Privacy Policy

Effective October 9, 2026

The HMUA Society (“we”, “us”) runs a directory that helps clients in the Philippines find and message hair and makeup artists. This policy explains what personal data we collect, why, who we share it with, and the choices you have. We process personal data in line with the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.

1. Data we collect

Account data (clients and HMUAs)

• Name, email address and password (stored securely as a one-way hash by our authentication provider).
• If you sign in with Google or Facebook: your name, email address and profile photo from that account. We do not receive your Google or Facebook password, and we do not post anything to your accounts.
• Your role (client or HMUA) and account settings.

HMUA profile data

• Display name, studio or brand name, profile and cover photos, bio, years of experience, expertise, services and rates, languages, availability, Instagram and Facebook handles (shown publicly only for Featured artists; otherwise kept private and used to verify the artist) and portfolio photos and video links.
• Certifications and trainings you list (name, school, year, an optional note and link). These are shown publicly as listed by you; we don't collect certificate images or ID documents.
• Your base location and service areas. We store an approximate map point to calculate distance for search results, but we only ever show the public your city, municipality or province, never an exact address.
• Some artist profiles are created by our team from publicly available information or information the artist shared with us. These are labelled “Unclaimed profile” until the artist claims them, and the artist can ask us to correct or remove them at any time.

Messages, bookings and reviews

• Messages and photos you send through our chat, and reviews and replies you post.
• Bookings you and the other person confirm in chat (date, service, number of people and an optional note). We use them to let clients review only artists they actually booked and to show an artist's count of verified bookings. No payment goes through the site.
• To keep transactions on the platform safe, our system automatically hides phone numbers, email addresses and social media handles in messages.

Community and job board

• Community posts, replies and photos you share, and the posts you mark as helpful.
• If you post jobs: your business name, type, city and short description, and the job posts you write. If you apply for jobs (HMUAs): your application message and quoted rate, shared only with that job's poster.
• As in chat, phone numbers, email addresses and social media handles are hidden automatically in these posts.

Payments

• Payments are processed by PayMongo. We receive the payment status, amount, method (e.g. GCash, card) and a reference number. We never see or store your full card number, CVV, or e-wallet PIN.

Technical data

• IP address and basic device/browser information, used for security (for example, to limit repeated sign-up attempts) and to keep the service running. We use only essential cookies, which keep you signed in.

2. How we use your data

• To create and run your account, and to show HMUA profiles to people searching for HMUAs.
• To let clients and HMUAs message each other, and to send you email notifications about new messages.
• To review HMUA profiles before they go public.
• To calculate search results by distance and show response-time and rating indicators.
• To process subscriptions, featured listings and payments.
• To prevent fraud, spam and abuse, and to handle reports.
• To comply with legal obligations.

Our legal bases are your consent, performing our agreement with you (providing the service you signed up for), our legitimate interest in keeping the platform safe, and compliance with law.

3. Who we share data with

We do not sell your personal data. We share it only with service providers who help us run the platform:

• Supabase: database, authentication and file storage.
• Netlify: website hosting.
• Resend: sending emails.
• PayMongo: payment processing.
• OpenStreetMap / Nominatim: turning a typed city or area into map coordinates. Only the location text is sent, never your name or contact details.
• Google and Facebook (Meta): only if you choose to sign in with them.

Some of these providers store data outside the Philippines. We use providers that protect data with industry standard security. We may also disclose data when required by law or to protect the rights and safety of our users.

4. What is public

Approved artist profiles are public: display name, studio name, photos, bio, expertise, services and prices, city/area, listed certifications, ratings and reviews. Client reviews show the reviewer's first name and last initial. Client accounts are not public. Phone numbers and admin notes are never shown publicly.

Community posts and replies are public, shown with your first name and last initial (HMUAs with their profile name). Approved job posts are public with the poster's business details, never their account name or email.

5. How long we keep data

We keep your data while your account is active. When you delete your account, we delete your profile, photos, favorites, reviews, community posts and job posts right away. Messages you sent stay visible to the person you sent them to, and community replies stay in their discussion, both with your name removed. Payment records are kept for as long as tax and accounting laws require, with your account link removed. Backups are overwritten within 30 days.

6. Your rights

Under the Data Privacy Act you have the right to be informed, to access, to correct, to object, to erasure or blocking, to data portability, and to file a complaint with the National Privacy Commission. You can update most of your data yourself in Settings, or delete your account there. For anything else, email us at admin@thehmuasociety.com.

7. Security

We protect data with encryption in transit (HTTPS), access controls that limit each user to their own data, private storage for chat photos, and limited admin access. No system is perfectly secure; if a breach affects you, we will notify you and the National Privacy Commission as the law requires.

8. Children

The service is for people 18 and older. Clients booking for a minor (for example, a debut) should create the account themselves as the parent or guardian.

9. Changes

If we make important changes to this policy we will notify you by email or on the site. The effective date at the top shows when it was last updated.

10. Contact

The HMUA Society Data Protection Officer
Email: admin@thehmuasociety.com

To delete your data, see our Data Deletion Instructions.