Data Protection & Privacy

Privacy Policy

How Kwaderno Protects Your Resort, Guest, and Financial Data (RA 10173 Compliance)

Effective Date: November 13, 2026Regulatory Framework: Data Privacy Act of 2012 (Republic Act No. 10173)Data Processing Role: Personal Information Processor (PIP)

ZERO-SNOOPING VAULT GOVERNANCE GUARANTEE:

Kwaderno respects the privacy and confidentiality of your resort operations. Your guest lists, contact phone numbers, cash collections, rates, and booking history belong exclusively to you. Kwaderno does not sell, rent, advertise, or disclose your private business data to third-party brokers, advertisers, or competing resorts.

1. Introduction & Overview

Kwaderno (“we,” “us,” or “our”) operates the cloud-based resort management platform accessible viawww.kwaderno.net and the official Kwaderno Android mobile application. This Privacy Policy informs resort owners, administrators, and staff members (“Subscribers”) regarding our policies on the collection, processing, storage, and safeguarding of Personal Information and Operational Data in strict compliance with theData Privacy Act of 2012 (Republic Act No. 10173) of the Republic of the Philippines.

2. Roles Under the Philippine Data Privacy Act (RA 10173)

To maintain transparency and regulatory compliance:

Resort Subscriber as Personal Information Controller (PIC): You (the resort owner/operator) are the Personal Information Controller of your guests’ personal data (names, phone numbers, email addresses, and reservation dates). You are responsible for ensuring that you have lawful consent from your guests to record their details for reservation purposes.
Kwaderno as Personal Information Processor (PIP): Kwaderno acts solely as your Personal Information Processor. We process and store your guests’ data strictly on your behalf, solely to provide the automated booking desk, arrival reminders, ledger tracking, and receipt generation features requested by your workspace.

3. Information We Collect

We collect and process the following categories of information:

Data Category	Specific Data Items	Purpose & Legal Basis
Account Data	Resort business name, owner name, contact email, mobile number, username, hashed password.	Workspace creation, secure authentication, password reset, and subscription billing.
Guest / Booking Data	Guest full name, phone number, check-in/out dates, guest count, rates, payment status.	Reservation scheduling, calendar collision avoidance, and arrival reminder notifications.
Financial Records	Cash collections, down payments, refunds, expenses, GCash/bank reference numbers, receipts.	Resort bookkeeping, staff cash turnover tracking, agent commissions, and accounting reports.
Technical / Device Data	IP address, browser type, Android device token (FCM), trusted device hash, session timestamps.	Preventing brute-force attacks, session management, and delivering native push notification alerts.

4. Technical & Organizational Security Measures

We implement state-of-the-art cryptographic and structural security controls to protect your data against unauthorized access, alteration, disclosure, or destruction:

Cryptographic Password Hashing: Passwords are never stored in plaintext. They are hashed using PBKDF2-HMAC-SHA256 with cryptographically random per-account salts and a secure server-side pepper.
Multi-Factor Authentication (TOTP): Super-Admin and platform governance accounts enforce mandatory RFC 6238 Time-Based One-Time Password (TOTP) two-factor authentication.
Database Vault Isolation: Tenant data is logically siloed (or physically dedicated) in Cloudflare D1 SQLite vaults, strictly partitioned by workspace_id. Cross-tenant leakage is blocked at the database engine and API levels.
Encrypted Transport: All data in transit between your browser/app and our edge servers is encrypted using modern TLS 1.3 encryption with strict HTTPS enforcement.
Zero Local Secrets on Devices: The Kwaderno Android APK does not store database credentials, server peppers, or master keys on your physical phone.

5. Data Sharing & Third-Party Processors

We do not sell, trade, or monetize your personal or business information. We engage only trusted, privacy-compliant infrastructure providers who act under strict confidentiality obligations:

Cloudflare Inc. (Global Edge & D1 Database): For global network hosting, DDoS protection, edge compute, and encrypted SQLite persistence.
Google Firebase Cloud Messaging (FCM): For delivering real-time Android push notifications for arrival reminders and booking requests. No sensitive guest amounts or full names are transmitted across lock screens by default.
Resend / Email Services: Exclusively for delivering transactional security one-time passcodes (OTPs) and account verification emails.

6. Data Retention & Your Rights (Data Privacy Act)

Under the Philippine Data Privacy Act of 2012, you and your guests have specific statutory rights:

Right to Access & Portability: You can view, search, and export your entire booking and financial ledger to Excel/CSV spreadsheets at any time through the Kwaderno Desk.
Right to Rectification: You can edit or correct inaccurate customer or booking records directly in your workspace.
Right to Erasure / Deletion: Upon subscription cancellation or written request, you may request the complete deletion of your workspace database and associated records.
Data Retention on Expiry: Expired trial or subscription workspaces are retained in a suspended, encrypted state for sixty (60) days to allow for renewal before permanent purge.

