Privacy Policy

Effective Date: April 30, 2026 Last Updated: April 30, 2026

This Privacy Policy describes how Lechon Labs, a United States sole proprietorship operated by Sam Silver ("Lechon Labs," "we," "us," or "our"), collects, uses, shares, stores, and protects personal information in connection with Orderbook.ph (the "Service"). It applies to the mobile application, our website at orderbook.ph and lechonlabs.com, and all related services we operate.

This Policy is intended to comply with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Republic of the Philippines, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission of the Philippines ("NPC"). It also addresses requirements under Meta Platforms' Developer Policies, the Apple App Store guidelines, and the Google Play Store policies.

This Policy combines what some services publish as separate "Privacy Policy" and "Data Privacy" pages. Both topics are addressed here in a single document.

We encourage you to read this Policy carefully. By using the Service, you acknowledge that you have read and understood this Policy.

1. Who This Policy Applies To

The Service has two distinct categories of users, and this Policy addresses both. The protections, rights, and obligations described in this Policy may differ depending on which category applies to you.

Sellers. Individuals who create an account and use the Service to manage their food business. When we refer to "you" or "your" in this Policy without qualification, we generally mean Sellers, except where otherwise specified.

Customers. Individuals who place orders with Sellers through Facebook Messenger or other channels integrated with the Service. Customers do not create accounts with us. Their personal information is processed because they have communicated with a Seller who uses our Service.

Important note for Sellers regarding your customers. When you use the Service, you act as the personal information controller of your customers' personal data (as that term is defined under the Data Privacy Act of 2012), and we act as your personal information processor. This means you are primarily responsible for ensuring that your customers have been properly informed about how their data is processed and that you have a lawful basis under the Data Privacy Act to process their data through the Service. By using the Service, you confirm that you have such a lawful basis. The terms governing this processor relationship are described throughout this Policy and in our Terms of Service.

2. Information We Collect

2.1 Information We Collect from Sellers

When you register for and use the Service, we collect:

Authentication Information. When you sign in with Facebook Login, we receive your Facebook profile name, email address, profile picture, Facebook user ID, and the Facebook Pages you administer. We use these to identify you and to connect your Facebook Page to your Orderbook.ph account.

Business Profile Information. Information you provide about your business, including business name, barangay or city, delivery area, delivery fee, operating hours, GCash number (last four digits or full number depending on what you provide), menu items, prices, and photos.

Account Activity. Logs of your interactions with the Service, including login events, feature usage, screen navigation, error events, and synchronization events. This information is used to operate the Service and to diagnose issues.

Subscription and Billing Information. Records of your subscription tier (free or Pro), trial period status, referral activity, and the date and amount of any subscription charge. We do not receive or store your full payment card information; payments are processed by Google Play, the Apple App Store, or other authorized payment processors, who handle billing data under their own privacy policies.

Device and Technical Information. Device model, operating system version, app version, language preference, time zone, and approximate IP-based location. This information is used for authentication, security, debugging, and analytics.

Communications with Us. If you contact us by email, through the Service, or through any other channel, we retain records of those communications and any information you provide in them.

2.2 Information We Collect About Customers (Through Sellers' Use of the Service)

When a customer messages a Seller's Facebook Page, the Service receives data through Meta's webhook integration, including:

Message Content. The text of customer messages sent to the Seller's Facebook Page. This text is processed to identify whether the message contains a food order, and if so, to extract order details such as items and quantities.

Customer Identifiers. The Facebook user ID (Page-Scoped User ID, "PSID") of the customer, which Meta provides through the Messenger Platform. We do not receive a customer's real name, profile photo, or other Facebook profile information unless they include such information in their message to the Seller.

Customer-Provided Information. Any information a customer voluntarily provides in their messages, such as delivery address, payment preference, or contact details. This information is stored as part of the order record so the Seller can fulfill the order.

Order History. Records of orders associated with each customer, including items ordered, quantities, prices, payment status, and delivery status. This information is used to populate the Seller's Order Dashboard, payment tracker, and customer history features.

We do not collect customer location data, contact lists, photos, or any information about customers other than what they choose to share with the Seller through Messenger or other connected channels.

