Privacy Policy
Last updated 29 October 2026
This explains what personal data JoyBook collects, why, who sees it, how long we keep it, and how you can control it. In short: we collect what’s needed to connect you with businesses, we don’t sell your data, analytics only run if you say yes, and you can download or delete your data from Profile at any time.
1. Who we are
JoyBook is run by Maxiconn Technologies (Philippines), referred to here as “we” or “us”. We decide how the personal data described here is used, so under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, the “DPA”) we are its personal information controller.
Our Data Protection Officer is Jovani Wayne Ogaya. Write to privacy@joybookapp.com about anything in this policy.
2. What this policy covers
The JoyBook app at www.joybookapp.com, the business site at business.joybookapp.com (the owner console and the booking, chat and review pages businesses share with their guests), and the emails and notifications we send.
Businesses are responsible for their own use of your data. When you book or message a business, it receives the details it needs to serve you (section 5) and becomes a controller of that data in its own right. Its own privacy notice applies to what it does with it. Booking pages that a business shares from its own website are run by us on the business’s behalf.
3. What we collect
What you give us
- Your account: name, email address and/or mobile number, and a password (stored only as a one-way hash).
- Bookings: the business, dates or appointment time, number of guests, room or service, any notes you add, and, if you book for someone in your household, that person’s name. Only add someone else’s details if you are allowed to.
- Payment proofs: the screenshot or photo of a receipt and the reference number you upload. Payments go directly to the business; we never receive your money or your card, GCash or bank login.
- Messages and photos you send to businesses in chat.
- Reviews you write, with the name shown alongside them.
- Choices you make in the app: saved places, reminders, people you share your schedule with (their email address), personalization settings, and places you hide.
- Messages to us, for example at hello@joybookapp.com.
What we collect as you use JoyBook
- Your location, only when you tap “Near me”. It is rounded to about 1 km on your device, used for that search and not stored by us. You can choose a town instead.
- Booking and visit history, used for “Book again” and reminders if you turn personalization on.
- Push notification address for your browser or phone, if you turn notifications on.
- Technical data: IP address, browser type and request logs, used to keep the service running and secure (for example to limit repeated sign-in attempts).
- Views of listed places: we count how many people saw a place. The count keeps no IP address or account, and nothing is sent if your browser has Do Not Track or Global Privacy Control turned on.
- Analytics, only if you accept cookies (see the Cookie Policy).
“Recently viewed” places are kept only on your device and are never sent to us.
If you run a business on JoyBook
- Your account and contact details, and the business details, photos and prices you publish.
- Documents you give us to verify the business, such as a DTI or SEC registration, a business permit, an ID or a DOT accreditation. They are kept in separate private storage that only authorised verification staff can open.
- Payment account details you publish for guests. We may check that a GCash or bank account is in the business’s or owner’s name with a small test transfer.
- Plan and billing records. Card and PayPal payments are handled by Stripe and PayPal; we don’t receive full card numbers.
- Social accounts you connect to post from JoyBook, such as through Buffer or Facebook.
From public sources
Some places are listed before their owner joins, using public business information (name, category, address, map location and public contact details) from open map data and the Department of Tourism’s published accreditation lists. Owners can claim, correct or ask us to remove these listings.
4. Why we use it, and on what basis
The DPA allows processing only for a lawful reason. Ours are:
- To provide the service you asked for (a contract with you): your account, sending booking requests and messages to businesses, showing their replies, emails about your bookings and password resets.
- With your consent, which you can withdraw at any time in the app: analytics cookies, personalization and rebook reminders, and push notifications.
- Our legitimate interests, balanced against your rights: keeping JoyBook secure, preventing fraud, fake reviews and spam, verifying businesses, counting place views without identifying anyone, and improving the service.
- Legal obligations: answering lawful requests from authorities and keeping records the law requires.
We don’t sell your personal data, and we don’t use it for advertising on other sites.
6. Data outside the Philippines
Our servers and stored files are in Singapore. Some providers above (for example Google, Resend and Cloudflare) may process data in other countries, including the United States. We remain responsible for your data wherever it is processed, and we use providers bound by contracts that require protection comparable to the DPA.
7. How long we keep it
- Your account: until you delete it.
- When you delete your account, we erase your name, email, phone and password, and remove your saved places, notifications, personalization, reminders, household and sharing settings, and push addresses. Bookings, chat messages and reviews stay with the businesses as their records, no longer linked to you and shown as “Deleted account”. We keep the record of what you consented to, as proof.
- Email confirmation and password links expire after a few days.
- Analytics data is kept for no longer than 14 months.
- Business verification documents: while the business is on JoyBook, and afterwards only as long as needed to handle disputes or meet legal requirements.
- Billing records: as long as tax and accounting rules require.
Deleted data can remain in encrypted backups for a short time until those backups are replaced.
8. Your rights
Under the DPA you have the right to:
- be told how your personal data is used (this policy);
- see the personal data we hold about you and get a copy of it;
- correct data that is wrong or incomplete;
- object to processing, and withdraw consent you gave;
- have your data deleted or blocked;
- receive your data in a format you can take elsewhere;
- claim damages if you are harmed by inaccurate, unlawfully obtained or misused data;
- complain to the National Privacy Commission.
Most of this you can do yourself in the app:
- Profile: edit your details, download everything we hold about you, or delete your account.
- Profile → Personalization: turn personalization and reminders on or off.
- Cookie settings (at the bottom of every page): change your analytics choice.
- Notifications: turn push off in the app or in your browser or phone settings.
For anything else, write to privacy@joybookapp.com. We may ask you to confirm who you are, and we will answer within 30 days. If you aren’t satisfied, you can complain to the National Privacy Commission at privacy.gov.ph.
9. How we protect it
Data travels encrypted (HTTPS). Passwords are stored only as one-way hashes. Photos, payment proofs and verification documents are kept in private storage and shown only to the people they are meant for. Access by our team is limited to those who need it, and admin actions are logged.
No system is perfectly secure. If a breach puts your data at real risk, we will notify the National Privacy Commission and the people affected within 72 hours of finding out, as the DPA requires.
10. Children
You must be at least 18 to create a JoyBook account. A parent or guardian can book for a child in their household; they provide the child’s name and are responsible for it. If you believe a child has given us personal data, tell us and we will delete it.
11. Changes to this policy
We update this policy when what we do changes, and change the date at the top. If a change affects how we use data you already gave us, we will tell you in the app or by email before it applies, and ask for your consent again where the law requires it.
12. Contact
Maxiconn Technologies, Philippines
Data Protection Officer: Jovani Wayne Ogaya, privacy@joybookapp.com
General questions: hello@joybookapp.com