Privacy notice · Last updated 10 October 2026

Your data, kept simple.

PopCart is a delivery app for fresh goods, grilled food and groceries in the Philippines, with a rider app for the people who deliver and a Partner Hub for the shops that sell. This notice says what we collect, why, who sees it, how long we keep it, and how you get it deleted. We follow the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

Who we are

PopCart is a Philippine business based in the Philippines. It is being incorporated as PopCart Technology Inc. (SEC registration in progress); until then it is run by its founder. PopCart is the personal information controller for the data described here.

Data protection officer: PopCart’s data protection officer, support.popcart@gmail.com.

What we collect

Your account

• Your email address, and your name, mobile number and profile photo if you add them.
• If you sign in with Google: see Google sign-in below.
• Sign-in codes we email you are stored only as a scrambled hash, for 10 minutes.
• Your notification choices (order updates on, promotions off unless you turn them on).

Addresses and location

• The delivery addresses you save, the map pin for each, and any delivery notes (gate colour, landmarks).
• Your phone’s location, only when you allow it and only to drop your delivery pin or check that we deliver to you. We don’t track customers in the background.

Orders and payments

• What you ordered, from which shop, prices, fees, the delivery address used, timestamps and order status.
• Payment method and payment status. Card, GCash and Maya payments are handled by PayMongo; we never receive or store your card number or e-wallet PIN.
• Notes, ratings and tips you leave on an order, if you leave any.

Riders

• If you deliver for PopCart: your name, mobile number, profile photo, vehicle type and plate number, the jobs you take, and your live location while you are online or carrying an order. We use it to assign jobs, show customers their rider on the way, estimate arrival times and settle pay.
• The proof-of-delivery photo you take at drop-off, and cash you collect and remit.

Shops (Partner Hub)

• For each partner shop: its name, pickup address and pin, phone and email, and the business record we check before it goes live (registered business name, DTI/SEC number, TIN). The people who run it: their name and email.
• Product photos and details shops add, and the weighed photos for items sold by weight.

Device and technical data

• A push notification token, so we can tell you when your order moves.
• Basic server logs (IP address, time, the page or action requested) for security and to fix problems. We don’t use advertising trackers or sell analytics data.

Google sign-in and Google user data

You can sign in to PopCart (the customer app, the rider app and the Partner Hub at hub.popcartph.com) with your Google account. When you do:

• What we receive: only your Google account ID, email address, name and profile picture (Google’s openid, email and profile permissions). We don’t ask for, and can’t see, your Google password, contacts, Gmail, Drive, calendar or any other Google data.
• How we use it: only to create and sign you in to your PopCart account, show your name and photo in the app, and send you sign-in and order emails. Nothing else.
• Who we share it with: no one, except as needed to run your orders as described in “Who we share it with” below (for example, a rider sees the name on your order). We never sell Google user data, never use it for advertising, and never use it to train AI or machine-learning models.
• How we keep it safe: it travels only over encrypted connections, is stored on PopCart’s own servers, and only staff who need it to help you can see it.
• How long and how to delete it: until you delete your PopCart account (see Delete your account); deleting your account removes your Google link right away. You can also remove PopCart’s access any time in your Google Account under Security → Third-party connections.

PopCart’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Why we use it

• To deliver your order: pass it to the shop, find a rider, route the rider to your door and keep you posted. This is the contract you ask us to perform.
• To take payment and keep books: process payments and refunds, and keep the records Philippine tax and accounting rules require. This is a legal obligation.
• To keep PopCart safe: check partner shops before they go live, stop fraud, abuse and fake accounts, and secure our systems. This is our legitimate interest.
• To help when something goes wrong: answer your messages and sort out late, missing or wrong orders.
• Marketing: only if you turn promotions on, and you can turn them off any time in the app.

Who we share it with

Only what each one needs, only to run PopCart. We don’t sell your data.

• Shops you order from: your order, the name on it and the notes you add.
• Riders carrying your order: your name, mobile number, delivery address, pin and notes, for that delivery.
• Customers (if you are a rider): your first name, photo and vehicle, and your live location during their delivery.
• PayMongo (payments, Philippines): the amount, the order reference, your name and email, plus what you enter on their payment page.
• Google (Google sign-in, if you use it): Google confirms who you are to us.
• Resend (email delivery, United States): your email address and the message, to send sign-in codes and account emails.
• Expo, Google and Apple (push notifications, United States): a device token and the notification text.
• Cloudflare (network and security, global): carries the encrypted connection between your phone or browser and our servers, and blocks attacks.
• Maps: our maps and routes run on our own servers, using OpenStreetMap data. Your address is not sent to an outside map company. Your phone’s own location service (Google on Android, Apple on iPhone) works out your position when you allow it.
• Hosting: PopCart’s own servers in the Philippines hold the database, photos and backups.
• Authorities: when the law or a valid order requires it.

Some of these companies process data outside the Philippines. We use them only under terms that protect your data the way the Data Privacy Act requires.

How long we keep it

• Your account, addresses and Google link: until you delete your account.
• Order and payment records: for as long as Philippine tax and accounting rules require (up to 10 years). After you delete your account they are no longer linked to your name, email or phone.
• Rider trip location history: 90 days, then deleted automatically; the totals needed for pay stay with the order records.
• Proof-of-delivery and weighed photos: with the order record they belong to.
• Push notification tokens: until you sign out, or 60 days after the app last used them.
• Sign-in codes: 10 minutes. Server logs: in rotating files that overwrite the oldest entries as they fill (at most 50 MB per service). Backups: 14 days.

Delete your account

In the app: Me → Account → Delete account. On the web: popcartph.com/delete-account. We email you a 6-digit code to confirm, then delete your name, email, phone number, photo, Google sign-in link, saved addresses and notification tokens right away, and sign you out everywhere. Order records stay only as described above, without your name, email or phone. Backups holding your data roll off within 14 days.

Your rights

Under the Data Privacy Act you can ask to be informed, to see your data, to correct it, to object, to have it erased or blocked, to get a copy you can take elsewhere, and to be compensated for damage caused by inaccurate or unlawfully used data. Email support.popcart@gmail.com and we’ll reply within 15 working days. If you’re not happy with our answer you can complain to the National Privacy Commission (privacy.gov.ph).

Keeping it safe

Connections are encrypted, sign-in codes and sessions are stored hashed, staff sign in to the Ops tools with short sessions behind an extra access check, and every staff change to people and shops is logged. If a breach puts you at real risk, we will tell you and the NPC as the law requires.

Kids

PopCart is for people 18 and over. We don’t knowingly collect data from children.

Changes

If we change this notice in a way that matters, we’ll tell you in the app or by email before it applies. The date at the top always shows the latest version.

Contact

PopCart (PopCart Technology Inc., incorporation in progress), the Philippines. Email support.popcart@gmail.com.