Privacy Notice
For people who use the Likom app · Effective 1 December 2026
Who we are
Likom is run by James Grimaldo, an individual software developer based in Mandaluyong City, Metro Manila, Philippines ("we"). Likom and Selyo are his apps, not separate companies. For your Likom account, he is the personal information controller.
This notice explains what we collect, why, who sees it, and your rights. We follow the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its rules, and we respect the extra rights the law of your own country may give you (see "If you're outside the Philippines").
Data Protection Officer: James Grimaldo, [email protected]. Our full postal address is available on request by email.
What we collect
| What | Details |
|---|---|
| Your account | Name, @username, email and/or mobile number, birthday, city, and a scrambled (hashed) copy of your password. If you sign in with Google: your Google account ID and email. |
| Your cards | The cards you add, their balances (points, punches, cashback), memberships and tiers. |
| Purchases and rewards | When a store scans your card: the amount of the bill, the branch, the store's receipt number, which staff member recorded it, and what you earned or redeemed. Gifts, vouchers and tickets you buy, receive or send, including gift notes and postcard letters. |
| People | Your connections, people you block, branches you heart, and reviews you write. |
| Your phone and app use | A notification token (if you allow notifications), the pages you open and buttons you tap in Likom (never what you type), your IP address and sign-in times. You can turn off usage tracking in Me → Privacy. |
| Location | Only when you use Explore and allow location. We use it to sort nearby stores and don't save it to your account. |
Why we use it, and on what basis
- To run Likom (to perform our agreement with you): create your account, show your cards, record what you earn and redeem, deliver gifts and tickets.
- To keep it safe (our legitimate interest, and legal duties): stop fake purchases, account takeover and misuse; keep an audit trail.
- To send messages: sign-in codes and important notices (agreement); a store's promotions and reminders only while you haven't muted that store (consent, which you can withdraw from the store's card at any time).
- To improve Likom (legitimate interest, with an opt-out in Me → Privacy).
- To make statistics (legitimate interest): totals and trends that can't identify you, for example how many cards a kind of store gives out. We may keep and use these after your account is gone.
- Because the law requires it: tax, accounting, or a lawful order from authorities.
We don't sell your personal information, we don't share it for advertising, and we don't show third-party ads.
What a store sees
When you add a store's card, that business can see: your name, mobile number (or email if you have no mobile), city, @username, birthday as month and day only (never the year), the branches you heart, and your cards, balances, purchases and rewards at that business. Stores never see your activity at other stores.
Each business runs its own loyalty program and is responsible for using this information lawfully. Questions about how a store uses it go to that store; we'll help.
Who else receives it
These providers run parts of Likom for us, under contracts that let them use your data only on our instructions:
- Neon: database (Singapore)
- Railway: app servers
- Cloudflare: websites, image storage, anonymous site statistics
- Resend: email delivery
- Google (Firebase): push notifications, and Google Sign-In if you use it
We may also disclose information when the law requires it, or to protect people from fraud or harm.
If you're outside the Philippines
Likom is run from the Philippines, and your information is stored in Singapore and handled by providers that may process it in other countries, including the United States. When it leaves the Philippines, we stay responsible for it and use providers bound to protect it to a comparable standard.
If you live somewhere with its own privacy law, such as the European Union or United Kingdom (GDPR), Singapore (PDPA) or California (CCPA), you may have extra rights there, and the rights below are available to you too. We'll answer requests under those laws where they apply to us. You can also complain to your own country's privacy authority.
How long we keep it
- Your account: until you delete it.
- When you delete your account (Me → Privacy → Delete account): you're logged out everywhere and hidden at once (stores and other people no longer see you, and your cards close). For 30 days we keep your account so you can change your mind: logging in again brings it back.
- After those 30 days: your name, @username, email, mobile, birthday, city, password, Google link, connections, blocks, hearts, reviews, messages and app-usage history are erased, and what's left can no longer be linked to you.
- What stays, without your name: records of past purchases, rewards, gifts and tickets, for up to 15 years, because stores need them for their accounts, the law requires some of them, and they help stores understand their business over time.
- A card you delete on its own can be restored for 60 days.
- App-usage events: 6 months.
Your rights
You can ask to be informed about, access, correct, object to, block, delete or get a copy of your personal information, withdraw consent, and be compensated for damage from unlawful processing. You can change most details yourself in Likom → Me, and delete your account there.
For anything else, email [email protected]. We'll answer within 15 days. You can complain to the National Privacy Commission.
Security
We protect your information with measures suited to the risk: encryption in transit, hashed passwords, card QR codes that change every 30 seconds and work once, balances worked out only on our server, limits on sign-in attempts, and access to data only for those who need it.
No system can be made perfectly secure. If a breach is likely to put you at risk, we'll tell you and the National Privacy Commission within the time the law requires (72 hours in the Philippines), and say what we're doing about it. Keep your password and sign-in codes to yourself and tell us at once if you think someone else used your account.
Children
Likom is for people aged 13 and over. If you're under 18, use it with a parent's or guardian's permission. If you believe a child under 13 has an account, tell us and we'll delete it.
Changes
If we change this notice in a way that matters, we'll tell you in the app at least 30 days before it takes effect. If Likom is transferred to a company James Grimaldo sets up, or to whoever takes Likom over, your information goes with it under this notice, and we'll tell you.