2.3 Information from Third Parties

We receive information from the following third parties:

• Meta Platforms (Facebook and Messenger). Authentication tokens, Page administrative information, and inbound message data through the Messenger Platform.
• Google AI Studio (Gemini API). When the order parser is unable to interpret a message using deterministic methods, we send the message text and the Seller's menu to Google's Gemini service for parsing. Google processes this data under its own terms and privacy policies. We do not receive any new personal information from Google in this exchange; we receive only the parsed result.
• Anthropic. In some scenarios, message text or other content may be sent to Anthropic's Claude API for parsing or assistance. Anthropic processes this data under its own terms and privacy policies. As of the effective date of this Policy, the production order parser uses Google's Gemini service rather than Anthropic's Claude; this is subject to change.
• Google Play, Apple App Store, GCash, and Other Payment Processors. Subscription and billing information, including subscription start and renewal dates, cancellation events, and refund events. We do not receive full payment card or bank account information from these processors.
• Supabase. Our cloud database and authentication provider. Supabase processes data on our behalf as a sub-processor under its own data processing terms.
• Sentry. Error reporting and performance monitoring service. Sentry receives anonymized or pseudonymized error data when the application encounters bugs or crashes.

3. Why We Process Personal Information (Lawful Bases)

Under the Data Privacy Act of 2012, we process personal information only when we have a lawful basis to do so. The bases on which we rely are:

For Sellers' Personal Data:

• Contract Performance. Processing is necessary to fulfill our agreement with you to provide the Service (Section 12(b), DPA 2012).
• Legitimate Interests. Processing is necessary for our legitimate interests in operating, securing, improving, and promoting the Service, where those interests are not overridden by your rights (Section 12(f), DPA 2012).
• Legal Obligation. Processing is necessary to comply with our legal obligations, including tax laws and regulatory requirements (Section 12(c), DPA 2012).
• Consent. For specific processing activities that require consent under applicable law, we will request your consent at the time the activity is initiated, and you may withdraw that consent at any time (Section 12(a), DPA 2012).

For Customers' Personal Data:

When we process Customer Data, we do so as a personal information processor on behalf of the Seller. The lawful basis for processing Customer Data is established by the Seller, who is the controller. The Seller is responsible for ensuring that an appropriate lawful basis exists, which may include:

• The customer's consent (for example, by initiating contact with the Seller through Messenger to place an order);
• The processing being necessary to respond to the customer's order request;
• The processing being necessary for the Seller's legitimate business interests in operating their food business.

4. How We Use Personal Information

We use personal information for the following purposes:

To Provide and Operate the Service:

• Authenticate Sellers and maintain their accounts;
• Receive customer messages from Messenger and other connected channels;
• Parse customer messages to identify orders, extract items and quantities, and create draft order records;
• Send automated reply messages to customers (limited to clarification requests for ambiguous orders during message processing, and order confirmation messages sent only after the Seller affirmatively confirms an order on the Order Dashboard);
• Display orders, payments, customers, menus, and analytics to Sellers within the Service;
• Synchronize data between the Seller's mobile device and our cloud infrastructure.

To Communicate with Sellers:

• Send service-related notifications (account events, system alerts, sync errors);
• Respond to support requests;
• Send important changes to these terms or to the Privacy Policy;
• With your consent or where permitted by law, send product updates, feature announcements, and marketing communications. You may opt out of marketing communications at any time.

To Improve the Service:

• Analyze how Sellers use the Service to identify usability issues and feature opportunities;
• Improve the accuracy of automated order parsing using aggregated, pseudonymized parsing examples;
• Monitor performance, debug errors, and prevent abuse.

To Comply with Legal Obligations:

• Respond to lawful requests from regulatory authorities, including the National Privacy Commission, the Bureau of Internal Revenue, and law enforcement;
• Maintain records required by tax law and consumer protection law;
• Investigate and respond to suspected violations of our Terms of Service or applicable law.

To Protect Our Legal Interests:

• Detect, prevent, and address fraud, security incidents, or abuse;
• Enforce our agreements;
• Establish, exercise, or defend legal claims.

We do not sell personal information. We do not use personal information for behavioral advertising targeting Sellers or Customers.

5. Automated Decision-Making and Artificial Intelligence

The Service uses automated processing to interpret customer messages and create draft order records. This processing involves a cascade of techniques: pattern-matching rules, fuzzy text matching, and large language model inference (using Google's Gemini service).

This automated processing may produce errors, including:

• Misinterpreting the intent of a message;
• Misidentifying menu items or quantities;
• Failing to capture an order;
• Capturing a non-order message as if it were an order.

Sellers retain full control over orders. No order is communicated to a customer as confirmed until the Seller affirmatively reviews and confirms it through the Order Dashboard. Where the parser is uncertain, the Service may send an automated clarification message to the customer (for example, asking the customer to confirm a quantity); these clarification messages are clearly identified as automated and do not commit the Seller to fulfilling an order.

