MatchBroker (“we”, “us”, “our”) is a professional networking and matching platform for licensed Philippine real estate brokers. This Privacy Policy explains what personal information we collect, how we use it, when we share it, and the rights you have as a data subject under the Philippine Data Privacy Act of 2012 (RA 10173) and its implementing rules and regulations.
1. Who we are
MatchBroker is operated by Vancor Distribution, OPC, a one-person corporation registered in the Philippines. For any privacy matter, contact us at info@matchbroker.ph. Vancor Distribution, OPC is the Personal Information Controller (PIC) for MatchBroker’s data processing activities.
2. Information we collect
2.1 Information you provide when you register
- Broker account details: full name, professional email address, mobile number (+63), and a password (which we store only as a one-way bcrypt hash — the plaintext is never persisted).
- PRC verification data: your Professional Regulation Commission (PRC) real estate broker license number and an image of your PRC ID card. We use this data solely to confirm that you are a licensed broker before granting access. PRC ID images are stored in object storage with restricted access.
- Referral code (optional) — links your registration to another broker’s account so trial or Pro credits can be applied.
2.2 Information we receive when you sign in with Google
If you choose to sign in with Google, we receive only the following fields from your Google account: full name, email address, and profile picture URL. We do not access your Gmail, Contacts, Google Drive, Calendar, or any other Google service.
MatchBroker’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
2.3 Content you create on the platform
- Property listings: raw pasted text plus AI-extracted structured fields (title, location, building/project, unit identifier, bedrooms, floor and lot area, parking, price, transaction type, category, exclusive-ATS flag, semantic features).
- Buyer / lessee requirements: raw pasted text plus AI-extracted structured fields (target location, budget, category, preferred features, notes).
- Match & pipeline activity: which listings and requirements were matched, match scores, pipeline status changes (Suggested, Inquiry, Viewing, Offer, Closed, Archived), and any disputes you raise or receive on exclusive-ATS conflicts.
- Reports and moderation activity: if you flag a listing, we record who reported it, the reason, and any admin disposition.
2.4 Technical and usage data
- Device information such as browser type, IP address (used for rate-limiting and lockout protection only), and timestamps of key events (login, listing/requirement create, password reset).
- Notification records — in-app, email, and (when configured) SMS messages sent to you, including subject/body summaries kept for delivery diagnostics.
- A JSON Web Token (JWT) issued at login and stored in your browser’s local storage to keep you signed in.
3. How we use your information
- Verification & gatekeeping: to confirm you are a licensed PRC broker before granting network access.
- Matching engine: to compute semantic similarity scores between your listings and other brokers’ requirements (and vice versa), and to surface potential co-broker matches.
- Communications: password resets, verification approvals, new-match alerts, subscription and billing notifications, administrator broadcasts.
- Service operation & security: authentication, brute-force protection (temporary lockouts), audit logs of admin/support actions, and platform performance monitoring.
- Legal compliance: to comply with obligations under Philippine law, respond to lawful requests from regulators, and enforce our Terms of Service.
4. Legal bases for processing (RA 10173)
- Consent: you consent to our processing when you create an account and agree to this Privacy Policy.
- Contract necessity: to provide the platform services you subscribe to (verification, matching, pipeline management, billing).
- Legitimate interests: preventing fraud, enforcing exclusive-ATS integrity, ensuring platform security, and improving matching quality — balanced against your privacy interests.
- Legal obligation: retention of billing and audit records as required by tax, corporate, and consumer protection laws.
5. AI processing
Raw text you paste into the AI parse dialogs (listings and requirements) is transmitted to third-party large language model (LLM) providers for structured extraction and match-score computation. We send only the raw text and derived numeric embeddings — not your account credentials. LLM providers are contractually prohibited from training on our submissions. AI outputs are assistive and may contain errors; you remain responsible for reviewing extracted fields before saving.
6. Payments & billing
Subscription payments are processed by PayMongo (Republic Act-registered Philippine payments processor). We never receive or store your card number, GCash credentials, or Maya credentials. We store only PayMongo transaction references, subscription tier, expiry date, and status metadata needed to grant or revoke access.
7. When and how we share your information
- Other verified brokers on the network: your name and PRC-verified badge are visible in the co-broker directory. Once a match reaches the Inquiry stage in the shared pipeline, your listed contact channels (email and phone) become visible to the other broker so the deal can progress off-platform.
- Service providers (processors on our behalf): PayMongo (payments), Resend (transactional email delivery), LLM providers (text extraction and matching), cloud hosting and object storage providers.
- Regulators and law enforcement: when we are required by valid legal process or Philippine law.
- We do not sell your personal data to third parties for advertising or profiling. We do not share your PRC ID image with anyone outside our verification team and the affected data subject.
8. Retention
We retain your account and content data for as long as your account is active, and for a reasonable period thereafter to comply with legal, tax, and audit obligations (typically up to five years from your last transaction). When you delete your account, we remove or anonymize personal identifiers except where retention is required by law.
9. Security measures
- Passwords are stored as bcrypt hashes; the plaintext is never persisted.
- All traffic between your browser and our servers is encrypted with TLS.
- Role-based access control: administrator sub-roles (super_admin, verifier, support) grant only the permissions required for each function, with every privileged action written to an append-only audit log.
- Password reset tokens are single-use, SHA-256-hashed at rest, and expire in 30 minutes; rate limits and lockouts protect against brute-force attempts.
- Impersonation tokens issued by support agents are strictly scoped: they cannot access admin routes or make payments, and every use is audit-logged.
10. Your rights as a data subject
Under RA 10173, you have the right to be informed and to:
- Access the personal data we hold about you.
- Object to certain processing activities.
- Correct inaccurate data (available in your profile settings; contact us for restricted fields such as PRC data).
- Erase or block personal data that is no longer necessary or was collected unlawfully.
- Damages: seek indemnity for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data.
- Data portability: obtain an electronic copy of your data in a commonly used, machine-readable format.
- File a complaint with the National Privacy Commission (NPC) if you believe your rights have been violated.
To exercise these rights, email us at info@matchbroker.ph from the email address associated with your MatchBroker account. We will respond within a reasonable time as required by law.
11. Cookies and local storage
We use your browser’s local storage to hold a JWT session token that keeps you signed in, plus small preference flags (e.g. the parent-session cache when a support agent is impersonating a broker). We do not use tracking cookies for advertising.
12. Children
MatchBroker is a professional platform. It is not directed at, and does not knowingly collect data from, individuals under 18 years of age. Every user must be a licensed PRC real estate broker, which is a professional credential available only to adults.
13. International transfers
Some of our service providers (LLM providers, transactional email, cloud hosting) process data outside the Philippines. When personal data is transferred abroad, we use providers with contractual safeguards consistent with RA 10173’s cross-border transfer requirements.
14. Updates to this Policy
We may update this Privacy Policy from time to time. Material changes will be signalled via an in-app banner or email to your registered address. Continued use of MatchBroker after an update constitutes acceptance of the revised policy.