Skip to content

Privacy Policy

Last updated: October 3, 2026

This policy explains what personal information Migala collects, why, who we share it with, how long we keep it and what you can do about it. It follows the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.

Migala is run by Migala Inc, Origin Building, 9544 C. Raymundo Ave, Pasig, 1606 Metro Manila (“Migala”, “we”, “us”). We are the personal information controller for the data described here. Our Data Protection Officer can be reached at dpo@migala.com.ph.

1. What we collect

When you create an account

  • Your name, email address and password (stored scrambled, so we can’t read it).
  • Whether you’ve confirmed your email, and whether you host, supply or both.

When you sign in with Google or Facebook

  • From Google: your name, email address, whether Google has confirmed that email, and an account id Google gives Migala.
  • From Facebook: your name, your email address if you choose to share it, and an account id Facebook gives Migala.
  • We use these only to sign you in and to fill in your account. We don’t receive your password for either service, your contacts or friends, or your profile photo, and we never post anything for you.

When you fill in your profile

  • An optional photo, a short “About you” and the city you’re based in. If you have a live listing, your profile is public.

When you supply

  • Your listing: business name, services, the areas you serve, description, photos, packages, prices, business hours and any business contact details you add. Listings are public once approved. We don’t show a phone number, email address or street address on public pages.
  • Your proposals: services, prices, inclusions, messages and attachments you send to hosts.
  • Your credits and orders: packs bought, amounts, dates and payment status. Your card or e-wallet details go straight to PayMongo; we never see or store them.

When you host

  • Your events: type, date and times, city, venue, guests, budget, services needed and description. An approved event is visible to suppliers, and a short version of it to anyone with the link.
  • Your choices about proposals, your collections of saved suppliers, and reviews you write.

When you message someone

  • Your messages and attachments, and when they were sent and read. Attachments are stored privately and only the people in the conversation can open them.

When you claim a listing Migala added

  • The business email or other detail you use to prove the listing is yours, and the result of the claim.

Automatically, when you use Migala

  • Technical information such as your IP address, browser and device type, and the pages you visit, kept in server logs for security and to fix problems.
  • Counts of how often listings and events are viewed, shown to their owners as stats.
  • Cookies (see section 6).

Information about businesses that haven’t joined

To help hosts find suppliers, staff may list a business using information it has made public (such as its name, services, area and public photos), marked “Listed by Migala”. If that’s your business, you can claim the listing or ask us to remove it at help@migala.com.ph.

2. Why we use it

  • To provide Migala (performing our agreement with you): your account, listings, events, proposals, messages, credits, reviews and notifications.
  • To keep Migala safe (our legitimate interest and legal obligations): reviewing events and listings before they go live, blocking contact details before a supplier is chosen, limiting message rates, preventing fraud and abuse, and securing accounts.
  • To process payments and keep records (legal obligation): orders, receipts and accounting records.
  • To email you: account emails (confirming your email, password changes) are always sent. Activity emails (new proposals, messages, decisions, credits, reviews) can be switched off by group in Account settings.
  • To improve Migala (legitimate interest): understanding how features are used, in aggregate.
  • With your consent, for anything else we ask about at the time. You can withdraw consent at any time.

We don’t sell your personal information, and we don’t use it for third-party advertising.

3. Who can see what

  • Everyone: live listings, public profiles of suppliers with a live listing, reviews, and the short version of approved events.
  • Logged-in suppliers: the full details of approved events, without the host’s contact details.
  • The people in a conversation: its messages and attachments.
  • A host: proposals sent to their events. A supplier: the events they propose to and their own proposals.
  • Migala staff: what they need to review, support and moderate, under confidentiality.

4. Who we share it with

We use a small number of service providers who process data for us, under contracts that require them to protect it:

  • Hostinger: website hosting and backups. Servers are in Asia (Indonesia).
  • PayMongo: payment processing (Philippines). PayMongo handles your payment details under its own privacy policy.
  • Brevo: sending emails (European Union).
  • Mapbox: the maps on Explore and listings. Your browser loads map tiles from Mapbox, which sees your IP address.

