Privacy notice
Effective 11 November 2026
Daylaya, operated through The North Protégé, uses personal information to review property submissions, process reservation requests and manage access to its team workspace. Contact daylaya@thenorthprotege.com for privacy questions or requests.
What we collect and why
For reservations, we collect your name, email, phone number, selected property, dates, guest count and any message you choose to share. We use these details to assess availability, coordinate with the host, respond by email and maintain booking records. Please avoid including identification documents, payment information or sensitive personal information in optional messages.
For team accounts, our authentication provider manages your email, password and email verification. Daylaya stores your verified account identifier, name, email, access request, approval status, permitted menus and privacy notice acknowledgment. These are used for account security, owner approval and access control. Registration does not provide access to guest data.
For property applications, we collect the details you submit for private review. The public Owner or Host profile, photograph and preferred contacts are published only as part of an approved listing. Provide only details you are authorized to publish.
Who can access your information
Authorized Daylaya staff can access only the workspace menus assigned to them. Relevant booking details may be shared with the property host to process your request. Service providers include Supabase for account authentication, Convex for application data and file storage, Cloudflare for hosting and security, and Resend for transactional email. Their infrastructure may process information outside the Philippines. We use service providers to support these stated purposes; we do not sell personal information.
Email and browser storage
Reservation acknowledgments, booking decisions and relevant follow-up messages are transactional communications. We do not add booking guests or team applicants to a marketing list. Team sign-in uses secure, HTTP-only session cookies. Saved properties are stored on your device. Open and click tracking are not required for booking acknowledgments.
Retention and control
Pending, declined or revoked team access requests are removed after 90 days without an update. Approved access records remain while access is active. Security audit records are retained for up to one year. Email delivery records in the application are removed after 30 days. Reservation and property records are retained while needed to administer bookings, address disputes and meet applicable recordkeeping obligations. Email providers may retain their own delivery records under their service policies.
You may request access to or correction of your information, object to unnecessary processing, or request deletion or withdrawal of consent where applicable by emailing us. We will assess the request, verify identity as needed, and explain any legal or operational reason for retaining a record. Account and booking data are used only for their stated purposes. You may raise concerns with the Philippine National Privacy Commission at privacy.gov.ph.
Keeping information secure
We use verified sign-in, approval before team access, server-enforced menu permissions, encrypted transport and access logs. Keep your password private and sign out on shared devices. Email daylaya@thenorthprotege.com if you suspect unauthorized access.