This Privacy Policy ("Policy") describes how BeeRook ("Company," "we," "us," or "our") collects, uses, processes, discloses, and protects personal information obtained from users ("you," "your," or "User") of our online platform, website, mobile applications, and related services (collectively, the "Platform" or "Services"). We are committed to protecting your privacy and handling your personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), and all applicable Philippine laws, regulations, and issuances of the National Privacy Commission (NPC). By accessing or using the Platform, you acknowledge that you have read, understood, and consent to the collection, processing, and disclosure of your personal information as described in this Privacy Policy. If you do not agree with this Policy, please discontinue use of the Platform immediately. Age Restriction: BeeRook is not intended for individuals under eighteen (18) years of age. We do not knowingly collect, process, or retain personal information from children. If you are under 18, you must not use the Platform or provide any personal information to us.

We collect the following categories of personal information: 1.1. Information You Provide Directly: (a) Account Registration Information: • Full name • Email address • Password (hashed and encrypted; not stored in plain text) • Phone number (optional) • Profile picture/avatar (optional) • Bio and personal description (optional) (b) Property Listing Information (for Landlords): • Property title and description • Property address (street address, city, province) • Geographic coordinates (latitude, longitude) • Property photographs (3-10 images per listing) • Rental pricing and terms • Property features and amenities • House rules and policies • Contact name and phone number (c) Communications and Messages: • Text messages exchanged with other Users • Image attachments sent via messaging system • Inquiry details and conversation history • Quick response templates used (d) User-Generated Content: • Saved/bookmarked properties • Reports and appeals submitted • Feedback and reviews (if applicable) 1.2. Information We Collect Automatically: (a) Device and Technical Information: • Device type, model, and operating system • Browser type and version • Screen resolution • User agent string (b) Usage and Analytics Data: • Pages and properties viewed • Time spent on Platform • Click patterns and navigation paths • Property search queries and filters applied • Date and time of access • Session IDs and duration (c) Cookies and Tracking Technologies: • Authentication tokens (HTTP-only cookies) • Session identifiers • User preferences (See Section 4 for detailed Cookie Policy) 1.3. Information from Third-Party Sources: (a) OAuth Authentication Providers (Facebook): • Basic profile information (name, email, profile picture) • Facebook user ID • Permissions granted through Facebook OAuth (b) Google Maps API: • Property addresses submitted for geocoding • Geographic coordinates for property location • Nearby places data (schools, malls, hospitals, tourist spots within 5km radius) IMPORTANT: We do NOT collect: • Precise real-time GPS location tracking • Financial account information (bank accounts, credit cards) • Government-issued identification numbers (SSS, TIN, passport) • Biometric data

We process your personal information for the following legitimate purposes: 2.1. Service Provision and Account Management: • Create, maintain, and authenticate User accounts • Enable User login and access control • Display property listings to prospective Renters • Facilitate real-time messaging between Landlords and Renters • Process and deliver notifications (new inquiries, messages, view milestones) • Allow Users to save and bookmark properties • Track property views and engagement metrics • Generate landlord performance analytics (response rate, response time) 2.2. