Sukie privacy notice
Last updated: 16 September 2026
Sukie is a loyalty app for neighbourhood shops in the Philippines. Customers use app.sukie.ph; shops use merchant.sukie.ph. Sukie is run by Crewinabox Software Development Services, a DTI-registered sole proprietorship (DTI No. 8408202) owned by Rizi Kweyd Cruz Gonzales.
Privacy questions and requests go to contact@sukie.ph. Our Data Protection Officer is Rizi Kweyd Cruz Gonzales, reachable at the same address.
Sukie controls the accounts on the platform. Each shop controls its own loyalty records (who earned what at that shop), and we process those records on the shop's behalf.
If you're a customer
What we collect and why
| What | Why | Basis |
|---|---|---|
| Your mobile number (stored hashed for lookups) and the one-time code we text you | To find and secure your account and sign you in | Needed to provide the service |
| Your first and last name | So staff can recognise you at the counter | Needed to provide the service |
| Your stamps, points, rewards and visit times at each shop | To keep your balances and apply each shop's expiry rule | Needed to provide the service |
| The rotating QR code on your phone | To check it's really your card at the counter | Needed to provide the service |
| Email (optional), confirmed by a link | For account help and, if you tick the box, updates about your rewards | Your choice — remove it anytime |
| Location (optional) | To show shops near you | Your choice — turn it off anytime in your phone's settings |
Location, in detail: if you allow it, your phone keeps your last position only for the current session and sends it to us only to run the "near you" search. We don't save it on our servers, we never ask twice, and it's cleared when you sign out.
What shop staff can see
Staff at a shop see your name, the last four digits of your number, and your stamps or points and visits at that shop. They never see your full number, email, location or your records at other shops.
Messages from us
- Text messages: only sign-in and account-deletion codes.
- Email: only if you've added one, and only for account help and the reward updates you opted into.
- No marketing, no ads, no selling or sharing your details for anyone's marketing. Shops can't message you through Sukie.
If you run or work at a shop
- The shop account: its email address and password, the shop's details, rewards, logo and cover photo. The logo, cover and shop details are public on the shop page. Basis: needed to provide the service.
- Each person on the account: name, six-digit PIN (stored hashed) and a log of what they did at the counter. This keeps the shop's records honest and lets the owner see who did what. Basis: our and the shop's legitimate interest in accountability and security. Owners should tell their staff about this.
- Pilot paperwork and feedback: business name, the representative's name, role, signature and date; weekly feedback; the Day 15 and Day 45 discussions. Basis: the pilot agreement itself, and our legitimate interest in running the pilot well.
- Publicity: the pilot includes at least one public social media post about the shop. We agree the content with you first and never publish customer records. Photos or quotes of identifiable people need those people's separate permission.
For everyone
Security and monitoring
- Cloudflare Turnstile checks that sign-ups and sign-ins come from people, using signals such as your IP address and browser details.
- We use error-tracking (Sentry) and usage-measurement (PostHog) tools to keep the app working. Personal details are removed before anything is sent to them.
- Basis: our legitimate interest in keeping Sukie secure and working. You can object by emailing us.
- We use cookies and browser storage only to keep you signed in and remember your settings. Clearing them signs you out; it doesn't delete your account.
If you report a problem
The message you type, any screenshot you attach, the page you were on and your account ID are emailed to contact@sukie.ph so we can look into it. We keep reports only as long as needed to fix the problem, normally no longer than 90 days after it's resolved.
Our providers
Sukie runs on a small number of service providers: Supabase (accounts and loyalty records, Singapore), Vercel (hosting, served from Singapore with some processing in the United States), Cloudflare (photos, map tiles and security checks), Semaphore (text messages, Philippines), Resend (email, United States), Sentry (error tracking) and PostHog (usage measurement, United States). Philippine privacy law still protects your data when a provider is abroad, and we remain accountable for how they handle it.
How long we keep things
- Your account, name and balances: while your account is open. If you haven't signed in for 24 months, we may anonymise the account.
- One-time codes and QR codes: they expire within minutes and aren't kept.
- An email address you didn't confirm: removed.
- Problem reports and pilot feedback: deleted or anonymised once dealt with, normally within 90 days.
- Provider logs and backups: cleared on the providers' own schedules, generally within 30 days.
- Transactions after you delete your account: kept in anonymised form as the shop's business record. If any record could still identify you, it's still protected as personal data.
- Signed agreements and dispute records: kept while we need them to meet obligations or handle claims.
Deleting your account
Customers: Me → Privacy → Delete my account, confirmed by a text code. It removes your number, name and email immediately and freezes your cards. Shops: email contact@sukie.ph from the shop's registered address; we process closures within 30 days. Details: Delete your account.
Your rights
Email contact@sukie.ph to:
- see the data we hold about you, what we use it for and who receives it;
- correct it, including asking for a logged correction of a stamp or point;
- delete or block it where the law allows (customers can also delete in the app);
- object to processing based on our legitimate interests;
- get a copy of your data in a reusable format such as CSV;
- withdraw a consent you gave, such as email or location.
We may ask you to prove it's you. Requests are free and answered within 30 working days; complex ones may take 15 more, and we'll tell you why. If you're unhappy with our answer, you can complain to the National Privacy Commission; they usually ask that you contact us first.
Children
Sukie is for adults, 18 and older, and we don't check ages. If we learn an account belongs to someone under 18, we'll stop its use and remove the identifying details, keeping only anonymised transactions. Parents and guardians can contact us.
If something goes wrong
If a data breach is likely to cause you real harm, we'll notify the National Privacy Commission and you within 72 hours of learning about it, as the law requires.
Changes
We post updates here and flag significant changes in advance. Using your details for a new optional purpose always needs your fresh consent.