KantoHub
Favorites

Privacy Policy

Last updated: October 29, 2026

This Privacy Policy explains what personal information KantoHub collects, why, who can see it, how long we keep it, and the choices you have. We handle personal information in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). Using the site also means agreeing to our Terms of Use.

1. Who we are

KantoHub is a directory of local businesses in the Philippines. For the personal information described here, KantoHub is the personal information controller. For privacy questions or requests, contact us at hello@kantohub.com.

2. What we collect

When you create an account

  • Your first and last name, email address and password (stored only in scrambled, hashed form; we can’t read it).
  • Whether you joined as a member or a business owner, whether you confirmed your email, and when you agreed to our Terms and this Privacy Policy (and which versions).
  • Optional, in My account: a profile photo, a public name for your reviews, a mobile number, a home address and a home location on the map (rounded to about 100 metres).
  • Your settings, such as whether you want emails from places you follow, and your favorites (the businesses you saved).

When you list a business

  • The business details you enter: name, categories, address, map pin, phone, email, website and social links, hours, menu, services, prices, photos, delivery and pickup details, today’s menu and promos. These are public; that’s the point of a listing.
  • Suggestions you send us (new categories, tags or communities), requests to join a community, and “Is it yours?” phone number claims.
  • Verified badge documents: photos or PDFs of your business permit, BIR Form 2303 and, if you send them, DTI/SEC/CDA registration and barangay clearance.
  • If our team hides your listing and you reply, your note and any proof file you attach.

When you pay for Pro, an extra listing or an ad

  • What you bought, the amount, GCash or Maya, the reference number, and the screenshot of your receipt. A screenshot can show your name, mobile number and account details as GCash or Maya display them.
  • For ads: your posters, the dates you chose, and our team’s notes.
  • You pay in the GCash or Maya app. We never receive your PIN, password, one-time codes or card details.

When you use the site

  • Reviews and replies: your stars, words, photos, and the date.
  • Inquiries you send a business: your name, email, phone number (optional) and message.
  • Reports you make about a listing: the reason and your note.
  • Your location, only if you allow it in your browser, to show what’s near you and distances. It is rounded to about 100 metres.
  • Push notifications, only if you turn them on: the browser’s subscription address for your device.
  • Visit counts: when someone opens a business page or taps Call, Directions, Website, Share or the heart, or sees or taps an ad, we add 1 to that business’s count for the day. The counts don’t say who you are.
  • Your IP address, used only briefly: to avoid counting the same visit twice within 30 minutes, and to slow down repeated sign-up and login attempts. It is kept as a scrambled (hashed) key in temporary storage that expires within a day, and is not added to your account, reviews or the counts.
  • A record of the emails we send you (address, subject, type and whether it was delivered to the mail server).

3. Why we use it

  • To run your account, keep you logged in and keep it secure (legitimate interest and our agreement with you under the Terms).
  • To show listings, reviews, favorites, distances and routes, and to deliver your inquiries to businesses (our agreement with you).
  • To check Verified badge documents, payment receipts and ads before turning them on, and to keep records of payments (our agreement with you, and legal obligations such as tax records).
  • To send emails and notifications you asked for, and service messages your account needs. You can turn off emails from places you follow at any time.
  • To give owners stats about their own listings and ads, as totals only.
  • To prevent spam, fake listings, fraud and abuse, and to look into reports (legitimate interest).

We don’t sell your personal information, we don’t use it for advertising profiles, and the site has no third-party advertising or analytics trackers. The ads on the site are posters from businesses listed here, chosen by the category and area of the page you’re looking at, not by who you are.

4. Who can see what

  • Everyone: business listings and their details; reviews with the reviewer’s public name (for example “Maria S.”), profile photo, stars, words and photos; owner replies; shared favorites lists you choose to share by link.
  • The business owner: inquiries sent to their business (including your email and phone, so they can reply), the stats totals for their listings and ads. Owners don’t see who reported their listing, who favorited it, or your account email, phone, address or location.
  • Our team (site administrators and directory admins): what they need to run the site, including account details, reports, verification documents, payment screenshots, ads waiting for review and inquiries. Verification documents and payment screenshots are kept in a private folder outside the public website and can be opened only by you and our team.
  • Never public: your email, password, mobile number, home address, home location, verification documents and payment details.

