Privacy notice
Last updated October 16, 2026 · This notice is written with the Philippine Data Privacy Act of 2012 (RA 10173) in mind. Have it reviewed by your counsel before relying on it commercially.
Who we are
Tuloy (tuloy.rest) provides booking-management software to accommodation businesses (“Hosts”). For guest data a Host collects through Tuloy, the Host is the personal information controller and Tuloy acts as a personal information processor on the Host's instructions. For Host account data, Tuloy is the controller.
What we collect
- Host accounts: name, email, password (hashed by our authentication provider), business details and the records you enter (properties, bookings, payments, expenses).
- Guests: name, mobile number, optional email and message, booking details, and payment receipts a guest chooses to upload.
- Technical: a hashed (not raw) network address for spam and rate limiting, and essential session cookies. We do not use advertising trackers.
We do not ask for government ID numbers. Hosts should avoid storing sensitive personal information (such as ID numbers or health data) in notes.
How we use it
- To operate booking pages, calendars, payment tracking and reports for the Host.
- To let guests see their booking status and send payment details to the Host.
- To secure the service, prevent abuse and fix errors.
We never sell personal data. We do not send marketing messages to guests.
Where it is stored
Data is stored with our infrastructure providers (database and file storage in the Asia-Pacific region; application hosting). Payment receipts are kept in private storage that only the Host's team can open through short-lived links.
Retention
Host data is kept while the account is active. Owners can export their data at any time and permanently delete their workspace from Settings. Guests' personal details can be erased by the Host from the guest's record (booking amounts are kept for the Host's financial records). Backups held by our providers expire on their normal schedules. Security logs are kept for up to 12 months.
Your rights
You may request access, correction, erasure, or a copy of your data, and object to processing. Guests should contact the Host first; Hosts and guests may also write to hello@tuloy.rest. You may lodge a complaint with the National Privacy Commission.
Security
Each business's data is isolated with database row-level security, connections are encrypted, secrets are kept server-side, and important actions are audit-logged. No system is perfectly secure; we will notify affected Hosts of a personal data breach as required by law.