Privacy Notice
Lunhaw helps people in Metro Manila find parks, gardens and public libraries, and how to get there. We collect as little personal data as we can. This notice explains what we collect, why, and the rights you have under the Data Privacy Act of 2012 (Republic Act No. 10173).
Who we are
Lunhaw is operated by HLN, the personal information controller for the data described here. For any privacy question or request, including reaching our Data Protection Officer, email lunhaw.hln@gmail.com.
What we collect and why
| Data | Why | Legal basis | How long we keep it |
|---|---|---|---|
| Account: your name, email address and password (stored only as a secure hash) | To create your account and let you sign in | Your consent when you sign up, and to provide the service you asked for | Until you delete your account |
| Newsletter: your email address and when you agreed to receive emails | To send occasional updates about Lunhaw | Your consent | Until you unsubscribe |
| Technical data: IP address, browser type and request times | To deliver the website, keep it secure and prevent abuse (for example, rate limiting) | Our legitimate interest in running a secure service | Short-term service logs kept by our hosting providers |
What stays on your device
- Your location. Lunhaw only asks for it when you tap “Use my current location”. It is used in your browser to estimate walking distance and is never sent to our servers or stored by us. You can always type a starting point instead.
- Saved places and your sign-in session are kept in your browser’s local storage. Clearing your browser data removes them.
What we don’t do
- We don’t sell or rent personal data.
- We don’t use advertising, analytics or tracking tools.
- We don’t record the locations you search from.
Who processes data for us
We use a small number of service providers, who process data only on our instructions:
- Supabase: database and account sign-in.
- Cloudflare: hosting for the website and API.
- Google Fonts: serves the typefaces used on the site, which means your browser requests them from Google.
These providers may store or process data on servers outside the Philippines. Where that happens, we rely on their contractual and security commitments to protect it to a standard comparable to the Data Privacy Act.
How we protect your data
All connections use HTTPS. Passwords are never stored in readable form. Database access is restricted, and the newsletter list can only be read by the operator. If a personal data breach occurs that is likely to put you at risk, we will notify the National Privacy Commission and the people affected within 72 hours of learning of it, as the law requires.
Your rights
Under the Data Privacy Act you have the right to:
- be informed about how your personal data is processed;
- access the personal data we hold about you;
- correct inaccurate data;
- object to processing, or withdraw your consent at any time;
- have your data erased or blocked;
- receive your data in a portable format;
- claim damages for misuse of your data; and
- file a complaint with the National Privacy Commission (privacy.gov.ph).
To use any of these rights, including deleting your account or unsubscribing, email lunhaw.hln@gmail.com. We will respond within 30 days.
Children
If you are under 18, please use Lunhaw with the permission of a parent or guardian.
Changes to this notice
If we change how we handle personal data, we will update this page and the date above. For significant changes, we will tell account holders by email before the change takes effect.