Privacy Policy
Who We Are
KortOS is a court booking and sports facility management platform built for Philippine sports clubs and their members. It is operated by ASJ Digital OPC, a registered One Person Corporation in the Philippines.
Registered Address: Davao City, Philippines Data Protection Officer: Alain Pedronio DPO Contact: alain@kortos.app Platform: kortos.app
We are committed to protecting your personal information in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations.
What This Policy Covers
This Privacy Policy applies to:
kortos.app — our marketing and information website
The KortOS operator dashboard — used by sports facility owners and their staff to manage bookings, members, and operations
The KortOS member portal — used by sports facility members to book courts, manage their profile, and view their activity
This policy does not apply to third-party websites or platforms that may be linked from KortOS.
The Roles Under Philippine Privacy Law
Under RA 10173, different parties play different roles in how data is handled:
ASJ Digital OPC (KortOS) is a Personal Information Controller (PIC) — we decide why and how personal data is collected and processed through the KortOS platform.
Facility Operators (sports clubs using KortOS) are also Personal Information Controllers for the data of their own members. They use KortOS as a tool to collect and manage that data, which makes them responsible for obtaining proper consent from their members and handling that data lawfully.
Third-Party Service Providers (listed below) are Personal Information Processors — they process data on our behalf under strict confidentiality obligations.
Section 1 — Website Visitors (kortos.app)
When you visit kortos.app without creating an account, we collect limited information automatically.
What we collect
Usage data — pages visited, time spent, links clicked, referral source
Device and browser data — browser type, operating system, screen size
IP address — collected by our analytics tools
Why we collect it
To understand how visitors use our website so we can improve it
To measure the effectiveness of our marketing
Tools we use
Google Analytics 4 (GA4) — website traffic and behavior analytics. KortOS is configured to minimize data collection in our analytics tools.
Microsoft Clarity — session recordings and heatmaps to understand how visitors interact with our pages. KortOS is configured to minimize data collection in our analytics tools.
Cookies
kortos.app uses cookies for analytics and performance. You can control cookies through your browser settings. Disabling cookies may affect your experience on the site.
Section 2 — Facility Operators
This section applies to sports facility owners, managers, and staff who use the KortOS operator dashboard.
What we collect about you
When you register as a KortOS operator or staff member, we collect:
Account information — full name, email address, phone number
Business information — facility name, address, sport types, operating hours, court configuration
Billing information — subscription plan, payment history, invoice records (we do not store card details — payments are processed by PayMongo)
Activity data — actions taken in the dashboard, audit log entries, settings changes
Staff accounts — names and email addresses of staff members you add to your account
Why we collect it
To provide and maintain your KortOS subscription
To process payments and generate invoices
To send billing notifications, product updates, and support communications
To maintain audit logs for accountability and security
To improve the platform based on how operators use it
Your responsibilities as a facility operator
Because you use KortOS to collect and manage your members' personal data, you are also a Personal Information Controller under RA 10173. This means:
You are responsible for obtaining proper consent from your members before collecting their data through KortOS
You must inform your members about how their data is used
You must handle your members' data requests (access, correction, deletion) in a timely manner
You must notify ASJ Digital OPC immediately if you become aware of any data breach involving your members' data on the KortOS platform
By using KortOS, you agree to these responsibilities.
Data retention
Upon subscription cancellation, operators may contact alain@kortos.app to request a data export or account deletion. KortOS will retain operator data for a reasonable period to allow for account recovery.
Financial records (invoices, payment history) are retained as required by applicable Philippine law including BIR regulations.
Section 3 — Sports Facility Members
This section applies to individuals who register as members of a sports facility using the KortOS platform.
What we collect about you
When you create a member account or book a court through KortOS, the following data may be collected:
Profile information — display name (you may use your first name, full name, or a preferred name), email address, phone number
Profile photo — optional, only if you choose to upload one
Booking history — courts booked, dates and times, booking status, cancellations
Transaction records — payment amounts, payment method used, booking references. A Technology Usage Fee (TUF) is applied to all payment transactions processed through KortOS regardless of payment method. We do not store your card details — card payments are processed by PayMongo.
Keys and Stubs — your court booking entitlements and rental passes
Membership information — your membership plan and status at your facility
Session data — behavioral data collected by our analytics tools (see Third-Party Services below)
DUPR email sharing — if you choose to opt in during registration or via your Profile under Privacy and Preferences, your email address will be shared with DUPR (Dynamic Universal Pickleball Rating) for pickleball rating services and marketing communications from DUPR. This opt-in is not pre-checked and sharing only occurs with your explicit consent. You may withdraw this consent at any time from your Profile under Privacy and Preferences. Withdrawal stops future sharing but does not retroactively delete data already shared with DUPR. Opted-in email addresses are exported to DUPR on a quarterly schedule (January 31, April 30, July 31, October 31).
Why we collect it
To manage your court bookings and reservations
To process payments and maintain transaction records
To send booking confirmations, reminders, and notifications
To enable facility features such as Open Play, First Dibs, and the Smart Waitlist
To allow your facility operator to manage their membership and operations
Who can see your data
Your facility operator and their authorized staff can see your profile, booking history, transaction records, and any notes or tags they have added to your account
ASJ Digital OPC can access your data for platform support, security, and compliance purposes
Other members cannot see your personal data — only your display name may be visible in shared features like Open Play queues
Age requirement
KortOS does not currently support member accounts for individuals under 18. By registering, you confirm that you are at least 18 years of age.
Your consent
By registering as a member on a KortOS-powered facility platform, you are required to read and accept this Privacy Policy before your account is created. Your consent is recorded with a timestamp at the time of registration. You may withdraw your consent at any time by contacting your facility operator or our DPO at alain@kortos.app.
Data retention
Members may request account deletion by contacting their club administrator or alain@kortos.app. Requests will be processed within 30 days. Financial transaction records may be retained in anonymized form as required by applicable law.
Section 4 — Third-Party Services
KortOS uses the following third-party services to operate the platform. Each of these services may receive limited personal data as described below.
Service Purpose Data They Receive Supabase Database, authentication, and file storage All member and operator data stored in KortOS Vercel Application hosting and deployment Application code and server logs — no direct personal data storage PayMongo Payment processing (BSP-registered) Payment transaction data for online payments — card details are processed and held by PayMongo, not KortOS. Note: the Technology Usage Fee (TUF) applies to all payment transactions processed through KortOS, including manual payments (GCash, Maya, bank transfer), not only PayMongo transactions. Resend Transactional email delivery Email addresses and message content for booking confirmations and notifications Cloudflare Email routing and DNS Email addresses for routing purposes only Google Analytics 4 Website and platform analytics Behavioral data and device information. KortOS is configured to minimize data collection. Microsoft Clarity UX session recordings and heatmaps Session interaction data. KortOS is configured to minimize data collection. DUPR (Dynamic Universal Pickleball Rating) Pickleball rating system integration Email addresses of members who have explicitly opted in to DUPR communications. Sharing is consent-based, optional, and exported quarterly. Members who do not opt in are not included.
All third-party services are required to handle your data in accordance with applicable privacy laws and their own privacy policies. We do not sell your personal data to any third party.
Section 5 — Your Rights Under RA 10173
As a data subject under Philippine law, you have the following rights:
Right to be informed You have the right to know that your personal data is being collected, what data is collected, why it is collected, and who it is shared with. This Privacy Policy fulfills that right.
Right to access You may request a copy of the personal data we hold about you. Members can view their profile, bookings, and transaction records in the member portal. For a complete copy of your data, contact alain@kortos.app.
Right to rectification You may correct inaccurate or incomplete personal data through your account settings or by contacting us.
Right to erasure Members may request account deletion by contacting their club administrator or alain@kortos.app. Requests will be processed within 30 days. Some data may be retained in anonymized form for legal or regulatory compliance purposes.
Right to object You may object to specific data processing activities by contacting us at alain@kortos.app.
Right to data portability You may request your personal data by contacting alain@kortos.app. We will provide your data in a readable format.
Right to damages If your rights under RA 10173 have been violated, you may seek compensation through appropriate legal channels.
Right to file a complaint If you believe your data privacy rights have been violated, you may file a complaint with the National Privacy Commission (NPC) at privacy.gov.ph.
To exercise any of these rights, contact our Data Protection Officer at alain@kortos.app. We will respond to all requests within 30 days.
Section 6 — Data Security
We take the security of your personal data seriously. The following measures are in place to protect it:
All data is transmitted over encrypted connections (HTTPS)
Our database is hosted on Supabase with row-level security (RLS) — each facility's data is strictly isolated from other facilities
Passwords are hashed using industry-standard algorithms — they are never stored in plain text
Access to the platform is role-based — staff members can only access data relevant to their role
All data access and changes are recorded in audit logs maintained as an append-only record that cannot be edited by any user
Access to audit logs is restricted to authorized administrators
KortOS maintains automated daily backups through our database provider
KortOS uses access-controlled file storage for user-uploaded content
Payment card data is never stored by KortOS — all card transactions are handled by PayMongo, a BSP-registered payment processor
KortOS maintains separate environments for development, staging, and production
Access to KortOS infrastructure and environment variables is restricted to authorized personnel
In the event of a data breach that is likely to affect your rights and freedoms, we will notify you within 72 hours of becoming aware of the breach, in accordance with NPC Circular 16-03.
Section 7 — Children's Data
KortOS does not currently support member accounts for individuals under 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at alain@kortos.app.
Section 8 — Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we publish a material update, registered operators and members will be required to review and re-accept the updated policy before they can continue using the platform. Access to KortOS is temporarily suspended until re-acceptance is confirmed. This ensures that your consent is always current and informed.
The current version of this Privacy Policy is always available at kortos.app/privacy.
Section 9 — Contact Us
For any questions, concerns, or data subject requests regarding this Privacy Policy or how we handle your personal data:
Data Protection Officer Alain Pedronio ASJ Digital OPC Davao City, Philippines alain@kortos.app
National Privacy Commission privacy.gov.ph complaints@privacy.gov.ph
KortOS is operated by ASJ Digital OPC — Built in Davao, Philippines 🇵🇭 This Privacy Policy is governed by the laws of the Republic of the Philippines.