PropertyCone Hub is a property sales workspace for brokerages, brokers, and developers. This policy explains what personal data we hold, why, and what you can ask us to do with it.
We are based in the Philippines and handle personal data in line with the Data Privacy Act of 2012 (Republic Act 10173).
1. Two kinds of personal data
This distinction matters, because your rights differ depending on which applies.
Data about you, our customer
When you create an account we collect your name, email address, and password (stored only as a cryptographic hash — we never see it). If you subscribe we also hold your plan, subscription status, renewal date, and the brand and last four digits of your card.
Data you put into your workspace
You control this data; we only store and process it on your instructions. In data protection terms you are the controller and we are the processor. Specifically, a workspace may contain:
- Buyer leads: name, mobile number, email address, Facebook or Messenger link, occupation, budget, preferred locations and property types, pipeline stage, notes, and the record of calls, viewings and other activity logged against them.
- Enquiry and consent records: where an enquiry came from, when a privacy notice was shown, which wording version was used, and whether the person separately agreed to future marketing.
- Property listings: address and location, price, specification, availability, listing notes, and one cover photograph per listing.
- Property owner contacts: the name, mobile number, alternative contact number and email address of the landlord or seller.
- Your team: each member’s name, email address, mobile number, employee identifier, job title, department, branch, date joined, role, permissions, and profile photograph if provided, together with pending invitations.
- Work records: tasks, appointments, reminders, notifications, and an audit log of significant actions such as exports, invitations and listing approvals.
- Workspace branding: the business logo you upload. Company profile documents uploaded before that feature was removed may remain in existing workspace records.
This includes personal data about people who are not our users — buyers you record, and property owners whose phone numbers and email addresses you save. You are responsible for having a lawful basis to hold their information and for telling them how it is used.
2. What we never receive
Card numbers. Payments are handled by Lemon Squeezy, who act as Merchant of Record. Card details are entered on their systems and never pass through ours. We receive only the subscription status and the last four digits.
3. We do not send marketing email
Every email we send is about something you or your workspace did: confirming an address, resetting a password, an invitation to join a workspace, a reminder that a trial or subscription is ending, or a notice before data is deleted.
We do not send newsletters or promotional campaigns, we do not sell or rent your details to anyone, and we do not share them with advertisers. We run no advertising or analytics trackers on this service. Your leads’ contact details are never used to contact them — only you contact your buyers.
4. Why we hold each thing
| Data | Purpose |
|---|---|
| Name, email, password hash | Create and secure your account |
| Workspace contents | Provide the service you are paying for |
| Subscription status | Determine what your plan gives you access to |
| Activity and audit records | Show your team who changed what, and when |
| Email address for notifications | Send account, security, and workflow emails |
We do not sell personal data, and we do not use your workspace contents to train machine learning models.
5. Who else processes it
We use a small number of providers, each for a defined purpose:
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | Northeast Asia |
| Vercel | Application hosting | Global edge network |
| Resend | Transactional email delivery | Asia Pacific |
| Lemon Squeezy | Payments, invoicing, and tax | United States |
Because these providers operate outside the Philippines, your data is transferred internationally. We choose providers that offer contractual data protection commitments.
6. How long we keep it
- While your subscription is active: for as long as you use the service.
- If payment fails: full access continues for a 7 day grace period, then the workspace becomes read-only. Nothing is deleted.
- For 90 days after a subscription ends: the workspace becomes read-only and your data is kept so you can export it or resume where you left off. Exporting stays available throughout this period for workspaces that have held a paid subscription.
- After 90 days: the workspace becomes eligible for permanent deletion, and we may delete it and everything in it — leads, listings, notes and activity — without further notice. Deletion cannot be undone. We do not guarantee that data is destroyed on the ninetieth day exactly; treat that date as the point after which you should not rely on your records still being available.
- Free trials that end without a subscription: the same 90 day period applies. Exporting is a paid feature and is not available on a workspace that has only ever been on trial.
- If you ask us to delete your account: we remove it within 30 days, except records we must keep for tax or legal reasons. You do not have to wait for the 90 day period to expire.
We email you 30 days and 7 days before a workspace becomes eligible for deletion, so you have time to export your records or resume your subscription. Your records may include information you are required to keep for your own tax or regulatory purposes; once deleted we cannot recover it.
Deletion removes your data from the live service immediately. Copies held in routine encrypted backups are overwritten as those backups age out of our providers’ retention windows.
7. How it is protected
- Every connection is encrypted in transit (HTTPS/TLS).
- Passwords are hashed, never stored in readable form.
- Workspaces are isolated at the database level. Access rules are enforced by the database itself, not only by the interface, so one workspace cannot read another’s data.
- Sensitive fields such as property owner contact details are restricted further, to the workspace owner, administrators, and the agent assigned to that listing.
- Changes to records are written to an audit log.
No system is perfectly secure. If a breach affects your personal data we will notify you and the National Privacy Commission as required by law.
8. Your rights
Under the Data Privacy Act you may ask us to:
- Tell you what personal data we hold about you
- Correct anything inaccurate
- Delete your data, subject to our legal obligations
- Provide a copy in a portable format
- Object to a particular use
If the data concerns you as a buyer or property owner recorded in someone else’s workspace, please contact that brokerage directly — they control it. If you cannot reach them, contact us and we will help.
9. Cookies
We use cookies only to keep you signed in and to keep your session secure. We do not use advertising or cross-site tracking cookies.
10. Children
PropertyCone Hub is a business tool and is not intended for anyone under 18.
11. Changes
If we make a material change we will email account owners before it takes effect. The date at the top always reflects the current version.
12. Contact
Questions, requests, or complaints: notif.pch@salescone.online.
You also have the right to complain to the National Privacy Commission of the Philippines at privacy.gov.ph.