Privacy Policy

instacharge (“instacharge”, “we”, “us”, or “our”) operates a shared power bank rental service in the Philippines through our mobile apps, website, and charging cabinets. This Privacy Policy explains what personal data we collect, how we use it, and the rights available to you under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

By using instacharge, you agree to the practices described in this policy.

1. Who we are

instacharge is the data controller responsible for the personal information you provide when using our service. You can reach our Data Protection Officer at privacy@instacharge.ph.

2. Information we collect

2.1 Information you provide

• Account details: your mobile phone number, name, and (for certain users) email address.
• Verification codes: one-time passwords (OTPs) sent to your phone to sign in.
• Payment information: we process top-ups and rental charges through third-party providers such as GCash and Maya. We do not store your full card or e-wallet credentials on our servers; we only retain a transaction reference and amount.
• Support communications: any messages, feedback, or reports you send us.

2.2 Information we collect automatically

• Location data: your approximate or precise location (when you grant permission) so the app can show nearby charging cabinets and suggest return points.
• Camera data: we use your camera solely to scan QR codes on charging cabinets. QR images are processed on your device and are not uploaded to our servers.
• Rental activity: which cabinet you rented from, power bank serial number, rental start and end times, duration, and amount charged.
• Device & usage data: device model, operating system version, app version, language, crash logs, and basic diagnostic information used to keep the app working.

2.3 Information from partners

We receive authentication tokens from our identity provider (Clerk) to confirm your phone number is verified, and transaction statuses from payment processors (GCash, Maya) when you top up your wallet or pay for a rental.

3. How we use your information

We process personal data for the following purposes, each with a lawful basis under the Data Privacy Act:

• To provide the service (contractual necessity): authenticate you, unlock power banks, track rentals, process returns, charge your wallet, and display cabinet availability.
• To operate our cabinets and power banks (legitimate interest): monitor inventory, detect missing or damaged units, and maintain the reliability of the network.
• To prevent fraud and abuse (legitimate interest and legal obligation): detect suspicious activity, enforce rental limits, and comply with applicable law.
• To communicate with you (contractual necessity and consent): send rental receipts, service notices, OTP codes, and customer support responses.
• To improve the service (legitimate interest): analyse aggregate usage, diagnose bugs, and plan where to install new cabinets.
• To comply with law: respond to lawful government requests and tax or accounting obligations.

4. Device permissions

The instacharge mobile app requests the following permissions. You may grant or revoke them in your device settings at any time; some features will not work without them.

• Location — to show nearby cabinets and the distance to each. You can use the app with location denied, but you will need to search manually.
• Camera — to scan the QR code printed on each cabinet. No images or video are stored or uploaded.
• Notifications — to alert you when a rental starts, when you are nearing a pricing tier, and when a return is confirmed.
• Phone number — used as your account identifier and verified via OTP.

5. How we share information

We share personal data only in the following circumstances:

• With service providers that run our infrastructure, under contracts that require them to protect your data (see section 6).
• With venue partners (e.g., cafes, malls, airports) — only in aggregate, anonymised form, such as number of rentals per day at their location.
• To comply with law, including valid subpoenas, court orders, or requests from the National Privacy Commission (NPC) or other competent authorities.
• In a business transfer such as a merger, acquisition, or sale of assets, in which case we will notify you before your data is transferred.
• With your consent, for any other purpose not described here.

6. Service providers

The following third parties process personal data on our behalf. Each is bound by data protection terms and processes data only for the purposes we instruct.

• Clerk — phone-number authentication and session management.
• Convex — primary backend database hosting rental records and user accounts.
• Google Maps Platform — map rendering, geocoding, and place search inside the app.
• GCash and Maya — payment processing for wallet top-ups and rental charges.
• DigitalOcean — cloud hosting for our bridge service, admin dashboard, and MQTT broker.
• Expo — mobile app updates and crash reporting.

7. Data retention

We keep personal data only as long as we need it:

• Account data: while your account is active, plus up to 12 months after deletion for fraud prevention.
• Rental and transaction records: up to 10 years, to comply with Philippine tax and accounting requirements.
• OTP codes and session tokens: minutes to a few days, then deleted.
• Crash logs and diagnostic data: up to 90 days.

When a retention period ends, we delete the data or irreversibly anonymise it.

8. Security

We use industry-standard safeguards including TLS 1.2+ in transit, encryption at rest on managed databases, hashed credentials (SHA-256 for API keys, bcrypt-style hashing for device passwords), role-based access control for administrators, and audit logs of privileged actions. No system is 100% secure; if we ever detect a breach affecting your personal data, we will notify you and the National Privacy Commission within the timelines required by law.

9. Your rights

Under the Data Privacy Act, you have the right to:

• Be informed about how your data is processed.
• Access the personal data we hold about you.
• Correct inaccurate or outdated data.
• Object to processing, or withdraw consent where consent is the basis.
• Request erasure or blocking of data we no longer need.
• Request data portability in a structured, machine-readable format.
• File a complaint with the National Privacy Commission (privacy.gov.ph).

To exercise any of these rights, email privacy@instacharge.ph. We will respond within 30 days.

10. Children

instacharge is intended for users aged 18 and above. We do not knowingly collect data from children. If you believe a child has provided us with personal information, contact us and we will delete it.

11. International transfers

Our primary infrastructure is hosted in Singapore and other locations operated by the service providers listed in section 6. When data leaves the Philippines, we rely on the contractual protections required by the Data Privacy Act to keep your information safe.

12. Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we will notify you in-app or by email at least 15 days before they take effect. The “Effective date” at the top of this page reflects the latest version.

13. Contact us

Questions, requests, or complaints about this policy or how we handle your data: