Last updated 11 September 2026
Who we are
Upa is a web application for billing rent and utilities, run from upaph.com and app.upaph.com. "We" and "us" mean the team that operates Upa. "You" means an operator who uses Upa - a landlord, property manager, dormitory or boarding house owner - and anyone who contacts us through this website.
Your role and ours
This policy follows the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.
- For your own account details, we are the personal information controller.
- For your tenants' information - names, contact numbers, units, bills, meter readings and payments you enter - you are the personal information controller and we are your personal information processor. We handle that data only to provide Upa to you, and only on your instructions.
As the controller for your tenants' data, you are responsible for having a lawful basis to collect it and for telling your tenants how it is used.
What we collect
From operators
- Your name, business name, email address and mobile number when you sign up.
- Your password, which we store only as a one-way hash.
- Records of your subscription orders and payments to us.
- Security records: sign-in attempts and a hashed form of the network address they came from, used to stop password guessing.
About your tenants, as you enter it
- Names, mobile numbers, unit assignments and lease terms.
- Meter readings, optional photos of meters, bills, penalties and payments with their reference numbers.
From this website
- What you type into the contact form: name, business, mobile number, email, number of doors, city and message.
- Your light or dark theme choice, stored in your own browser.
We do not use advertising trackers or analytics that follow you across websites.
How we use it
- To run Upa: compute bills, show statements, record payments and keep your account secure.
- To reply to messages you send us and to help you set up.
- To send account email you need, such as email confirmation and password resets.
- To comply with the law and to protect Upa and its users from fraud and abuse.
We never sell personal information, and we never contact your tenants for our own purposes.
Who we share it with
Only the service providers needed to run Upa, under obligations to protect the data:
- Our web hosting provider, which stores the application and its database.
- Our network and security provider, which delivers pages over HTTPS and filters attacks.
- Our email provider, which delivers account email.
We disclose information to authorities only when the law requires it.
How long we keep it
- Your records stay while your account exists. If your plan lapses, nothing is deleted - the account becomes read-only.
- When you ask us to close your account, we delete your records within a reasonable period, except anything the law requires us to keep.
- Contact-form messages are kept for as long as we need them to follow up with you.
How we protect it
Hashed passwords, optional two-factor authentication, separation of every account's records, private random links for tenant statements, private storage for meter photos, anti-forgery tokens on forms, and HTTPS everywhere. Read the details. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you and the National Privacy Commission as the law requires.
Your rights
Under the Data Privacy Act you may be informed about, access, correct, object to the processing of, and ask us to erase or block your personal information, obtain a copy of it in a portable format, and claim damages for a violation. Tenants should direct requests about their data to their landlord or property manager first, who controls it; we will help them respond.
If you believe your rights have been violated, you may complain to the National Privacy Commission.
Cookies and storage
- This website stores only your theme choice, in your browser, plus a cookie of the same name so the app opens in the same theme.
- The app uses one session cookie to keep you signed in, and the same theme preference.
Our fonts are loaded from Google Fonts, which receives your network address when your browser downloads them.
Changes
If we change this policy in a way that matters, we will update the date above and tell operators by email or inside the app before the change takes effect.
Contact us
For privacy questions or to exercise your rights, write to us through the contact form or on Messenger, and mention "privacy" so it reaches the right person.