Privacy Policy.

This policy explains what Comffee Drink & Play collects, why, and what your rights are — in plain language, under the Philippine Data Privacy Act of 2012 (RA 10173). It covers comffee.org, the installable Comffee app, and the software our partner cafes run. Our Data Protection Officer is reachable at comffee.dpo@gmail.com.

What we collect

• Your account — when you sign in with Google we receive your name, email address, and profile photo. We never see your Google password.
• Bookings and orders — stay dates, guest counts, seat reservations, game top-up order details, and vouchers you buy or redeem.
• Payments — processed by PayMongo, a licensed Philippine payment processor. We keep amounts, references, and payment status; we never store your card number, GCash or bank credentials.
• Chat — messages and photos you send through the site chat, so the cafe and our team can answer you.
• Partner-cafe staff attendance (staff only, with consent) — a face template and audit selfie at clock-in/out, the punch time, the distance from the cafe, and a phone-binding key. Customers are never face-scanned.
• Technical basics — the logs any website keeps (device type, approximate network address, pages visited) to keep the service running and abuse out.

Why we use it

To run the service you asked for: confirming bookings and orders, taking and settling payments, answering chats, computing partner-cafe payroll from attendance, preventing fraud and abuse, and meeting legal obligations. We do not sell your data, and we do not use it for third-party advertising.

Face data (partner-cafe staff)

If you work at a partner cafe, clocking in uses your face to confirm it's really you. This only happens after you accept the on-screen consent, it is used only to verify your punches — never for marketing, never shared — and audit selfies are automatically deleted after 30 days. Your face template is removed when you are unenrolled from the cafe's staff. You can decline consent; ask your cafe admin about alternative arrangements.

Who we share with

Only the processors that make the service work: PayMongo (payments), Google (sign-in), our email provider (booking and receipt emails), and our hosting providers (Vercel and Supabase, where the site and its database run). Partner cafes see the data about their own branch — their bookings, their chats, their staff — never another cafe's. Authorities, only when the law requires it.

How long we keep it

Attendance selfies: 30 days. Face templates: until you leave the cafe's staff. Bookings, orders, and payment records: as long as bookkeeping and tax law require. Chats: while your conversation stays useful for support. Accounts: until you ask us to delete yours.

Your rights

Under the Data Privacy Act you may ask to see your data, correct it, have it deleted, or object to how it's used. Email comffee.dpo@gmail.com and we'll respond. If you believe we've mishandled your data, you may also complain to the National Privacy Commission (privacy.gov.ph).

Cookies

We use cookies to keep you signed in and remember basics like which app mode you last used. We don't run third-party advertising trackers — in fact, the site strips social-network tracking tags off shared links when you arrive.

Questions? Ask us — or read the Terms of Service.