Privacy Policy

Effective Date: March 1, 2026 · Version 1.0

This Privacy Policy explains how Morph Tech Inc. ("we", "us", "our") collects, uses, and protects your personal information when you use OC Shop ("the Platform"). We are committed to protecting your privacy in accordance with the Philippine Data Privacy Act of 2012 (RA 10173).

1. Information We Collect

Account Information:

• Name, email address, and profile photo from your Google account (via Google OAuth).
• We do not collect or store your Google password.

Store Owner Information:

• Business name, business type, store slug, and contact information you provide.
• Business documents you upload (DTI/SEC registration, business permits, BIR COR) for tier verification.
• Bank account or e-wallet details for payouts.
• Product listings, pricing, and store configuration.

Customer Information:

• Name and email from Google OAuth when placing orders.
• Delivery addresses (if provided for delivery orders).
• Order history and preferences.

Automatically Collected:

• Browser type, device information, and IP address.
• Usage data (pages visited, features used, timestamps).

2. How We Use Your Information

• To create and manage your account.
• To operate your store and process customer orders.
• To process payments through PayMongo.
• To calculate and apply commissions and membership fees.
• To verify business documents for store tier upgrades.
• To send important notifications about your account, orders, and the Platform.
• To improve the Platform and develop new features.
• To prevent fraud and ensure Platform security.

3. Information Sharing

We do not sell your personal information. We share information only in the following cases:

• PayMongo: Payment details are shared with PayMongo to process transactions, subject to their own privacy policy.
• Store Owners ↔ Customers: Customer names and delivery addresses are shared with store owners to fulfill orders. Store contact information is visible to customers.
• Legal Compliance: We may disclose information if required by Philippine law, court order, or government regulation.
• Service Providers: We use Supabase (database hosting) and Vercel (web hosting). These providers process data on our behalf under data processing agreements.

4. Data Storage & Security

• Your data is stored securely in Supabase's cloud infrastructure with Row Level Security (RLS) policies ensuring data isolation between stores.
• All data transmission is encrypted via HTTPS/TLS.
• Business documents are stored in encrypted cloud storage with access restricted to authorized personnel.
• We implement industry-standard security measures to protect against unauthorized access.

5. Data Retention

• Account data is retained as long as your account is active.
• Order data is retained for 5 years for tax and legal compliance purposes.
• Upon account deletion, personal data is removed within 30 days. Anonymized analytics data may be retained.

6. Your Rights

Under the Philippine Data Privacy Act, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (subject to legal retention requirements).
• Object: Object to processing of your personal data for certain purposes.
• Portability: Request your data in a machine-readable format.

To exercise these rights, contact us at privacy@morphtechinc.com.

7. Cookies & Local Storage

• We use browser localStorage to store your shopping cart (scoped per store) and authentication session tokens.
• We do not use third-party tracking cookies.
• Supabase uses cookies for session management.

8. Children's Privacy

OC Shop is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a minor, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 14 days before changes take effect. The "Effective Date" at the top of this page indicates the latest revision.

10. Contact Us

For questions or concerns about this Privacy Policy or your personal data:

• Email: privacy@morphtechinc.com
• Data Protection Officer: Morph Tech Inc., Philippines