7. Contact the Data Protection Officer (DPO)

If you have inquiries, complaints, or wish to exercise your rights under the Data Privacy Act of 2012, please reach out to our Data Protection team:

Kwaderno Data Protection Office

Official Support Email: support@kwaderno.net

Facebook Messenger: m.me/kwaderno.net

Jurisdiction: National Privacy Commission (NPC), Republic of the Philippines

Data Protection & Privacy

Privacy Policy

How Kwaderno Protects Your Resort, Guest, and Financial Data (RA 10173 Compliance)

Effective Date: November 13, 2026Regulatory Framework: Data Privacy Act of 2012 (Republic Act No. 10173)Data Processing Role: Personal Information Processor (PIP)

ZERO-SNOOPING VAULT GOVERNANCE GUARANTEE:

1. Introduction & Overview

2. Roles Under the Philippine Data Privacy Act (RA 10173)

To maintain transparency and regulatory compliance:

Resort Subscriber as Personal Information Controller (PIC): You (the resort owner/operator) are the Personal Information Controller of your guests’ personal data (names, phone numbers, email addresses, and reservation dates). You are responsible for ensuring that you have lawful consent from your guests to record their details for reservation purposes.
Kwaderno as Personal Information Processor (PIP): Kwaderno acts solely as your Personal Information Processor. We process and store your guests’ data strictly on your behalf, solely to provide the automated booking desk, arrival reminders, ledger tracking, and receipt generation features requested by your workspace.

3. Information We Collect

We collect and process the following categories of information:

Data Category	Specific Data Items	Purpose & Legal Basis
Account Data	Resort business name, owner name, contact email, mobile number, username, hashed password.	Workspace creation, secure authentication, password reset, and subscription billing.
Guest / Booking Data	Guest full name, phone number, check-in/out dates, guest count, rates, payment status.	Reservation scheduling, calendar collision avoidance, and arrival reminder notifications.
Financial Records	Cash collections, down payments, refunds, expenses, GCash/bank reference numbers, receipts.	Resort bookkeeping, staff cash turnover tracking, agent commissions, and accounting reports.
Technical / Device Data	IP address, browser type, Android device token (FCM), trusted device hash, session timestamps.	Preventing brute-force attacks, session management, and delivering native push notification alerts.

4. Technical & Organizational Security Measures

We implement state-of-the-art cryptographic and structural security controls to protect your data against unauthorized access, alteration, disclosure, or destruction:

Cryptographic Password Hashing: Passwords are never stored in plaintext. They are hashed using PBKDF2-HMAC-SHA256 with cryptographically random per-account salts and a secure server-side pepper.
Multi-Factor Authentication (TOTP): Super-Admin and platform governance accounts enforce mandatory RFC 6238 Time-Based One-Time Password (TOTP) two-factor authentication.
Database Vault Isolation: Tenant data is logically siloed (or physically dedicated) in Cloudflare D1 SQLite vaults, strictly partitioned by workspace_id. Cross-tenant leakage is blocked at the database engine and API levels.
Encrypted Transport: All data in transit between your browser/app and our edge servers is encrypted using modern TLS 1.3 encryption with strict HTTPS enforcement.
Zero Local Secrets on Devices: The Kwaderno Android APK does not store database credentials, server peppers, or master keys on your physical phone.

5. Data Sharing & Third-Party Processors

We do not sell, trade, or monetize your personal or business information. We engage only trusted, privacy-compliant infrastructure providers who act under strict confidentiality obligations:

Cloudflare Inc. (Global Edge & D1 Database): For global network hosting, DDoS protection, edge compute, and encrypted SQLite persistence.
Google Firebase Cloud Messaging (FCM): For delivering real-time Android push notifications for arrival reminders and booking requests. No sensitive guest amounts or full names are transmitted across lock screens by default.
Resend / Email Services: Exclusively for delivering transactional security one-time passcodes (OTPs) and account verification emails.

6. Data Retention & Your Rights (Data Privacy Act)

Under the Philippine Data Privacy Act of 2012, you and your guests have specific statutory rights:

Right to Access & Portability: You can view, search, and export your entire booking and financial ledger to Excel/CSV spreadsheets at any time through the Kwaderno Desk.
Right to Rectification: You can edit or correct inaccurate customer or booking records directly in your workspace.
Right to Erasure / Deletion: Upon subscription cancellation or written request, you may request the complete deletion of your workspace database and associated records.
Data Retention on Expiry: Expired trial or subscription workspaces are retained in a suspended, encrypted state for sixty (60) days to allow for renewal before permanent purge.

7. Contact the Data Protection Officer (DPO)

If you have inquiries, complaints, or wish to exercise your rights under the Data Privacy Act of 2012, please reach out to our Data Protection team:

Kwaderno Data Protection Office

Official Support Email: support@kwaderno.net

Facebook Messenger: m.me/kwaderno.net

Jurisdiction: National Privacy Commission (NPC), Republic of the Philippines