Privacy Policy

Alleba Advertising and Events, 58 Luisa Street, Juna Subdivision, Matina, Davao City, Philippines, is the personal information controller for data collected through www.alleba.com. Our Data Protection Officer can be reached at hello@alleba.com.

When you buy a ticket or book an event, the seller running that event is also a personal information controller for the attendee data they collect. Alleba stores and processes that data as their service provider, but the seller decides what to ask for and must only use it to run the event.

• Account details: name, username, email address, password (stored hashed), and — if you sign in with Google — the basic profile Google shares with us.
• Shop details: shop name, tagline, category, logo, links, fulfilment locations and the payment QR image you upload.
• Listings: product titles, descriptions, photos, prices, variants and stock.
• Orders: items ordered, amounts, delivery or pickup details, buyer contact details, payment references and order status.
• Messages: chat between buyers and sellers, and support tickets or dispute reports including any files you attach.
• Identity documents: for sellers who apply for verification, a government-issued ID image and a selfie.
• Billing: your plan, payment status and references from our payment provider. We never see or store your full card number.
• Beta applications: name, email, business name and what you intend to sell.
• Technical data: IP address, browser and device information, pages visited and referrers.

When you book an event, the seller needs the attendee's full name and email so they can issue a ticket and check the attendee in at the door. We also collect:

• Full name and email address for each attendee, entered by the buyer.
• An optional note or special request (up to 500 characters) such as dietary needs, accessibility requirements or seating requests.
• The ticket code, check-in time, and the name of the staff member who scanned the ticket.
• For the seller: the full attendee list for that event, which can be searched and exported as a spreadsheet.

We do not collect, store or process a photo or copy of anyone's ID. Door staff may inspect a physical valid ID or school ID at the venue, but that check happens outside Alleba.

Sellers may only use attendee data to run the event they collected it for. They may not add attendees to marketing lists, share the list with unrelated third parties, or keep it longer than needed for that event without clear consent.

• To create and run your account, shops and listings.
• To let buyers and sellers complete and track orders and talk to each other.
• To verify seller identity and display trust badges.
• To handle support tickets, reports and disputes.
• To take payment for paid plans and issue receipts.
• To send service email such as verification codes, welcome mail, order updates and shipping notices.
• To detect fraud and abuse and keep the platform safe.
• To understand traffic and improve the site.

We rely on your consent, on performing our contract with you, on our legitimate interest in running a safe platform, and on legal obligations, as applicable.

• Public: your shop page, listings, public shop details, trust badges and the reviews you leave.
• The other party in a transaction: when you place an order, the seller sees the contact and delivery details needed to fulfil it. You see the seller's shop and payment details.
• Event staff: when you attend an event, the seller and their authorised door staff can see the attendee name and check you in. Cashiers may see customer details needed for counter sales.
• Alleba admins: account, order, support and verification data, as needed to run the platform.
• Nobody else by default. Identity documents and dispute attachments are kept in private storage and are not publicly reachable.

We do not sell your personal data, and we do not share it for third-party advertising.

• Hosting, database, authentication and file storage for the site and its data.
• A payment provider for Alleba plan payments. Buyer-to-seller payments happen outside Alleba, directly between you and the seller.
• An email delivery provider for verification, notification and support email.
• Google Analytics for aggregate traffic measurement.
• Google Maps for turning a seller's pickup or meetup address into a map link.
• Google Sign-In, if you choose to sign in with a Google account.

These providers may process data outside the Philippines. We only pass them the data they need to deliver their service.

• Account and shop data: while your account is open, then removed or anonymised within 30 days after closure, except where we must keep records by law or for disputes.
• Order and receipt records: kept for at least 5 years for bookkeeping, tax and dispute purposes.
• Identity documents: kept while your shop is verified and for up to 2 years afterwards for fraud-prevention and audit purposes, then deleted.
• Event attendee lists and check-in records: kept for 12 months after the event date so sellers can handle post-event questions and disputes, then deleted or anonymised.
• Support tickets and disputes: kept for 3 years after the ticket is closed so we have a history if an issue resurfaces.
• Analytics data: retained by the analytics provider under its own retention settings.

Access to your data is controlled at the database level so that you can only read your own records and the records of transactions you are part of. Private files such as identity documents and dispute attachments are served only through short-lived links to authorised users. Staff roles such as door staff and cashier are limited to the data they need for their task.

No system is perfectly secure, so please use a strong, unique password and tell us straight away if something looks wrong with your account.

We use cookies and similar storage to keep you signed in and to remember your cart and preferences. Google Analytics sets its own cookies to measure traffic in aggregate. You can block cookies in your browser or install Google's opt-out add-on, though signing in will not work without the session cookies.

Under Republic Act No. 10173 you have the right to be informed, to access your data, to correct inaccurate or outdated data, to object to certain processing, to have your data erased or blocked where the law allows, to data portability, to be notified of a personal data breach, to claim damages, and to lodge a complaint.

To exercise any of these rights, email hello@alleba.com from the email address on your account and describe your request. We may ask for proof of identity before releasing or changing sensitive data. We will respond within 15 working days, or tell you if we need more time.

If you are unhappy with how we handled your request, you can complain to the National Privacy Commission at privacy.gov.ph or through its complaint channels.

If we discover a personal data breach that is likely to result in serious harm, we will notify affected users and the National Privacy Commission within 72 hours of discovery where feasible, and tell you what steps we are taking.

Alleba is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has registered, email us and we will remove the account.

We will post updates here with a new “last updated” date, and notify account holders when a change is significant.