Privacy Policy

1. Scope

This policy explains how Rexidol Gutierrez Valencia, doing business as Rexshai Website Application Services, operating as BHouse ("BHouse", "we"), collects, uses, and protects personal data through the BHouse platform, in line with the Philippine Data Privacy Act of 2012 (RA 10173) and its implementing rules.

A Landlord Organization decides what information about its renters and staff to collect and how it is used — BHouse processes that information on the Landlord Organization's behalf, as described below.

2. What we collect

• Account data — email address, a securely hashed password (never stored in plain text), display name, and role, for every landlord, staff, and renter account.
• Renter records — full name, phone, email, emergency contact, a government-issued ID type and number, a photo of that ID, a profile photo, and any notes a landlord adds. This is entered by the Landlord Organization or by the renter directly.
• Financial records — bills, invoice line items, payment amounts, payment method, transaction reference numbers, and photos submitted as payment proof, including the receipt a Landlord Organization uploads when it pays a BHouse subscription invoice by QR Ph.
• Property records — meter readings and photos of utility meters, maintenance-request descriptions and photos, and room/property details.
• Communications — a log of every email and SMS BHouse sends on a Landlord Organization's behalf (recipient, template, and a preview of the content), so delivery can be audited.
• Technical data — IP address, used to apply rate limits against password-guessing and abusive automated requests, and standard server logs. Sign-up, registration and contact forms use Cloudflare Turnstile, which checks the visitor's browser to tell people from bots.

3. Why we collect it

Every category above exists to operate the core service: computing and issuing invoices, reviewing and matching payments, verifying renter identity where a landlord requires it, sending reminders, tracking maintenance, and securing accounts against unauthorized access. We do not sell personal data, and we do not use renter data for advertising.

Under RA 10173 we rely on the following lawful bases: contract (providing the service a Landlord Organization signed up for), legal obligation (keeping invoice and tax records, and responding to lawful requests), legitimate interest (securing the platform, preventing fraud and abuse, and keeping an audit trail), and consent where we ask for it, for example when you accept these terms or tick a marketing preference. Where a Landlord Organization collects renter data, it is responsible for having its own lawful basis and for telling its renters.

4. Automated processing (OCR and Ask BHouse)

When a meter photo, a payment-proof screenshot, or a government ID photo is uploaded, BHouse sends that image to Cloudflare Workers AI (a vision-language model) to read the meter value, the payment amount and reference number, or the ID type and number, so the relevant field can be auto-filled. The extracted value is always shown to a person for confirmation before it is saved — nothing is recorded automatically without a human checking it.

On plans that include it, Ask BHouse answers a landlord's questions about their own records. The question and the figures needed to answer it are processed by a language model on Cloudflare Workers AI. It only reads, it cannot change anything or message a renter, and it only sees the asking organization's own data.

5. Who we share data with

The following processors handle data as part of running the platform, under their own security and data-processing terms:

• Cloudflare — hosting (Workers), database (D1), file storage (R2), and the OCR model (Workers AI) described above.
• Resend — delivery of transactional email (invoices, reminders, password resets, contact messages).
• Semaphore — delivery of SMS reminders, for Landlord Organizations that enable SMS.
• PayMongo — payment processing for subscription invoices and SMS credit purchases. When you pay online we send PayMongo the amount, our invoice reference and a short description to create the checkout; card and e-wallet details are entered on PayMongo's page and never reach BHouse.

We do not share personal data with any other third party except where required by law, or with your consent.

Transfers outside the Philippines. Cloudflare operates a global network, so data we store or process with it may be handled in data centres outside the Philippines, and Resend, our email provider, is based in the United States. PayMongo and Semaphore operate in the Philippines. We use these providers because they commit to appropriate security and confidentiality, and we remain responsible for personal data we entrust to them.

6. Data retention

Records are retained for as long as a Landlord Organization's account is active, so historical bills, readings, and lease records remain available for reference. When a renter, room, or property record is deleted by a Landlord Organization, associated files in storage are removed as part of that deletion. Moving to the Free plan does not delete data. When you sign up we keep your details only until you confirm your email address; sign-ups that are not confirmed are deleted automatically within two days.

If a Landlord Organization asks us to close its account, we delete or anonymise its data within 30 days of confirming the request, except records we must keep by law, such as our own subscription invoices and payment records. Daily backup snapshots of each organization's data are kept for 30 days and then removed automatically. Sign-in rate-limit records and server logs are short-lived.

7. Security measures

• Passwords are hashed with PBKDF2-SHA256 (100,000 iterations) — never stored or logged in plain text.
• Session tokens are stored as one-way hashes; the live token exists only in your browser's cookie.
• Every sensitive action a landlord or staff account takes is written to an audit log.
• Uploaded files are private by default and served only to authenticated users who own them.
• Sign-in and account-creation endpoints are rate-limited against automated guessing.

Data breaches. If a personal data breach occurs that is likely to put people at risk of serious harm, we will notify the National Privacy Commission and the affected people within 72 hours of becoming aware of it, as required by Philippine law, and tell affected Landlord Organizations so they can inform their renters.

8. Your rights and how to exercise them

Under the Data Privacy Act, you have the right to be informed about how your data is processed; to access it; to correct it; to object to processing; to ask for it to be suspended, withdrawn, blocked or deleted; to data portability; and to claim damages if you are harmed by inaccurate, unlawfully obtained or unauthorized use of your data. A Landlord Organization can export its own data (including renter records) as a JSON backup or CSV export directly from BHouse at any time. For a request you cannot complete yourself — including a renter's request to a Landlord Organization, or a request about BHouse's own processing — contact us at support@bhouserentals.com and we will respond within a reasonable time as required by law. If you believe your rights have been violated and we have not resolved your concern, you may file a complaint with the National Privacy Commission (privacy.gov.ph).

9. Children's data

BHouse is intended for use by landlords, staff, and renters aged 18 and over. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time; material changes will be reflected by an updated effective date above, and continued use of BHouse after a change takes effect constitutes acceptance of the revised policy.

11. Contact

Privacy questions or requests can be sent to support@bhouserentals.com or through our contact form (choose "Data privacy request").

Data Protection Officer. Attn: Data Protection Officer, Rexshai Website Application Services, Davao City, Philippines, at the email address above.