Privacy Policy

This policy explains how Vertix LLM (“Vertixia Rental”, “we”, “us”) handles personal information when you use this website and rent vehicles from us. We are the personal information controller for that data under the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.

Registered address: Baguio, Benguet 2600. Data Protection Officer: Angelo Paet, dposupport@gmail.com.

What we collect

When you create an account

• Your name and email address.
• Your password, which we store only as a bcrypt hash. We never hold the password itself and cannot recover it — we can only let you set a new one.
• If you sign in with Google, we receive your name and email address from Google in place of a password. We do not receive your Google password, and we ask Google for nothing beyond your name, email address and whether that address is verified.

When you book a vehicle

• Your contact phone number, address and city.
• Your driver’s licence number and its expiry date, and any identification or licence images you upload.
• Booking details: the vehicle, the dates, your destination, and any notes our staff add to your booking.
• Payment records: the amount, the method (card, GCash or Maya), a payment reference, and for card payments the card brand and the last four digits only. We do not store full card numbers, expiry dates or security codes.

Your licence number and any government identification you upload are sensitive personal information under the Data Privacy Act. We collect them because we cannot lawfully hand over a vehicle without verifying that the driver is licensed, and we ask for your consent at the point you provide them.

While a rental is in progress

Vehicles on active rentals report their location to us for the duration of the rental. We use this to know where our vehicles are, to support you if something goes wrong, and to confirm returns. Tracking is tied to the booking and stops when the rental ends. We do not track you personally, and we do not track a vehicle outside an active rental.

Automatically

• A session cookie (vertixia_session) that keeps you signed in for seven days. It is HTTP-only, so scripts in your browser cannot read it.
• A short-lived cookie during Google sign-in that exists only to protect the sign-in from tampering, and is deleted as soon as you land back on the site.
• Ordinary server logs kept by our hosting provider, which include IP addresses.

We do not use advertising cookies, and we do not track you across other websites.

Why we use it, and on what basis

We do not sell your personal information, and we do not share it for anyone else’s marketing.

Who else handles it

We use a small number of service providers, who process your data on our instructions and for no purpose of their own:

• Vercel — hosts the website and keeps server logs.
• Neon — hosts the database where your account and booking records live.
• Resend — delivers account email such as password reset links.
• Google — only if you choose to sign in with Google, and only to confirm who you are.

Some of these providers store data on servers outside the Philippines. Where that happens we rely on contractual protections with the provider, and we remain accountable for your information under the Data Privacy Act.

We may also disclose information where the law requires it — for example to a court, to the police in connection with a stolen vehicle, or to our insurers and professional advisers in connection with a claim.

How long we keep it

Deleting your account removes your profile, your uploaded identification and your contact details. We keep the financial record of completed rentals for as long as the law requires us to, because we are not permitted to delete those on request.

How we protect it

• Passwords are stored as bcrypt hashes, never in a readable form.
• The whole site is served over HTTPS.
• Session cookies are HTTP-only and, in production, secure-flagged.
• Password reset links are stored only as a hash, expire in 30 minutes, and work once.
• Administrative access to customer records is limited to staff accounts, and is checked against the database on every request rather than trusted from a cookie.

No system is perfectly secure. If a breach occurs that puts you at real risk, we will notify you and the National Privacy Commission as the Data Privacy Act requires.

Your rights

Under the Data Privacy Act of 2012 you have the right to:

• Be told what we hold about you and how we are using it;
• Get a copy of it, in a portable electronic format;
• Have anything inaccurate corrected;
• Object to processing, or withdraw consent where consent is what we relied on;
• Have your information erased or blocked, where the law allows;
• Be indemnified for damage caused by inaccurate or unlawfully used data; and
• Complain to the National Privacy Commission.

To exercise any of these, write to our Data Protection Officer at dposupport@gmail.com. We will respond within 15 days. If you are not satisfied, you can complain to the National Privacy Commission at privacy.gov.ph.

Children

You must hold a valid driver’s licence to rent from us, so this service is not intended for children and we do not knowingly collect their information.

Changes

If we change this policy we will update the date at the top of this page. Where a change materially affects how we use information we already hold, we will tell you directly.

Contact

Questions about this policy, or about your information, go to dposupport@gmail.com. For anything about a booking, use vertixsupport@rental.llm or see the Terms of Service.