5. Services we use

Some parts of the site load from other services. When they do, your browser connects to them and they receive your IP address and basic browser details, under their own privacy policies:

  • unpkg: the Leaflet map library.
  • OpenStreetMap services: map images (tile.openstreetmap.org), routes (routing.openstreetmap.de), and finding a place from its address when it has no map pin (nominatim.openstreetmap.org). When you ask for a route, the start point (where you are, or your home) and the business’s location are sent to the routing service.
  • Push services run by your browser’s maker (such as Google, Mozilla or Apple), only if you turn on notifications. The message is encrypted for your device.
  • Our web host and email provider, which store the site and deliver our emails.
  • GCash and Maya, when you pay. Your payment is made in their app, under their terms and privacy policies.
  • Share buttons (Facebook, Messenger, Viber and others) open those services only when you tap them.

6. Cookies and storage in your browser

We use only first-party cookies and browser storage that the site needs to work. No advertising or tracking cookies.

  • Login cookies (WordPress): keep you logged in.
  • kh_loc (cookie, 1 day): your rounded location, only after you allow “near me”. Turning “near me” off removes it.
  • Browser storage (stays on your device): your favorites (kh_saved, so guests can keep favorites without an account), light or dark theme (kh-theme), recent searches (kh_recent_searches), dashboard layout and dismissed reminders (kh_dash_collapsed, kh_dash_hidden), whether notifications are set up (kh_push_synced), and the map location of a place found by its address.

You can clear these in your browser settings at any time; the site will still work, but you may need to log in again and guest favorites will be lost.

7. How long we keep it

  • Inquiries: deleted automatically after 180 days. (A copy also goes to the business by email, which they keep under their own control.)
  • Email records: deleted after 30 days.
  • Hashed IP keys for counting and rate limits: expire within 30 minutes to a day.
  • Location cookie: 1 day.
  • Visit counts: kept as daily totals per business, with no personal information.
  • Verification documents: kept while the listing exists, so the badge can be checked again; deleted with the listing.
  • Payment requests and receipt screenshots: kept while your account exists, for our records; deleted when your account is deleted.
  • Account, reviews and replies: kept until you delete them or your account.

8. Deleting your account

You can delete your account yourself in My account. Business owners first delete their listings (which also deletes their photos and Verified badge documents). Deleting your account removes your profile, profile photo, reviews and replies (with their photos), favorites, notification subscriptions, payment requests and receipt screenshots, and your email records. Inquiries you sent to businesses expire on their own as described above. If you can’t delete your account yourself, contact us and we’ll do it.

9. How we protect it

Passwords are hashed. Verification documents and payment screenshots are stored outside the public website under random file names and served only to you and our team. Team actions need a team account. Sign-up, login, reviews and payments are rate-limited to stop abuse. Push messages are encrypted. No system is perfectly secure; if a personal data breach happens that is likely to put you at risk, we will notify you and the National Privacy Commission as the law requires.

10. Your rights

Under the Data Privacy Act, you have the right to:

  • be informed about how your personal information is used (this page);
  • access the personal information we hold about you;
  • correct it if it’s wrong (most of it you can edit yourself in My account and the listing editor);
  • object to its use, and withdraw consent you gave (for example, turning off location, notifications or follower emails);
  • erasure or blocking of information that is no longer needed or was processed unlawfully (you can delete your reviews and your account yourself);
  • data portability: get a copy of your information in a common electronic format;
  • damages, if you suffer harm from inaccurate, unlawfully obtained or unauthorised use of your information;
  • file a complaint with the National Privacy Commission (privacy.gov.ph).

To use any of these rights, write to hello@kantohub.com. We may ask you to confirm it’s really you before we act, and we’ll answer within a reasonable time.

11. Age

You must be 18 or older to create an account on KantoHub. We don’t knowingly collect personal information from children. If you think a child has given us their information, contact us and we’ll delete it.

12. Changes to this policy

If we change how we handle personal information, we’ll update this page and the date at the top. If a change is significant, we’ll tell account holders by email or a notice on the site.

13. Contact us

Questions, requests or complaints about your privacy: hello@kantohub.com.