Privacy notice

MugTuon Learning Hub at Cafe (Nazareth, Cagayan de Oro) keeps a few personal details so that MugTuon Rewards and room bookings work. This notice says what we keep, why, for how long, and how to ask us about it. It follows the Data Privacy Act of 2012 (Republic Act 10173).

What we keep and why

Your rewards card: your name, mobile number and email address, plus a password or a counter PIN that is stored only as a scrambled hash (we cannot read it back). We also keep the card's history: the bill amount of each purchase that earned points, the points earned and spent, the dates, and which staff member served you. Your card's QR code carries only your member number.

Room bookings: your name, mobile number, email address, the date and time you booked, how many people, any add-ons, and anything you typed in the notes. If you opened the booking page from one of our links or ads, we keep the name of that link. We also keep a scrambled hash of your network address for a short time, to stop one person holding every slot; the address itself is not stored.

Payments: the room deposit is paid through PayMongo, a licensed Philippine payment provider. PayMongo handles your card or e-wallet details on its own pages; we never see or store them. We receive only the amount, the payment status and PayMongo's reference numbers. PayMongo's own privacy policy applies to what you give them.

Email: we send you a link to confirm your email address, sign-in and password-reset links when you ask for them, and booking confirmations. We do not send marketing email.

Sign-in safety: failed sign-in attempts are counted against a scrambled hash of your mobile number or network address for up to 24 hours, so a stranger cannot guess a PIN or password by trying many times.

Cookies

The site sets one cookie, which keeps you signed in and holds a booking while you pay. It is not used for advertising, and we do not run analytics cookies.

How long we keep it

• Your rewards card and its history: for as long as the card is active, or until you ask us to delete it.
• An online sign-up whose email address is never confirmed: the details are blanked after 7 days.
• Bookings: your name, number, email and notes are removed 12 months after the booking date. The date, time and amount stay, without your details, for our records.
• Messages from PayMongo about a payment: the detailed copies are blanked after 90 days; the amount and status stay with the booking.
• Emails we sent: deleted 14 days after sending. Sign-in and confirmation links: deleted within a month of expiring or being used.
• Backups: a deleted or blanked detail can remain in our backups until they are replaced over time.

Who sees it

Our staff see what they need to serve you at the counter and to run bookings. We share your details only with the services that make the site work: PayMongo (payments), our email provider (sending the emails above) and our web host (where the site and its database live). We never sell or rent your details, and we never post them.

Your rights

You can ask us at any time to:

• see what we keep about you;
• correct a detail;
• delete your rewards card (we remove your name, number and email; the anonymous history of points earned and spent stays for our accounts);
• remove your details from past bookings, except while a payment or refund is still being settled;
• stop using the card or booking online, with no effect on buying at the counter.

Ask at the counter, or use the contact below. We answer within 15 working days. If you are not satisfied, you may complain to the National Privacy Commission (privacy.gov.ph).

Changes to this notice

When this notice changes, the version at the bottom of the page changes with it. Each new rewards member is recorded with the version they agreed to at sign-up.