Privacy
DRAFT — describes what the system actually does, and has not been through legal review. It must be reviewed before it is relied on or submitted to an app directory.
Who this covers
Three kinds of people reach KayIdol: customers, who arrive through an AI assistant and never create an account; service providers, who hold accounts; and agent developers, who hold API keys.
What is collected, and what happens to it
Customers. A booking needs somewhere to send a tradesperson and a way to reach you: a contact number, optionally an email, and a service address. The street-level address, the phone number and the email are encrypted before they reach the database, with a key the database never holds, and each ciphertext is bound to the column it belongs to so it cannot be moved between fields. Phone and email are additionally stored as a keyed hash, so a repeat booking can be recognised without the number being readable.
Location. The exact point of a service address is stored in a column the application is not permitted to read back. What ranking and search use is a version snapped to a coarse grid. A provider is never shown your exact position before a booking exists.
Providers. Business name, contact details, service area, prices, and verification evidence — currently a government ID check, which the law requires before a business may be listed at all.
Agents. A hash of the API key, never the key. Requests are logged with a request id, the route, the outcome and how long it took. Search queries are recorded as typed, because a query that matched nothing is how the service learns what it is missing.
What is never collected
No card numbers, bank details or payment credentials — during the free beta no money moves through KayIdol at all; the customer settles directly with the provider. Nothing is sold to anyone, and nothing is shared with advertisers.
Where it is stored
Application data is held in a managed PostgreSQL database and an application server, both located in Seoul, South Korea. Transactional email is sent through Resend and SMS through Semaphore; each receives only the address or number needed to deliver that one message, and the message body carries no customer details.
How long it is kept
Booking records are retained as business records. The audit log is append-only by design and owned by a database role the application cannot write to, so entries cannot be altered or deleted after the fact. Server logs are retained for 90 days.
Your rights
Under the Philippine Data Privacy Act (RA 10173) you may ask what is held about you, ask for it to be corrected, and ask for it to be erased. Write to support@kayidol.com. Erasure removes personal data while retaining the minimum a business record requires.
Questions about this page: support@kayidol.com. The service itself is described at /v1/meta/capabilities, which is authoritative over anything written here.