We do not make significant decisions about customers based solely on automated processing in a way that produces legal or similarly significant effects. The Seller remains the decision-maker for whether to accept, modify, or reject any order.

6. How We Share Personal Information

We share personal information only as described below.

Service Providers (Sub-processors). We share personal information with third-party service providers who help us operate the Service. These providers are bound by contractual obligations to protect personal information and to use it only for the purposes we direct. Our current sub-processors include:

We may add or change sub-processors as the Service evolves. Material changes to sub-processor relationships will be reflected in updated versions of this Policy.

Sellers (with respect to Customer Data). Customer Data received through Messenger and other channels is shared with the Seller whose Facebook Page received the message. The Seller is the controller of that data and uses it to fulfill orders.

Legal Compliance. We may disclose personal information if we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, court order, or legal process (including from authorities in the Philippines and the United States);
• Protect the rights, property, or safety of Lechon Labs, our users, or the public;
• Detect, prevent, or address fraud, security, or technical issues;
• Enforce our Terms of Service.

Business Transfers. If Lechon Labs is involved in a merger, acquisition, asset sale, or similar transaction, personal information may be transferred to the acquiring party, subject to a continuing obligation to protect the data in accordance with this Policy or a successor policy at least as protective.

With Your Consent. We may share personal information for purposes not listed above with your consent or at your direction.

We do not sell personal information to third parties. We do not share personal information with third parties for their own marketing purposes.

7. International Transfers of Personal Information

Lechon Labs is operated from outside the Philippines and uses cloud infrastructure that may be located in multiple jurisdictions, including but not limited to Singapore (Supabase), the United States (Google, Anthropic, Meta, Sentry), and other regions. As a result, your personal information may be transferred to, stored in, and processed in jurisdictions outside the Philippines.

When personal information of Philippine data subjects is transferred outside the Philippines, we comply with the cross-border transfer requirements of the Data Privacy Act of 2012 and any applicable NPC issuances. We rely on contractual safeguards, sub-processor commitments, and where applicable, the recipient country's privacy framework.

By using the Service, you acknowledge that your personal information may be transferred to and processed in countries outside the Philippines that may have different data protection standards than your country of residence.

8. Data Retention

We retain personal information for as long as necessary to provide the Service and to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law.

Active Accounts. While your account is active, we retain Seller account information, business profile information, menu data, order records, customer records, and analytics.

Closed Accounts. When a Seller closes their account, we delete or anonymize Seller account information within ninety (90) days, except for:

• Records required for tax, accounting, or legal compliance, which we retain for the period required by applicable law;
• Records reasonably necessary to defend against potential legal claims, which we retain for the applicable statute of limitations period;
• Aggregated, anonymized data used for service improvement, which is no longer associated with any identifiable individual.

Customer Data. Customer Data is retained as long as the associated Seller account is active and may be deleted by the Seller through account-level deletion controls. Sellers are responsible for honoring customer data subject requests under the Data Privacy Act with respect to Customer Data.

Backup Storage. Personal information may persist in encrypted backup systems for up to one hundred eighty (180) days after deletion from production systems before being automatically purged.

Parser Training Examples. With Sellers' consent or under our legitimate interest in improving the Service, we retain pseudonymized records of parsed messages and the Seller-confirmed order outcomes to improve the accuracy of the automated order parser. These records contain message text and parsed output; they do not contain Seller account credentials or customer Facebook profile information beyond the Page-Scoped User ID.

9. Security

We take reasonable organizational, physical, and technical measures to protect personal information from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using industry-standard TLS;
• Encryption of data at rest within our cloud database and storage systems;
• Authentication and access controls limiting personnel access to personal information on a need-to-know basis;
• Webhook signature verification for inbound message data from Meta Platforms;
• Logging and monitoring to detect unauthorized access or unusual activity;
• Regular review of security practices and dependencies.

No method of transmission over the internet or method of electronic storage is one hundred percent (100%) secure. We cannot guarantee absolute security. You are responsible for keeping your authentication credentials confidential and for notifying us immediately if you suspect any unauthorized access to your account.

In the event of a personal data breach involving sensitive personal information or information likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and affected data subjects in accordance with the Data Privacy Act of 2012 and applicable NPC issuances.

