Privacy Policy

Last updated: May 10, 2026

1. Introduction

collabz.ph (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the collabz.ph platform (the “Platform”). This policy applies to all users — creators, brands, studios, and managers — across web and mobile (PWA) experiences.

2. Information We Collect

2.1 Information You Provide

Account information — name, email address, password, phone number, date of birth, and role selection (creator, brand, studio, manager).
Profile information — display name, bio, measurements (height, weight, bust, waist, hips), hair type, complexion, ethnicity, body type, tattoos, piercings, categories, location, social media handles, and Instagram links.
Portfolio content — photographs, videos, albums, and associated metadata that you upload to the Platform.
Collabz Feed content — posts, images, text (up to 250 characters), comments, Aura (star) interactions, and tagged users.
Verification documents — government-issued ID and live selfie submitted for identity verification (KYC).
Communications — messages exchanged with other users through the Platform's messaging system.
Payment information — payment method details processed through PayMongo (GCash, Maya, Visa, Mastercard). We do not store full card numbers. For manual payments, we receive proof-of-payment screenshots (e.g., GCash receipts, bank transfer confirmations).
Support tickets — subject lines, messages, and attachments submitted to our support system.

2.2 Information Collected Automatically

Device and browser data — IP address, browser type, operating system, device type, and screen resolution.
Usage data — pages visited, features used, timestamps, referral URLs, and actions taken on the Platform.
Profile view logs — anonymized records of who viewed your profile, subject to 24-hour deduplication.
Push notification tokens — web push subscription endpoints used to deliver notifications.

2.3 Information from Third Parties

Google OAuth — if you sign in with Google, we receive your name, email address, and profile picture from Google.

3. How We Use Your Information

We use the information we collect to:

Create and maintain your account.
Display your public profile, portfolio, and Collabz Feed posts to other users.
Facilitate bookings, casting calls, and communications between users.
Process payments and manage subscriptions and credits.
Verify your identity through our KYC process.
Deliver push notifications and email notifications based on your preferences.
Moderate content using automated tools (Google Cloud Vision SafeSearch for images, profanity filtering for text).
Power search and discovery features using Meilisearch indexing.
Generate platform analytics, including profile view counts, engagement metrics, and Top Creators rankings.
Detect and prevent fraud, abuse, and violations of our Terms of Use.
Respond to support tickets and provide customer service.
Improve the Platform through aggregated, anonymized usage analysis.

4. Image Processing and Metadata

When you upload photos to the Platform (portfolio, Collabz Feed, or profile photo), the following processing occurs automatically:

EXIF stripping — all metadata (including GPS location, camera model, and timestamps) is removed from uploaded images to protect your privacy.
Image optimization — images are resized and converted to WebP format. A full-resolution version (up to 2000px), a thumbnail (300px), and a 20px blur placeholder are generated.
Content moderation — images are analyzed by Google Cloud Vision SafeSearch to detect potentially inappropriate content. Flagged images are held for manual review.
BlurHash generation — a compact visual placeholder is created for progressive image loading.

5. Text Content Filtering

Text submitted in Collabz Feed posts, comments, bios, and other user-generated content is processed through our profanity detection system. Profane words in English and Filipino are automatically masked with asterisks. The content is still published — it is not blocked, rejected, or hidden. This process is performed server-side before storage.

6. Data Sharing and Disclosure

We do not sell your personal information. We share data only in the following circumstances:

Public profile data — your display name, bio, portfolio, and public profile are visible to other Platform users and may be indexed by search engines.
Identity gating — for free-tier brand and studio users, creator names and contact details may be partially masked. Paid users see full identity information.
Payment processor — PayMongo processes your payment transactions. Their handling of your data is governed by their own privacy policy.
Cloud services — we use Cloudflare R2 for image storage, Google Cloud Vision for content moderation, and Meilisearch for search indexing.
Email and SMS providers — Resend (email) and Semaphore (SMS) are used to deliver transactional communications.
Video processing — Mux is used for video upload and processing.
Legal obligations — we may disclose your information if required by Philippine law, court order, or government regulation.
Safety — we may share information to protect the safety of our users, prevent fraud, or enforce our Terms of Use.

7. Data Storage and Security

All data is transmitted over HTTPS (TLS encryption in transit).
Passwords are hashed using bcrypt and never stored in plain text.
KYC verification documents (ID photos, selfies) are stored temporarily during the review period and may be deleted after verification is complete.
Database backups are performed regularly and stored securely.
Images are stored on Cloudflare R2 with access controlled through signed URLs where applicable.
Administrative actions are logged in an audit trail for accountability.

8. Cookies and Local Storage

The Platform uses cookies for authentication session management (NextAuth session tokens). We use local storage for push notification subscription state and user interface preferences. We do not use third-party tracking cookies or advertising cookies.

9. Your Rights

Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), you have the following rights:

Right to be informed — you have the right to know how your data is collected, used, and shared (this policy).
Right to access — you can view all your personal data through your dashboard settings.
Right to rectification — you can update your profile and personal information at any time through your dashboard.
Right to erasure — you can delete your account from Dashboard > Settings. Upon deletion, your profile, portfolio, and personal data are permanently removed. Display names in existing reviews and messages are preserved as snapshots.
Right to object — you can manage your notification preferences and opt out of non-essential communications.
Right to data portability — you may request a copy of your data by contacting support.

10. Push Notifications

We use web push notifications (via the Web Push API with VAPID keys) to deliver real-time alerts for messages, bookings, casting calls, support ticket updates, and other Platform activity. You can enable or disable push notifications at any time from Dashboard > Settings > Notification Preferences. You can also control specific notification categories (messages, bookings, casting, support, system, moderation).

11. Children's Privacy

The Platform is not directed at children under 18. Users under 18 may only participate through a Handler account managed by a parent or legal guardian. We do not knowingly collect personal information from children under 18 without parental consent. If we learn that we have collected information from a child under 18 without appropriate consent, we will delete that information.

12. Data Retention

Active accounts — we retain your data for as long as your account is active.
Deleted accounts — upon account deletion, personal data is permanently removed. Display name snapshots in reviews and messages are retained for Platform integrity.
Deactivated accounts — data is preserved but hidden. Logging in reactivates the account and restores visibility.
Audit logs — administrative action logs are retained for compliance and security purposes.
Soft-deleted content — deleted Collabz Feed comments are soft-deleted (marked as removed) and may be retained for moderation purposes.

13. International Data Transfers

Your data may be processed by third-party services located outside the Philippines (e.g., Cloudflare R2, Google Cloud Vision, Resend, Mux). We ensure that these transfers comply with applicable data protection laws and that appropriate safeguards are in place.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Continued use of the Platform after changes constitutes acceptance of the revised policy. We encourage you to review this page periodically.

15. Contact

If you have questions about this Privacy Policy or wish to exercise your data privacy rights, contact us at hello@collabz.ph or through the support ticket system in your dashboard.