1. Who is responsible
CRY-EX decides why and how the personal data described here is used and is the personal information controller for the CRY-EX service on the cry-ex.com website.
Privacy questions and requests can be sent through the Help tool in the relevant CRY-EX account. If you cannot sign in, start from the public Help & FAQ page linked in Contact us.
This notice covers the Landing, Customer, Driver, Merchant, Reach, and Admin sites and their shared API. A provider linked from CRY-EX may also have its own privacy notice.
2. Personal data CRY-EX handles
| Kind of data | Examples | Why it is needed |
|---|---|---|
| Account | Name, email, phone, role, email-confirmation status, password hash, account status | Create and protect an account and show the correct workspace |
| Delivery and order | Pickup and drop-off addresses and coordinates, recipient/contact details, parcel or order details, notes, messages, proof photo or signature, ratings | Quote, arrange, track, complete, support, and review a delivery |
| Driver | City, vehicle type, availability and submitted location, licence and vehicle documents, identity-check references and results, job and earnings history | Review eligibility, offer work, route an assigned job, and handle payouts |
| Merchant | Owner contact, store name, address and coordinates, hours, menu, prices, preparation time, orders and earnings | Set up the store, show it to customers, fulfil orders, and provide support |
| Reach | Campaign copy, audience choices, dates, budget, approval and impression/click/claim records | Run and measure advertising placements |
| Payment | Booking, amount, currency, payment method, provider reference and status | Start and confirm a GCash checkout. CRY-EX does not ask for or store your GCash PIN or OTP. |
| Help and communications | Support request, messages, email delivery status, notification settings | Answer questions and send account, delivery, order, or security updates |
| Safety and device | Request time, IP address or a protected value derived from it, sign-in attempts, session and security events, CAPTCHA result, browser/device details in service logs | Prevent abuse, investigate incidents, rate-limit requests, and keep accounts safe |
CRY-EX receives most of this information from you. It also receives delivery or order updates from the customer, driver, merchant, administrator, or provider involved in the same transaction. Identity and payment providers send status or reference information back to the API.
3. Location and map information
When broad network location is available, the map may begin near an area inferred from that information. For a more accurate starting point, the app offers a button that asks your browser for location permission. CRY-EX does not trigger that device prompt until you choose the button.
Denying location permission does not block manual address search. A browser’s temporary device position is used to centre the map; it is not automatically saved as your delivery or store address. When you choose an address or map point, the selected written address and coordinates can be stored with the booking, route, driver update, or store profile.
Map tiles, address searches, and route requests go to CRY-EX’s OpenStreetMap, Nominatim-compatible, and OSRM services. Those services can receive the searched place, route points, viewed map area, IP address, and request time. Enter only the address details needed to find the pickup, drop-off, route, or store.
4. Why CRY-EX uses personal data
- Provide what you request: create the account, calculate a route and quote, match roles, show a store, process a checkout, send updates, and answer support requests.
- Run the agreement: keep transaction records, handle disputes, calculate balances, and apply the Terms of Service.
- Protect people and the service: verify email, check driver documents, stop automated abuse, investigate suspicious activity, and keep an audit trail.
- Meet legal duties: respond to valid lawful requests and preserve information when the law requires it.
- Use a choice you made: ask for device location, optional notifications, or another feature that needs separate permission. You may withdraw an optional permission, although a feature that needs it may stop working.
Reading or acknowledging this notice does not give CRY-EX unlimited consent. CRY-EX should use the lawful reason appropriate to each purpose and ask separately when consent is required.
6. How long data is kept
CRY-EX applies these specific cleanup rules:
- an account that does not finish email registration is removed after 24 hours by scheduled maintenance;
- expired sessions and one-time registration, recovery, and activation tokens are removed after their configured expiry;
- sign-in attempt records, security events, completed notification-delivery records, and identity-check webhook events are normally kept for 90 days; and
- read notifications are normally kept for no more than 90 days.
Account, booking, order, store, driver, support, audit, payment-reference, and uploaded-media records are kept while the account or related transaction remains active. After an account-closure or deletion request is approved, CRY-EX removes or de-identifies records that are no longer needed. Limited records may be kept longer for security, a complaint or dispute, fraud prevention, accounting, or another legal duty. Each outside provider applies its own retention rules.
7. Information kept in your browser
CRY-EX uses browser storage for the current tab and a strictly necessary, secure sign-in cookie so your account stays signed in when you refresh or reopen the site. The cookie contains an opaque session credential, not profile details, and expires after seven days at most. The Customer site may also keep basic account display information for convenience. Signing out removes the active sign-in cookie. Your browser may cache ordinary site files. CRY-EX does not use advertising-tracking cookies.
Signing out, clearing site data, or reaching the session’s seven-day expiry will require you to sign in again. Avoid using a shared device; if you do, sign out and clear the browser’s site data when finished.
8. How data is protected
Safeguards include password hashing, email confirmation, time-limited session and recovery tokens, bot checks, rate limits, role-based access, private media storage, quarantined driver documents, provider-signed callbacks, audit events, encrypted HTTPS connections, and restricted browser security headers.
No service can promise perfect security. Do not send passwords, PINs, OTPs, or unnecessary identity details in a booking note, chat, store listing, ad, or support request. If you believe an account or document was exposed, use Help as soon as possible.
9. Your privacy rights
Subject to the Philippine Data Privacy Act of 2012 and its limits, you may have the right to:
- be informed about processing and ask for access to your personal data;
- correct inaccurate or incomplete information;
- object to certain processing or withdraw consent where consent is the basis;
- request erasure or blocking when the legal conditions are met;
- receive eligible information in a portable electronic format;
- claim damages where the law provides; and
- file a complaint with the National Privacy Commission.
CRY-EX may need to verify your identity before acting on a request and may keep a limited record of the request and response. An authorized representative may be asked for proof of authority.
10. Your choices
- You can deny browser location permission and enter an address manually.
- You can leave optional profile, description, note, and notification fields blank where the form allows it.
- You can stop a driver identity check before submitting documents. Driver jobs will remain unavailable if the required check is not completed.
- You can sign out, revoke a browser’s site permission, and request account closure through Help.
Do not create an account for a child. CRY-EX is intended for people aged 18 and over. If you believe a child’s information was submitted, ask the operator to remove it.
11. Changes to this notice
The notice will be updated when the service, provider list, retention rules, or legal requirements change. The effective date and version at the top will change. A material change should be shown clearly to registered users and, where the law requires, presented before the new processing begins.
12. Contact and requests
Use Help inside the Customer, Driver, Merchant, or Admin site to make a privacy request tied to your account. If you cannot sign in, use the public Help & FAQ page. State that your message is a privacy request and include the email used for your account, but never send a password, PIN, or one-time code.
- Controller
- CRY-EX
- Account request route
- Use the Help tool inside the relevant CRY-EX site.
- Cannot sign in
- Use the public Help & FAQ to contact the CRY-EX operator.