ehatud Merchant Privacy Policy

Effective Date: July 10, 2026

ehatud (“ehatud,” “we,” “us,” or “our”) is a duly registered sole proprietorship under the laws of the Republic of the Philippines, with principal business address at 32 Purok Papaya, Pondol, Hinunangan, Southern Leyte, Philippines. This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use the ehatud Merchant app and related services (the “Platform”).

This Privacy Policy applies specifically to Merchants and should be read together with our Merchant Terms and Conditions. If you use the ehatud Customer app or the ehatud Rider app, see the separate Privacy Policy for that app.

1. Information We Collect

1.1 Information You Provide at Registration

• Account information: business name, contact person, mobile number, email address, and password.

• Google Sign-In: if you choose to register or log in using Google Sign-In, we receive your name, email address, and profile photo from Google to create and authenticate your account.

• Communications: messages you send to support or Customers through the Platform, and any complaint or dispute details you submit.

1.2 Business Verification Data

• Business verification documents: DTI/SEC/CDA registration, business permits, tax registration, and sanitary or operational licenses submitted for onboarding and compliance checks.

• Settlement/financial information: your designated business bank account details, used solely to process weekly settlement payouts.

1.3 Operational and Performance Data

• Order data: listings, prices, order confirmations, cancellations, and preparation times.

• Performance metrics: order confirmation rate, auto-cancellation rate, preparation and rider wait-time metrics, complaint frequency, and order accuracy rate, used to evaluate performance and manage visibility, ranking, and account status on the Platform.

1.4 Information from Payment Partners

Settlement payouts and GCash Cash-on-Delivery (COD) verification are processed by PayMongo Philippines, Inc. (“PayMongo”), our current licensed third-party Payment Partner. We may receive limited transaction and confirmation data from PayMongo — such as payment status, reference numbers, and payout amount — to complete settlement and reconcile orders. Should we add or transition to another authorized Payment Partner (such as Dragonpay Corporation), we will update this Policy accordingly.

1.5 Location Data

With your permission, we collect precise and approximate location data from your device to detect your store's service area and support accurate order routing. Location is accessed only while you are using the app; we do not collect location data in the background.

1.6 Photos and Media

With your permission, we access your device's photo library and camera to let you upload product photos and business verification documents.

1.7 Device and Diagnostic Data

We use Sentry, a third-party crash-reporting and diagnostics service, to automatically collect crash logs, device model, operating system version, and app performance data when the app encounters an error. This diagnostic data helps us identify and fix technical issues and does not include your messages or business records.

1.8 Push Notification Data

To send you order alerts and account notifications, we collect a device push notification token through Firebase Cloud Messaging (Google), a third-party notification delivery service.

2. How We Use Your Information

• Verify your business eligibility to operate on the Platform.

• Process weekly settlements and reconcile order-related adjustments.

• Evaluate performance metrics and manage visibility, ranking, and account status accordingly.

• Investigate and resolve disputes, chargebacks, and refund claims.

• Monitor for fraud and enforce our Terms and Conditions.

• Maintain the security, integrity, and performance of the Platform.

• Detect your store's approximate service area to support order routing accuracy.

• Send push notifications for order updates and account alerts.

• Diagnose and fix technical errors through automated crash and performance reporting.

• Comply with applicable laws, regulations, and lawful requests from public authorities.

We do not use your data for purposes incompatible with the above without first notifying you and, where required by law, obtaining your consent.

3. How We Share Your Information

• With Customers: your listing information, business name, and order-related details necessary to complete a transaction.

• With Payment Partners (currently PayMongo): settlement details, including bank account information, necessary to process weekly settlements.

• With service providers: vendors who help us operate the Platform under confidentiality and data protection obligations, including Appwrite (Appwrite Cloud), our backend hosting, authentication, and database provider; Sentry, our crash and diagnostics reporting provider; and Google (Firebase Cloud Messaging), our push notification delivery provider.

• For legal reasons: when required by law, regulation, court order, or to protect the rights, property, or safety of ehatud, our users, or the public.

• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to continued protection of your information under this Policy.

Access to business verification documents and bank account details is restricted to personnel and systems that need it for onboarding, settlement, and compliance purposes. We do not sell your personal information.

Some of our service providers, including Appwrite Cloud, Sentry, and Google, may process or store data on servers located outside the Philippines. Where this occurs, we require these providers to maintain data protection standards consistent with the Data Privacy Act of 2012.

4. Data Retention

We retain your information for as long as your account remains active and as necessary to fulfill the purposes described in this Policy. Transaction records, settlement history, and related financial documentation are retained for the period required under applicable Philippine tax and accounting regulations (generally up to ten (10) years), even after your account is deleted. Business verification documents are retained only for as long as necessary for compliance and audit purposes, after which they are securely deleted.

5. Account and Data Deletion

You may request deletion of your Merchant account and associated data at any time, using either of the following methods:

• In-app: Go to Account Settings > Delete Account, and follow the on-screen instructions.

• Web request: Submit a request at https://sites.google.com/view/ehatud/account-deletion or email us at support@ehatud.com.

Before a deletion request can be completed, any pending settlement, open dispute, chargeback investigation, or outstanding platform fee must first be resolved. Once submitted, your account will be deactivated for a 30-day recovery period. Signing in during this period will automatically cancel the deletion request and restore your account. If no recovery action is taken within 30 days, we will permanently delete or anonymize your Merchant profile and operational data, while retaining financial and transaction records as described in Section 4. Temporarily deactivating or suspending your account, whether initiated by you or by ehatud outside of this process, does not constitute a deletion request.

6. Your Rights

Under the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, you have the right to be informed of processing, access your data, request correction, object to processing (subject to legal or contractual restrictions), request erasure or blocking, request data portability where feasible, and file a complaint with the National Privacy Commission (NPC). To exercise these rights, contact us using the details in Section 8.

7. Data Security

We implement reasonable organizational, technical, and physical safeguards designed to protect your data against unauthorized access, alteration, disclosure, or destruction, including encrypted data transmission, access controls, and transaction monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Contact Us

ehatud – Merchant Privacy Inquiries

Address: 32 Purok Papaya, Pondol, Hinunangan, Southern Leyte, Philippines

Email: support@ehatud.com.

Account/data deletion request link: https://sites.google.com/view/ehatud/account-deletion

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated Policy on this page with a revised Effective Date. Continued use of the Merchant app after changes take effect constitutes acceptance of the updated Policy.