for adults 18 and over. Requests may mention family members (for example a child’s tuition), but please share only what’s needed and never upload a child’s ID. If you believe a minor has created an account, tell us and we’ll remove it.
10. Changes to this policy
We’ll post any changes here and update the date at the top. If a change is significant we’ll also tell you in the app or by email.