How we handle your information.

Who handles your information

Sourlo is the trading name of this website. The Business & contact page identifies the operator and the public support and privacy contacts. Use Privacy requests for authenticated requests about your account. If you cannot sign in, use the public privacy contact on that page.

What we collect and why

Account: email, authentication credentials handled by Supabase Auth, display name, and your optional photo and saved items. New sign-ups record a declaration that the user is at least 18 and has agreed to the versioned terms and read this notice. We do not ask for your birth date or gender.

Selling: business identity, contact and pickup details, registration certificates, review decisions, shop logo, and listing content. BIR, DTI, SEC or CDA documents are used for the owner’s seller review. Optional map coordinates help describe pickup locations.

Shopping and support: messages, order items, recipient name, delivery address, contact number, payment references and statuses, and support or privacy requests. Order issue cases also contain submitted photos, return instructions and tracking, and review decisions. The website does not collect card numbers. Seller payout account details are collected only when a seller chooses to set up withdrawals.

Service providers may keep operational and security logs, including IP addresses, device information and request times. Do not put passwords, payment-card details, unrelated identification, or sensitive personal information into messages or request text.

Purpose and choices

We use account and order information to deliver the service you request; business records to review sellers and administer transactions; and limited records to protect the service, handle disputes, and meet applicable obligations. Optional Google Maps and retailer-hosted photos are separate choices. We do not sell personal information or use advertising trackers.

Browsing is available without an account. Optional profile photos and reference addresses are voluntary. Required checkout fields are needed to fulfil the order. Declining optional Maps does not prevent typing or saving an address. There is no marketing mailing list in this website.

Chat translation and language choices

When automatic chat translation is enabled, message text is sent from our server to Microsoft Azure Translator to translate it into the reader’s chosen language. We do not send your account name, contact details or conversation identifiers with the translation request. A message can itself contain personal details, so avoid including unnecessary sensitive information.

Original messages are retained. Translations are saved with the message and are available only to the conversation’s participants through the authenticated translation service. Translation records are removed when the original message is deleted. Turn off automatic translation in chat to read originals. Translations may contain errors; confirm important order details with the other participant.

Website language and chat language preferences are saved in this browser using sourlo-language-v1 and sourlo-chat-language-v1 entries. Menu translations are bundled with the website and do not send those selections or text to Microsoft.

Who receives information

Supabase provides account, database, storage and real-time messaging services. Hosting infrastructure processes website requests. The seller for an order receives the delivery and contact details needed to fulfil it; conversation participants see their messages. Order issue records and private evidence photos are shared with the affected buyer, the relevant shop, and authorized Sourlo reviewers.

Registration documents are stored in private storage and sent as attachments through Resend to the configured site owner for review, after the applicant’s express authorization. Those emails create separate copies in the owner’s mailbox. Access to the website review area is restricted to authorized reviewers.

If online payment is enabled and you choose it, Xendit handles its hosted payment process and receives the required order information. Optional Google Maps receives browser/network information when enabled and an address or location when you use those features. Some Lazada product photos are served by its image CDN when you allow retailer-hosted photos; the CDN receives your IP address and browser details. Shopee or Lazada also receives your browser request when you follow its links. Those providers apply their own privacy terms. Providers may process data outside the Philippines; their locations and terms depend on the operator’s service configuration.

What other visitors can see

Published shop names, logos, public locations, product photos and descriptions are public. Shop approval is an owner review, not government certification. Private application documents, payout details and account email addresses are not published on listing pages. Avoid adding personal contact details or certificate images to public shop photos or descriptions.

Keeping and removing records

We retain account information while the account is in use and keep order, financial, fraud and dispute records for the purposes and obligations that still apply. The owner reviews deletion requests and must explain any records that need to be retained and why. A request does not instantly erase an account or its orders.

Seller document retention includes private storage, review-email attachments, operational copies and backups. Deleting a website record alone does not remove an emailed copy. The owner handles those copies during a request and manages provider backup expiry. Retention periods and any exceptions must be recorded in the response to the requester.

Your rights and requests

You may request access to or a copy of your information, correction, deletion, or restriction of or objection to its use, subject to applicable conditions. You can edit your profile and remove saved items directly. Cookie settings lets you withdraw optional Maps and retailer-photo consent.

Privacy requests records a reference and a status you can revisit. Submitting a request is not confirmation that it is complete. Only the requester and authorized site reviewers can view it. We may need proportionate verification before disclosing or deleting records. You can contact the National Privacy Commission if you have an unresolved privacy concern.

Children and changes to this notice

Accounts and seller applications are intended for adults aged 18 or over. This is a self-declaration, not identity or age verification. We do not offer child accounts or collect parental-consent documents. A parent, guardian, or affected person can report a child’s data through the privacy contact; do not send extra identity documents unless securely requested for a specific reason.

The version at the top identifies this notice. Material changes to how data is used require the operator to update the notice and obtain any new permission that is needed.