Privacy Policy

1. Information We Collect (Only What is Necessary)

To maintain campus safety, prevent fraud, and facilitate peer-to-peer exchanges, we collect only the minimal necessary information:

• Account Credentials: Name and official institutional email address (e.g., @usm.edu.ph) provided via Google Single Sign-On.
• Campus Profile: Display name, profile photo, bio, and optional college/department affiliation (e.g., CEIT, CASS, CA) voluntarily provided by you.
• Verification Data: Photos of your valid USM Student ID or Certificate of Registration (COR) uploaded solely to obtain a “Verified Student” trust badge.
• Listing Data: Item title, description, price, category, condition, and photos of items you offer for sale, rent, or trade.
• Platform Communications: Messages sent between buyers and sellers within the built-in MarketKo chat system.

2. Purpose of Data Processing

We process your personal information strictly for the following legitimate purposes:

3. Zero Data Monetization & Third-Party Disclosure

We do NOT sell, rent, monetize, or disclose your personal information to commercial advertising networks, data brokers, or external marketers.

Information is only shared under the following limited circumstances:

• With other USM students: Your public profile (display name, avatar, college) and active listings are visible to authenticated peers on MarketKo.
• Infrastructure providers: Secure cloud database and authentication services (Supabase) operating under strict encryption and contractual data protection terms.
• Legal & Campus Authorities: Only when strictly required by applicable Philippine law, a valid subpoena, or university disciplinary proceedings investigating verified criminal misconduct.

4. Storage, Encryption & Retention

Your data is stored in cloud infrastructure secured with HTTPS/TLS 1.3 in transit and AES-256 encryption at rest. Database access is restricted through granular Row Level Security (RLS) policies.

Student ID verification photos are stored in a private, non-public storage bucket accessible only by authorized student moderators for verification purposes, and are retained only for the duration required to confirm enrollment status.

5. Your Rights as a Data Subject

Under the Philippine Data Privacy Act of 2012, you possess the following rights:

• Right to be Informed: To understand how your personal data is collected and processed.
• Right to Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To correct inaccurate or outdated information in your profile.
• Right to Erasure / Blocking: To request account deletion and removal of all your active listings and message history.
• Right to Damages: To seek indemnification for damages sustained due to unlawful data processing.

6. Data Protection & Inquiries

If you have any questions, concerns, or requests regarding your personal data or wish to exercise your rights under RA 10173, please contact: