Privacy Notice

TideDesk is software that resorts, guesthouses, and villas use to manage their own bookings. Under RA 10173 (Data Privacy Act), the resort is the personal information controller for guest booking data and TideDesk acts as a personal information processor on the resort's instructions. For the accounts of resort owners and their staff, TideDesk is the controller.

Who we are and how to reach us: TideDesk is the operator of this service at tidedesk.ph. Resort owners and managers reach us from the Help page in their workspace; guests reach us through the resort they booked with.

What we process for guests (minimized): guest name, mobile number, optional email, party size, stay dates and notes, messages you send the property, and, if you pay by bank transfer or e-wallet, the reference number and proof-of-payment image you upload. We do not collect government IDs, and payment card data never reaches us (PayMongo processes card and e-wallet payments under its own PCI scope).

Why: to hold your booking slot, take the resort's deposit, and send messages about your stay by SMS (and email, if you gave one): confirmation, reminders, check-in info, and one thank-you the day after check-out that may include a link to book the same property directly again. That post-stay message is the only one not strictly about an existing booking; reply STOP to any SMS to stop it and every later text. We never sell guest data or send guests third-party advertising.

Your rights under the Data Privacy Act (RA 10173): you have the right to be informed, to object to processing, to access your data, to correct it, to have it erased or blocked, to data portability, to be indemnified for damages, and to lodge a complaint with the National Privacy Commission (NPC). Reply STOP to any SMS to opt out of texts immediately. For access, correction, erasure/destruction, objection or a portable copy of your booking data, contact the resort you booked with; the resort is the personal information controller and relays verified requests to us. If you cannot reach the resort, ask the resort's published contact channel to pass your request to TideDesk; we act on verified requests within 15 working days or the period the NPC prescribes, and you may also complain to the National Privacy Commission (privacy.gov.ph).

Security and breach notification: we protect your data with encryption in transit, encryption at rest for stored provider secrets and payment-proof images, row-level access rules in the database, role-scoped staff access, rate limiting and an append-only audit trail of account and privacy actions. If a personal-data breach occurs that is likely to give rise to a real risk of serious harm, we notify the NPC and the affected data subjects without undue delay, in the manner the DPA and NPC rules require, and the resort is informed as controller.

Where your data is processed: our service providers may process data outside the Philippines (for example, hosting and email delivery infrastructure). We require them to apply protections at least equivalent to the DPA, and we remain accountable to you for the data we process on the resort's instructions.

Children: TideDesk is a business tool for accommodation providers and their adult guests. Guests must be 18 or older to book, and accounts for resort owners and staff must be held by adults. We do not knowingly collect data from children; if you believe a child's data reached us, contact us and we will delete it.

Cookies and similar technologies: we use the cookies needed to keep a signed-in session and your language and display choices (strictly necessary). Product analytics (PostHog) and Google Analytics 4 are optional, off unless configured, and can be switched off with the control at the end of this notice at any time; they set no advertising cookies and receive no guest identity, booking link or amounts. We do not use cookies to build advertising profiles.

Changes to this notice: we may update it; the date at the top always shows the current version, and material changes are announced by email or in-app notice before they take effect.

Resort owner and staff accounts: for people who run a workspace we process sign-in email and password (stored hashed by our sign-in provider), names and roles of invited staff, the property's contact phone and notification email, support requests, plan and payment status (never card details), and an audit record of account actions. We use this to run the account, secure it, bill the plan and answer support.

Booking messaging: if you use the private messaging panel, your text is shared with the property’s authorized owners and managers. Keep your guest link private; anyone holding it can access the reservation and conversation. Messaging access ends 90 days after check-out. Message text is deleted by a daily cleanup 180 days after check-out; minimal access/action audit records do not contain message text. No attachments, marketing messages, automatic payment verification or live-response promise are part of this feature.

Product analytics (tidedesk.ph and the booking pages it hosts): when enabled, we measure which TideDesk pages owners, visitors and guests use, including resort booking pages, with PostHog and Google Analytics 4. We send only the page route (for example "/p/[slug]/book") and a few named product events such as "booking started", never guest names, phone numbers, emails, booking links or amounts. No session recording and no advertising signals; PostHog keeps nothing in your browser, while Google Analytics may set its own first-party analytics cookies (never advertising cookies). Analytics turn off automatically when your browser sends a Do Not Track or Global Privacy Control signal, and you can switch them off here at any time.