Privacy Policy

1. Who is responsible

Arkila is the personal information controller for the data described here. We are based in the Philippines and process data under the Data Privacy Act of 2012 (RA 10173) and its implementing rules.

Vehicle owners on the platform are separately responsible for how they handle anything they learn about a renter during a rental. We do not control that, which is why we deliberately show them as little as possible (section 5).

2. What we collect

Everyone with an account

• Name, email address and mobile number
• Password, stored only as a cryptographic hash — we never see it
• Profile photo, if you add one
• Language preference, account status, and when you last signed in
• Your rating, review count and completed trips

Renters

• Driver's licence: number, category, restrictions, date of birth, issue and expiry dates
• Three photographs: the front and back of the licence, and a selfie
• Text read automatically from the licence image, so a reviewer can compare it against what you typed

Vehicle owners

• Business name and type, registration number and TIN
• Business address, contact person and contact number
• Payout details — bank, GCash or Maya account
• Vehicle documents, including OR/CR and insurance

From using the platform

• Bookings, including dates, pickup and drop-off addresses, and their map coordinates
• Messages and any photographs sent in a booking conversation
• Condition photographs and signatures recorded at pickup and return
• Payment records — amounts, status and the reference our payment provider returns
• Reviews you write and receive
• A push notification token for each device you sign in on
• Product analytics: which screens are reached and which steps are completed

We never receive your full card number. Payment details are entered on our payment provider's own page. What comes back to us is a reference and a result.

3. Why we collect it

We do not sell personal data, and we do not use it for advertising.

4. Identity documents

Licence photographs, business papers and vehicle documents are the most sensitive things we hold, and they are handled differently from everything else:

• They are stored on private storage and are never reachable from a public address.
• A link to view one is signed and expires within minutes. It cannot be forwarded or bookmarked.
• Your licence number and an owner's payout account number are encrypted in the database, not merely access-controlled.
• Every time a member of staff opens one, we record it — who looked, at which document, when, from which address, and why. That log exists so misuse can be found rather than merely discouraged.

An owner reviewing your rental request never sees your licence number. They see a masked version, the category, the expiry date, and whether we verified it — enough to trust the person collecting their vehicle, never enough to reuse the document.

5. What other users can see

Copying, sharing or storing another user's identity document breaches our terms and may be an offence under the Data Privacy Act.

We may disclose data to law enforcement or a regulator where we are legally required to, and to our professional advisers where necessary.

6. Third parties we use

These providers process data on our behalf, under contract:

Some of these process data outside the Philippines. Where that happens we rely on contractual protections consistent with the Data Privacy Act.

7. How long we keep it

When an account is closed we retain the records we are obliged to keep and remove the rest. Financial and dispute records outlive an account — we cannot delete a payment we are required to account for.

8. How we protect it

• Traffic between the app and our servers is encrypted in transit.
• Passwords are hashed. Licence numbers and payout accounts are encrypted at rest.
• Documents sit on private storage, reachable only through short-lived signed links.
• Staff access is limited by role, and access to identity documents is logged.
• Suspending an account signs it out on every device immediately.

No system is perfectly secure. If a breach occurs that is likely to put you at risk, we will notify you and the National Privacy Commission as the law requires.

9. Your rights

Under the Data Privacy Act you have the right to:

• Be informed — this page, and any specific notice we give you
• Access a copy of the personal data we hold about you
• Correct anything inaccurate
• Object to processing, including analytics
• Erasure or blocking, where the data is no longer needed or was unlawfully obtained
• Data portability — a copy in a usable electronic format
• Damages, where you suffered loss through misuse of your data
• Complain to the National Privacy Commission

To exercise any of these, contact us using the details below. We will respond within the period the law allows, and we may need to confirm your identity first — precisely because we will not hand personal data to someone who merely claims to be you.

Some rights have limits. We cannot erase records we are legally required to keep, and we cannot remove a verification decision while a booking that relied on it is still open.

10. Children

Arkila is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, tell us and we will delete it.

11. Changes

We may update this policy. The version and date are shown at the top of this page. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.

12. Contact and complaints

For any question about this policy, or to exercise a right under section 9, contact our Data Protection Officer:

If you are not satisfied with our response, you may complain to the National Privacy Commission, 5th Floor, Delegation Building, PICC Complex, Pasay City — privacy.gov.ph.