Privacy Policy

Last updated: 5 October 2026

This Privacy Policy explains how KantoPay ("we", "us", or "our") collects, uses, and protects your personal data when you use our Platform. It is designed to comply with the Philippine Data Privacy Act of 2012 (RA 10173). It applies to Creators (game-server owners who operate storefronts) and Buyers (players who purchase items through Creator storefronts).

1. Information we collect

We collect only the information necessary to provide and secure our services.

• Creators: mobile number, hashed PIN, store details, payout method and account details, transaction history, and wallet history.
• Identity verification (Creators, optional): to lift the withdrawal limit, a Creator can verify their identity with a selfie and a photo of a government-issued ID, on a verification page run by PayMongo, our BSP-licensed payment processor. Your ID and face images are sensitive personal information under the Data Privacy Act, so a check starts only after you agree to it in your dashboard, and we record when you agreed. To set up the check we send PayMongo your email address and mobile number. PayMongo collects and keeps the images; KantoPay receives the result (passed or failed), PayMongo's reason when a check does not pass, and the reference numbers of your verification account and sessions. Identity verification is only for Creators 18 and older.
• Buyers: player name, optional email address (for receipts / gift cards), in-game recipient details, items purchased, and our payment processor's record of the payment: its reference numbers and the bank or e-wallet it was paid from.
• Payment data: card and e-wallet details are collected directly by our BSP-licensed payment processor. KantoPay does not store full card numbers.
• Automated data: basic device and usage data, and IP addresses needed to run the site securely.
• Cookies and tracking: we use cookies to keep you logged in, remember your preferences, and secure the Platform. You can set your browser to refuse cookies or to warn you when one is sent — but if you do, essential parts of KantoPay (such as logging in or completing checkout) may not work properly.

2. How we use your data

• Platform operations: to operate your store, process payments, deliver purchased in-game items, and disburse Creator earnings.
• Communications: to send essential transactional messages — SMS login codes, email receipts, and gift-card codes.
• Security & compliance: to prevent fraud, abuse, and unauthorised access, to verify a Creator's identity before lifting their withdrawal limit, and to comply with legal obligations.
• Improvement: to provide customer support and analyse usage to improve the Platform.

3. How we share your data

We do not sell your personal data. We share it only with trusted third parties as needed to run our services:

• Service providers: our BSP-licensed payment processor, PayMongo (to handle transactions and payment disputes, which it passes on to the bank or e-wallet the payment came from, and, if you choose to verify your identity, to run the ID and selfie check), SMS/email providers (to deliver codes and receipts), and secure cloud infrastructure providers.
• Cross-border transfers: your data may be stored and processed on secure cloud servers located outside the Philippines. By using the Platform, you consent to this transfer; we require our infrastructure providers to meet recognised data-security standards.
• Legal authorities: we may disclose data where required by law, or to protect the rights, property, and safety of KantoPay, our users, or the public.

4. Buyer-to-Creator data sharing

When a Buyer makes a purchase through a Creator's storefront, limited order information (such as player name, items bought, and in-game recipient) is shared with that specific Creator so they can fulfil the order and provide support. Staff the Creator has given access to the store's orders can see it too, and the Creator must make sure they keep it confidential. Creators are required to handle this data lawfully and only as we instruct — see the Creator Agreement.

If a Buyer disputes a payment or asks for help with an order, we share with the Creator only what they need to look into it: the order, the in-game name it went to, and its delivery record. We don't share a Buyer's IP address, login logs or device data with Creators.

If a game server or store changes hands, Buyers' details from earlier orders don't pass to the new owner. The one exception: if we agree to move a store to a new owner, that owner receives the store's order records, and must handle them under the same Creator Agreement.

5. Third-party links

Creator storefronts may link to external sites we don't operate (such as a game server's own website or a game wiki). We are not responsible for the privacy practices or content of those sites; please review the privacy policy of any site you visit.

6. Data retention

We keep personal data only as long as needed to provide our services, resolve disputes, and meet legal, tax, and accounting requirements. Once it is no longer required, it is securely deleted or anonymised.

Records of purchases, refunds and payouts, including our payment processor's notices about them, are kept for as long as tax and accounting law requires us to keep our books.

Identity verification images are held by PayMongo, not KantoPay, under PayMongo's own legal and compliance retention rules. KantoPay keeps the verification result and its reference numbers for as long as your account is open.

7. Security measures

We use reasonable technical and organisational measures to safeguard your data, including PIN hashing, encrypted transport (HTTPS), and strict access controls. No digital system is 100% secure, but we work diligently to protect your information.

8. Your privacy rights

Under the Data Privacy Act of 2012, you have the right to be informed about, access, correct, object to, or request deletion of your personal data, and to lodge a complaint with the National Privacy Commission (NPC). To exercise these rights, contact our Data Protection Officer using the details below.

9. Children's privacy

Creator accounts are only for people 18 years of age or older. Many Buyers are younger. A Buyer under 18 may buy only with the consent of a parent or legal guardian (see our Terms of Sale, section 7).

From a Buyer under 18 we collect only what checkout needs, the same Buyer details listed in section 1: the player name and in-game details the item goes to, the items bought, an email address if one is given for a receipt or gift card, and our payment processor's record of the payment.

A parent or legal guardian may exercise the child's rights in section 8 on the child's behalf, including asking us to delete the child's personal data. Contact our Data Protection Officer using the details below. We may ask you to show that you are the child's parent or guardian. We keep only the records the law requires us to keep, such as records of purchases and refunds (section 6).

10. Changes & contact

We may update this Policy; material changes will be posted here with a new "last updated" date. For privacy questions or to exercise your rights, contact our Data Protection Officer:

• Email: support@kantopay.com (a dedicated DPO address will be published before public launch)
• Address: our registered office, to be published before public launch.