Privacy Notice

BackerMo is a product of Vanguard AI Analytics, Inc. ("BackerMo", "we", "us", "our"), which owns and operates the BackerMo Platform and is the personal information controller for the personal data described in this notice. We process personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

This notice explains what we collect, why, who we share it with, how long we keep it, and your rights. It forms part of our Terms of Use.

1. Information we collect

From all users

• Account details: your name, email address, and password (stored only as a one-way hash), and whether your email is verified.
• Security details: two-factor authentication settings, session records, and sign-in times.
• Legal records: which legal documents you accepted and when, with the IP address and browser details at the time of acceptance.
• Reports: any report you file about a campaign, and its details.

From Backers

• Pledges: the campaign, reward tier, amount, status, and history of changes to your pledge.
• Shipping details, where a reward needs delivery: recipient name, phone number, and address.
• Card details: your card is entered only on our payment service provider's secure page. We never receive or store your full card number or security code. We keep only a payment token, the card brand, the last four digits, and the expiry month and year.
• Charge records: charge attempts, results, and receipts.

From Fundraisers and their authorized representatives

• Business details: registered name, business type, registration number, Tax Identification Number (TIN), business address, contact email, and contact phone number.
• Representative details: name, position, and government-issued identification.
• Verification documents: DTI or SEC registration, articles of partnership or incorporation, General Information Sheet, BIR Certificate of Registration (Form 2303), proof of authority, and proof of bank account.
• Payout details: bank, account name, and account number, and the history of payouts and bank account changes.
• Campaign content: text, images, reward tiers, and updates you publish.

Automatically, when you use the Platform

• IP address, browser and device type, and the pages and actions you request, in our server and security logs.
• Strictly necessary cookies that keep you signed in and protect the Platform from abuse. We do not use advertising or cross-site tracking cookies.

Government-issued identifiers, such as IDs and TINs, are sensitive personal information under the Data Privacy Act. We collect them only from Fundraisers, only for verification and legal compliance, and only with the separate consent given at verification.

2. Why we use your information, and our legal basis

• Create and secure your account, and let you sign in. Basis: fulfilment of our contract with you (Sec. 12(b)).
• Record your pledges, verify and charge your card through our payment service provider, and send receipts and pledge emails. Basis: fulfilment of contract (Sec. 12(b)).
• Share your pledge and shipping details with the Fundraiser so it can deliver your reward. Basis: fulfilment of contract (Sec. 12(b)).
• Verify Fundraisers, create their payment sub-accounts, and release payouts. Basis: fulfilment of contract (Sec. 12(b)); consent for sensitive personal information (Sec. 13(a)).
• Display Fundraiser details on campaign pages, keep merchant records, act on reports, and respond to lawful requests from authorities. Basis: compliance with legal obligations, including the Internet Transactions Act of 2023 (RA 11967) (Sec. 12(c); Sec. 13(b)).
• Keep financial, tax, and transaction records. Basis: compliance with legal obligations (Sec. 12(c)).
• Detect and prevent fraud, abuse, and security incidents, and keep audit logs. Basis: our legitimate interests in a safe and trustworthy Platform (Sec. 12(f)).
• Establish, exercise, or defend legal claims. Basis: Sec. 12(f); Sec. 13(f).
• Improve the Platform using aggregated or de-identified data. Basis: our legitimate interests (Sec. 12(f)).
• Send marketing emails. Basis: only with your consent, which you may withdraw at any time.

We do not sell your personal data, and we do not use it for automated decisions that produce legal or similarly significant effects on you.

3. Who we share it with

• Fundraisers you back: your name, email address, pledge details, and shipping details. Each Fundraiser is responsible for protecting this data under the Data Privacy Act and may use it only to fulfil rewards and communicate about its campaign.
• The public: campaign content, and, as required by the Internet Transactions Act, each Fundraiser's registered name, business type, registration number, business address, and contact email.
• Service providers that process data on our behalf, under contracts that require them to protect it:
  • payment service providers (card processing, card tokens, Fundraiser payment accounts, and payouts);
  • secured cloud server, database, and file storage providers;
  • network security and content delivery providers; and
  • email delivery providers.
• Government and law enforcement: the Department of Trade and Industry, the NPC, the Bureau of Internal Revenue, courts, and law enforcement agencies, when the law requires or allows it.
• Professional advisers, such as lawyers and auditors, under a duty of confidentiality.
• A successor business, if Vanguard AI Analytics, Inc. is involved in a merger, acquisition, or sale of assets, subject to this notice.

4. Transfers outside the Philippines

Some of our service providers, including our secured cloud server storage, store or process data outside the Philippines. We remain responsible for your data when it is transferred, and we use contractual and other reasonable safeguards to protect it as the Data Privacy Act requires.

5. How long we keep it

We keep personal data only for as long as needed for the purposes above:

• Account data: while your account is open. When it is closed, we delete or anonymize what we no longer need.
• Pledge, charge, payout, and tax records: for the period required by tax, accounting, and e-commerce laws.
• Legal acceptances, reports, and audit logs: for as long as needed to show compliance and to establish or defend legal claims.
• Fundraiser verification documents: for the period required by law after the business stops using the Platform, or earlier if its application is rejected and the documents are no longer needed, after which they are securely deleted.

In general we do not keep personal data for more than ten (10) years after the end of the relationship or the last related transaction, unless the law requires longer or a legal claim is pending.

6. How we protect it

We use organizational, physical, and technical measures appropriate to the risk, including:

• encryption in transit (HTTPS) and encryption at rest by our hosting providers;
• full card numbers handled only by our PCI DSS-compliant payment service providers, never by us;
• verification documents kept in private storage, opened only through short-lived links, with every staff view logged;
• access limited to authorized personnel, with two-factor authentication required for administrators;
• tamper-resistant audit logs of sensitive actions.

No system is perfectly secure. If a personal data breach is likely to put you at real risk of serious harm, we will notify the NPC and affected individuals within seventy-two (72) hours of becoming aware of it, as the law requires.

7. Your rights

Under the Data Privacy Act, you have the right to:

• be informed about how your personal data is processed;
• access your personal data;
• object to processing, and withdraw consent where processing is based on consent;
• correct inaccurate or incomplete data;
• erasure or blocking of data that is unlawfully obtained, no longer necessary, or processed without a legal basis;
• data portability, to get a copy of your data in a commonly used electronic format;
• damages for inaccurate, incomplete, outdated, false, or unlawfully processed data; and
• file a complaint with the National Privacy Commission (privacy.gov.ph).

To exercise a right, email our Data Protection Officer at [email protected]. We will need to verify your identity, and we will respond within a reasonable time. Some data cannot be erased while we must keep it by law, to complete a pledge or payout already in progress, or to defend legal claims. Withdrawing consent does not affect processing already done.

8. Children

The Platform is not for anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor has given us personal data, contact [email protected] and we will delete it.

9. Changes to this notice

We may update this notice. We will post the new version on this page with its effective date and, where the change is material, ask you to review and accept it.

10. Contact us

Data Protection Officer, Vanguard AI Analytics, Inc., operator of BackerMo

Email: [email protected]