Privacy notice

1. Who we are

Overdash is run by [COMPANY LEGAL NAME], [BUSINESS ADDRESS] ("Overdash", "we"). We decide how your personal information is used, as the personal information controller under the Philippine Data Privacy Act of 2012 (Republic Act 10173).

Our Data Protection Officer is [DPO NAME], reachable at [PRIVACY EMAIL].

2. What we collect

Everyone with an account

• Your mobile number (your login), name, birthday, profile photo and the language you picked.
• Your PIN, stored only in a scrambled (hashed) form we cannot read back.
• The notification token of your phone, so we can send you order updates.

Customers

• Delivery addresses, their map pins, landmarks and notes, and an optional photo of your house or gate.
• Your orders: what you ordered, from where, prices, how you paid, when, and what happened to the order.
• For Express and Pabili: the sender's and receiver's names, numbers and addresses you enter, item photos, shopping lists and receipts.
• Your Dashpoints, vouchers, favourites, recent searches, reviews and the photos you add to a review or a problem report.
• Your birthday when you order an 18+ item, and whether your ID was verified (for example for PWD or Senior discounts or a higher cash limit) and in which country. [HOW AN ID IS CHECKED AND WHETHER A COPY IS KEPT]
• Messages you send your rider in the in-app chat.

Riders

• Your name, number, birthday, photo and vehicle details.
• Your location: the phone's GPS while you are on a session or a delivery (live position and a trail of one point a minute), and your hotspot pin.
• Delivery, pickup and problem photos, your calls through the app's Call button (time and place, not the call itself), your shifts, sessions, breaks, late and decline records and performance rates.
• Your earnings, cash collected and remitted, payout account and payouts.
• Whether your phone reports a fake (mock) location.

Merchants and stores

• Your name and number, your store details, menu, prices, photos and videos (reels), opening hours and the tablet paired to the store.
• Your store's orders, payouts, charges, appeals and payout account.

From every app

• Crash reports: what went wrong, the phone model and system version, the app version and the name of the screen that was open. No name, number or address.

We do not collect card numbers or e-wallet passwords: online payments are made on our payment provider's page.

3. Why we use it

• To provide the service you asked for: logging you in, taking orders, finding a rider, delivering, taking payments and refunds, paying riders and stores.
• To keep it safe and fair: stopping fake orders and abuse (limits on sign-in codes, orders and cash), checking deliveries with photos and location, settling problems and disputes.
• To follow the law: business, tax and money records, and age rules for 18+ items.
• To keep the apps working: crash reports and system alerts.

We use your information because it is needed for our agreement with you, to meet legal duties, or for our legitimate interest in a safe service. We do not sell your personal information. [MARKETING MESSAGES: whether you send any, and how a user says no]

4. Who sees it

• Your rider sees your name, number, delivery address, landmark and notes for that order. Your house photo only after the rider accepts, and only until delivery. Your rider sees only your first name in the chat; numbers stay hidden there.
• The store sees what you ordered and the order's details it needs to prepare it.
• Customers see their rider's first name, photo, vehicle and live position while the order is on its way.
• Anyone you share a tracking link with sees the rider's first name and position while the order is on its way, and your drop-off pin. Never your name, number or address text.
• Overdash staff and dispatchers see what they need to run deliveries and solve problems. A full phone number is shown only when a dispatcher taps Call, and that is logged.
• Authorities, when the law requires it.

5. Companies that help us

These companies process information for us, only to run the service. Some of their servers are outside the Philippines.

• Supabase — our database, logins, file storage and server code.
• Google Firebase — notifications and crash reports.
• Mapbox and Google Maps Platform — maps, routes and distances (with map pins, not names).
• Semaphore [and Twilio, once other countries open] — the text messages with your sign-in code.
• Xendit — online payments and refunds.
• Mux and Cloudflare — store videos and our web pages.

6. How long we keep it

7. Your rights

Under the Data Privacy Act you may ask to see the information we hold about you, have it corrected, get a copy, object to its use, or have it deleted. Email [PRIVACY EMAIL]; we answer within [DAYS] days and check first that the request is really yours.

You can delete your account yourself in the app (Account → Delete my account) or at delete.ovrdsh.com.

If you think we handled your information wrongly, you may complain to the National Privacy Commission (privacy.gov.ph).

8. How we protect it

Information travels encrypted. Each person and each app can read only what their role needs, checked on our servers. PINs are hashed, payment details stay with the payment provider, house photos are private files, and staff access is logged. If a breach puts you at risk, we will tell you and the National Privacy Commission as the law requires.

9. Age

You must be at least [MINIMUM AGE] to have an account. 18+ items are sold only to customers of the legal age in the store's country, checked from the birthday.

10. Changes and contact

When we change this notice we update the date at the top, and tell you in the app when the change matters. Questions: [PRIVACY EMAIL], [BUSINESS ADDRESS].