If you choose to sign in with Google (Google LLC) or Facebook (Meta Platforms, Inc.), you sign in on their page, and they tell Migala who you are as described in section 1. They know you used their sign-in for Migala, under their own privacy policies. Migala sends them nothing else about you.

We may also share information when the law requires it (for example a court order or a request from the National Privacy Commission), to protect someone’s safety, or as part of a sale or merger of Migala, in which case this policy continues to apply.

Some of these providers store data outside the Philippines. Where they do, we make sure the data is protected to the standard the Data Privacy Act requires.

5. How long we keep it

  • Account and profile: while your account is open. When you close it, we delete or anonymise your personal information within 30 days, except what we must keep.
  • Google or Facebook account id: while that sign-in is connected. It is deleted when you disconnect it in Account settings or close your account.
  • Events, proposals and reviews: while your account is open, because the other side relies on them. After you close your account, reviews may stay without your name.
  • Messages and attachments: while the conversation’s members have accounts, because both sides rely on them. When you close your account, your messages stay for the other person without your details.
  • Orders and payment records: 10 years, as required by tax and accounting law.
  • Server logs: up to 90 days. Security and login logs are kept for up to 1 year.
  • Backups: overwritten on a rolling basis within 30 days.

6. Cookies

Migala uses cookies that are needed for the site to work: keeping you signed in, protecting forms from forgery, and remembering whether you’re hosting or supplying. When you sign in with Google or Facebook, a cookie holds that sign-in attempt for up to 10 minutes. After you sign in, a cookie remembers which way you used last (Google, Facebook or email, nothing about you) so the login page can mark it; it stays after you log out and expires after about a year. We don’t use advertising cookies.

7. Your rights

Under the Data Privacy Act, you have the right to:

  • be informed about how your data is used (this policy);
  • access the personal information we hold about you;
  • correct inaccurate information (most of it you can edit yourself in Account settings, your listings and your events);
  • object to processing, or withdraw consent where we rely on it;
  • have your data erased or blocked when it’s no longer needed or was processed unlawfully;
  • get a copy of your data in a common format (data portability);
  • be compensated for damages caused by inaccurate, incomplete or unlawfully used data;
  • file a complaint with the National Privacy Commission (privacy.gov.ph).

To use any of these rights, or to close your account, email dpo@migala.com.ph from the address on your account. We’ll reply within 15 working days, and in any case no later than 30 working days. We may need to confirm it’s you first.

Deleting your data, including Google or Facebook sign-in

  • Disconnect Google or Facebook: in Account settings → Login methods, choose Disconnect. Migala deletes that account id at once. If it’s your only way to log in, set a password first.
  • Remove Migala’s access on their side: in your Google Account under Security → Your connections to third-party apps and services, or in Facebook under Settings → Apps and websites.
  • Delete your account and data: email dpo@migala.com.ph from the address on your account and ask us to close it. We delete or anonymise your personal information within 30 days, as section 5 describes, including any Google or Facebook account id.

8. How we protect it

Migala runs over HTTPS. Passwords are stored scrambled. Message attachments are kept in private storage, and staff access is limited to what their work needs. Payment details never reach our servers. No system is perfectly secure; if a breach puts your information at risk, we’ll tell you and the National Privacy Commission as the law requires.

9. Children

Migala is for people 18 and over. We don’t knowingly collect information from children. If you think a child has an account, tell us at dpo@migala.com.ph and we’ll remove it.

10. Changes to this policy

We’ll post any changes here with a new date. If a change is significant, we’ll tell you by email or on the site before it takes effect.

11. Contact

Data Protection Officer
Migala Inc
Origin Building, 9544 C. Raymundo Ave, Pasig, 1606 Metro Manila
dpo@migala.com.ph

Open original