10. Your Rights as a Data Subject

Under the Data Privacy Act of 2012, data subjects in the Philippines have the following rights with respect to their personal information:

• Right to Be Informed. You have the right to be informed about the collection and processing of your personal information. This Policy is intended to fulfill that right.
• Right to Access. You have the right to reasonable access to your personal information, including a description of the data, the recipients, the manner of processing, and how the data was obtained.
• Right to Object. You have the right to object to the processing of your personal information, including for purposes of direct marketing, automated processing, or profiling.
• Right to Correct (Rectification). You have the right to dispute and have corrected any inaccuracy or error in your personal information.
• Right to Erasure or Blocking. You have the right to suspend, withdraw, or order the blocking, removal, or destruction of your personal information from our filing systems under certain circumstances.
• Right to Damages. You have the right to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information.
• Right to Data Portability. Where applicable, you have the right to obtain a copy of your personal information in an electronic, structured, and commonly used format.
• Right to File a Complaint. You have the right to file a complaint with the National Privacy Commission. The NPC's contact information is available at privacy.gov.ph.

To exercise any of these rights, contact us at kumusta@orderbook.ph. We will respond within fifteen (15) business days, or sooner where required by law. We may need to verify your identity before responding to a request, and we may decline requests in limited circumstances permitted by law (for example, if the request is manifestly unfounded or excessive, or if fulfilling it would violate the rights of others).

Important note for Customers (data subjects of Sellers). If you are a customer who has placed an order with a Seller using Orderbook.ph, the Seller is the personal information controller of your data. You should direct data subject requests primarily to the Seller. We will assist Sellers in responding to such requests where required, but the Seller remains the primary point of contact. If you cannot reach the Seller or believe the Seller is not responding appropriately, you may contact us at kumusta@orderbook.ph and we will assist where we can.

11. Children's Privacy

The Service is not intended for individuals under the age of eighteen (18). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at kumusta@orderbook.ph and we will delete the information promptly.

Sellers must not use the Service to process orders from individuals known to be under eighteen (18) years of age, except where the order is placed by a parent or legal guardian on behalf of a minor.

12. Cookies and Similar Technologies

The Orderbook.ph mobile application uses local device storage (including WatermelonDB and similar local databases) to provide offline functionality. The orderbook.ph and lechonlabs.com websites use minimal cookies necessary for site functionality. We do not use third-party advertising cookies or behavioral tracking cookies on our properties.

The Service integrates with third-party services (such as Meta and Google) that may use their own cookies and tracking technologies under their respective privacy policies. We do not control these third-party technologies.

13. Data Protection Officer and Contact

Lechon Labs has designated a Data Protection Officer (DPO) responsible for ensuring compliance with the Data Privacy Act of 2012 and related regulations.

Data Protection Officer: Sam Silver, in his capacity as the operator of Lechon Labs. Contact Email: kumusta@orderbook.ph

You may contact the DPO at the email address above for any matter related to:

• Exercising your rights as a data subject;
• Filing a privacy concern or complaint;
• Asking questions about how we process your personal information;
• Requesting clarification of any provision of this Policy.

We will acknowledge receipt of your message within five (5) business days and provide a substantive response within fifteen (15) business days, except where applicable law specifies a different timeline.

14. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified through the Service or by email at least fifteen (15) days before they take effect, where reasonably practicable. The "Last Updated" date at the top of this Policy reflects the most recent revision. Your continued use of the Service after the effective date of any change constitutes your acceptance of the modified Policy.

15. Regulatory Information and Lawful Basis Summary

This Section summarizes key regulatory disclosures required under the Data Privacy Act of 2012:

• Personal Information Controller (for Seller Data): Lechon Labs (a sole proprietorship operated by Sam Silver).
• Personal Information Processor Role: Lechon Labs acts as a personal information processor on behalf of Sellers with respect to Customer Data.
• Purposes of Processing: As described in Section 4.
• Lawful Bases: As described in Section 3.
• Categories of Recipients: As described in Section 6.
• International Transfers: As described in Section 7.
• Retention Periods: As described in Section 8.
• Data Subject Rights: As described in Section 10.
• Data Protection Officer: As described in Section 13.

Where we process personal information of data subjects of more than one thousand (1,000) individuals, we register with the National Privacy Commission as required by NPC Circular No. 2022-04 and applicable issuances. Our NPC registration status will be displayed in this Policy once registration is completed.

16. Contact

For questions about this Policy or to exercise your rights as a data subject, contact:

Lechon Labs A sole proprietorship operated by Sam Silver Data Protection Officer: Sam Silver Email: kumusta@orderbook.ph

You may also file a complaint with the National Privacy Commission of the Philippines at privacy.gov.ph if you believe your rights under the Data Privacy Act of 2012 have been violated.