Privacy Policy

1. Scope

This policy explains how Rexidol Gutierrez Valencia, doing business as Rexshai Website Application Services, operating as BHouse ("BHouse", "we"), collects, uses, and protects personal data through the BHouse platform, in line with the Philippine Data Privacy Act of 2012 (RA 10173) and its implementing rules.

A Landlord Organization decides what information about its renters and staff to collect and how it is used — BHouse processes that information on the Landlord Organization's behalf, as described below.

2. What we collect

• Account data — email address, a securely hashed password (never stored in plain text), display name, and role, for every landlord, staff, and renter account.
• Renter records — full name, phone, email, emergency contact, a government-issued ID type and number, a photo of that ID, a profile photo, and any notes a landlord adds. This is entered by the Landlord Organization or by the renter directly.
• Financial records — bills, invoice line items, payment amounts, payment method, transaction reference numbers, and photos submitted as payment proof.
• Property records — meter readings and photos of utility meters, maintenance-request descriptions and photos, and room/property details.
• Communications — a log of every email and SMS BHouse sends on a Landlord Organization's behalf (recipient, template, and a preview of the content), so delivery can be audited.
• Technical data — IP address, used to apply rate limits against password-guessing and abusive automated requests, and standard server logs.

3. Why we collect it

Every category above exists to operate the core service: computing and issuing invoices, reviewing and matching payments, verifying renter identity where a landlord requires it, sending reminders, tracking maintenance, and securing accounts against unauthorized access. We do not sell personal data, and we do not use renter data for advertising.

4. Automated photo processing (OCR)

When a meter photo, a payment-proof screenshot, or a government ID photo is uploaded, BHouse sends that image to Cloudflare Workers AI (a vision-language model) to read the meter value, the payment amount and reference number, or the ID type and number, so the relevant field can be auto-filled. The extracted value is always shown to a person for confirmation before it is saved — nothing is recorded automatically without a human checking it.

5. Who we share data with

The following processors handle data as part of running the platform, under their own security and data-processing terms:

• Cloudflare — hosting (Workers), database (D1), file storage (R2), and the OCR model (Workers AI) described above.
• Resend — delivery of transactional email (invoices, reminders, password resets, contact messages).
• Semaphore — delivery of SMS reminders, for Landlord Organizations that enable SMS.
• Xendit — payment processing for subscription invoices and SMS credit purchases. When you pay online we send Xendit the invoice amount, reference and description and the payer's email address to create the checkout; card and e-wallet details are entered on Xendit's page and never reach BHouse.

We do not share personal data with any other third party except where required by law, or with your consent.

6. Data retention

Records are retained for as long as a Landlord Organization's account is active, so historical bills, readings, and lease records remain available for reference. When a renter, room, or property record is deleted by a Landlord Organization, associated files in storage are removed as part of that deletion. If a Landlord Organization closes its account, we retain data for a limited period to allow export or recovery of an accidental cancellation, then delete it.

7. Security measures

• Passwords are hashed with PBKDF2-SHA256 (100,000 iterations) — never stored or logged in plain text.
• Session tokens are stored as one-way hashes; the live token exists only in your browser's cookie.
• Every sensitive action a landlord or staff account takes is written to an audit log.
• Uploaded files are private by default and served only to authenticated users who own them.
• Sign-in and account-creation endpoints are rate-limited against automated guessing.

8. Your rights and how to exercise them

Under the Data Privacy Act, you may request access to, correction of, or deletion of your personal data, and may object to certain processing. A Landlord Organization can export its own data (including renter records) as a JSON backup or CSV export directly from BHouse at any time. For a request you cannot complete yourself — including a renter's request to a Landlord Organization, or a request about BHouse's own processing — contact us at support@bhouserentals.com and we will respond within a reasonable time as required by law.

9. Children's data

BHouse is intended for use by landlords, staff, and renters aged 18 and over. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time; material changes will be reflected by an updated effective date above, and continued use of BHouse after a change takes effect constitutes acceptance of the revised policy.

11. Contact

Privacy questions or requests can be sent to support@bhouserentals.com or through our contact form (choose "Data privacy request").