YOUR INFORMATION

Privacy Notice

Updated 25 October 2026. This notice explains how Ganchalyo handles information for our shop, Bulk / Team made-to-order requests, support and optional promotional email.

What we collect and why

For orders and delivery, we collect your chosen products, name, phone number, shipping address, delivery notes and a required checkout email for order confirmation and shipment updates. For Bulk / Team requests, we also collect your email, mobile number, optional team/company and desired date, agreed quotes and revisions, and shipping details before payment.

We keep payment references, amounts, payment status and verification history. Manual GCash/bank payments also use the proof image and transfer details you submit. Please avoid including unrelated personal information in screenshots or delivery notes.

We use this information to review requests, fulfill and track orders, verify payments, handle corrections and support, keep transaction records, and prevent fraud or misuse. Support messages contain the information you choose to send. Optional feedback includes your rating, comment, nickname and photos; publication requires your separate permission and our review.

For security and service operation, we process technical request information such as IP addresses and rate-limit records. Your browser stores cart choices and temporary checkout information so you can complete your order. Keep private order and request links private: they give access to your details.

Providers that help us operate

Cloudflare hosts the storefront and application and stores our order, request, payment-proof and subscription records. PayMongo provides ready-stock QR Ph checkout and payment verification; we send the order/payment reference, item and amount details, and billing name, phone and email when supplied. Payment information entered on its hosted checkout is handled by PayMongo and the chosen payment service.

Bulk / Team MTO payments use manual GCash or bank transfer. The chosen payment service handles the transfer; Ganchalyo reviews the proof and actual receipt. We provide delivery details needed by J&T to ship your parcel; shipping is arranged by the owner, without a direct J&T API integration.

Resend delivers order, shipment, request and payment-verification updates, as well as separate subscription confirmation and welcome/promotional email, using your email address and message content. We retain order-update email records to track delivery attempts and avoid duplicate messages. Our contact email is handled through Gmail. We share information with these services as needed for their role. Their own privacy and security practices also apply; this notice does not promise where every provider processes data.

Promotional email is your choice

Marketing consent is optional and separate from necessary order, payment and support communication. Buying or requesting a quote does not subscribe you. If you sign up, we keep your email, consent and confirmation records, preferences and welcome-offer history. You can unsubscribe from promotional emails through the unsubscribe link. This does not stop necessary order or service messages. We do not send abandoned-cart marketing in V1.

How long we keep information

Verified payment-proof images become eligible for disposal 90 days after owner-confirmed payment. Rejected or replaced proof images become eligible 30 days after rejection or replacement. These are eligibility periods, not promises of deletion on that date. In V1, cleanup is owner-triggered; there is no automatic scheduled deletion.

Dispute, refund/correction, suspected fraud, tax/accounting, or legal holds override disposal. Once applicable holds are released, an eligible image may be removed during a later cleanup. Disposal removes the image from the active application; structured submission and review records remain. Provider backups or recovery history may temporarily retain earlier database state.

Structured order, payment, transaction and accounting records are generally retained for at least 5 years, as applicable. The relevant tax or legal rule determines when that period starts; it is not simply five years from the order date. We may retain records longer while an issue remains unresolved or retention is required. Other request, support and subscription information is kept as needed for its purpose, your preferences and required records; V1 has no automatic structured-record deletion schedule.

Questions, corrections and privacy requests

Email [email protected] to ask about your information, request access or correction, withdraw marketing consent, request review removal, or ask for deletion. Requests are handled manually after reasonable verification that the requester is entitled to the information. Please start with the relevant order/request reference and avoid sending unnecessary identity documents.

We may need to keep information despite a deletion request for required retention, an unresolved payment, dispute, refund, fraud investigation or legal obligation. We will explain relevant limitations when responding.

Keeping information secure

We use private access links, restricted owner access and service-provider safeguards to limit access and misuse. No website or storage service can guarantee absolute security. Contact us at the email above if you believe your order link or information has been exposed.