Privacy Policy
How Fawn collects, uses, and protects your data — compliant with the Philippine Data Privacy Act of 2012.
Effective date: August 30, 2026
Welcome to Fawn. Fawn is an electric bill tracker designed for property managers in the Philippines to record monthly submeter readings, generate peso bills per submeter, and track portfolio-wide consumption and cost history.
This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and your rights under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations. It covers data handling only — for usage rules, accounts, and liability, see our Terms of Service.
By creating an account and using Fawn, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the service.
1. Account Information
- Email address (used for authentication and notifications)
- Hashed password (stored via better-auth; we never see your plaintext password)
- Name (optional, from OAuth providers if used)
- Profile image (optional, from OAuth providers)
2. Operational Data
- Properties: name, description, address
- Submeters: label, multiplier, status (active/archived)
- Readings: previous dial, current dial, multiplier, peso total, billing month, optional notes
- Billing date preferences per property
3. Media Files
- Meter face photos (current and previous reading) uploaded as proof — stored via Cloudinary
4. Technical & Usage Data
- Device information (browser, OS, screen size) for PWA installation and responsive layout
- IP address (briefly, for request routing and abuse prevention; not stored long-term)
- No analytics cookies, tracking pixels, or third-party analytics scripts
We process your data for the following purposes:
- Service delivery: Authenticate you, store your properties/submeters/readings, generate monthly bills, and show consumption history.
- Contractual necessity: The core bill-tracking workflow requires storing readings and photos as evidence for tenant billing.
- Security: Detect and prevent unauthorized access, enforce session management.
- Communication: Send billing date reminders (only if you enable them) and critical service notices.
- Legal compliance: Retain records as required by Philippine tax and business regulations.
We do not sell your data, use it for advertising, or share it with data brokers.
Canonical location for infrastructure & security disclosure. The Terms reference this section instead of duplicating it.
Database: Managed PostgreSQL. All connections use TLS encryption.
Images: Meter photos stored on an image optimization CDN with signed URLs for access control.
Authentication: Self-hosted auth library with secure password hashing (bcrypt), HTTP-only cookies, and CSRF protection.
Transport: All traffic served over HTTPS via Vercel edge network.
Access control: Single-account architecture — only you can access your data. No team/multi-user access exists. Account duties (password secrecy, etc.) are in Terms → Accounts & Security.
Note: We do not currently host in a Philippines-specific data region. If this is a regulatory requirement for your use case, please contact us.
Canonical vendor table for the whole product. The Terms link here instead of repeating it.
We engage the following categories of subprocessors to operate Fawn. Each has a Data Processing Agreement (DPA) or equivalent terms in place. Specific vendor details are available upon request.
| Category | Purpose | Data Categories | Location |
|---|---|---|---|
| Authentication library (self-hosted) | Authentication, session management | Email, password hash, session tokens | Within our database (US / Singapore) |
| Managed PostgreSQL database | Primary data storage | All operational data | US / Singapore |
| Image optimization & delivery CDN | Image upload, storage, optimization, delivery | Meter photos | US / Singapore |
| Cloud hosting & edge platform | Hosting, edge network, serverless functions | IP address (transient), logs | Global edge |
Canonical deletion schedule. The Terms reference this section for account-termination effects.
Active Account
All data is retained while your account is active and you use the service.
After Deletion Request
- Account & operational data: deleted within 30 days of verified request
- Meter photos: deleted from Cloudinary within 30 days
- Database backups: purged within 90 days (rolling backup cycle)
Legal Holds
Data may be retained longer if required by Philippine tax law (BIR), a court order, or an investigation by the National Privacy Commission.
As a data subject under Philippine law, you have the following rights:
- Right to Access: Request a copy of all personal data we hold about you.
- Right to Rectification: Correct inaccurate or incomplete data.
- Right to Erasure (Blocking/Deletion): Request deletion when data is no longer necessary, consent is withdrawn, or processing is unlawful.
- Right to Restriction: Limit processing while accuracy or lawfulness is verified.
- Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format.
- Right to Object: Object to processing based on legitimate interest (though core service delivery relies on contractual necessity).
- Right to Complain: Lodge a complaint with the National Privacy Commission (NPC) at privacy.gov.ph.
To exercise any right, email our Data Protection Officer at johnthomasalog@gmail.com. We will respond within 15 business days as required by the NPC.
Fawn is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us immediately and we will delete it.
We may update this policy to reflect changes in our practices or legal requirements. The "Effective date" at the top will be revised.
Material changes will be announced via an in-app banner and/or email at least 15 days before they take effect. Continued use after the effective date constitutes acceptance.
Questions, concerns, or requests regarding this policy or your data:
We aim to respond within 15 business days per NPC guidelines.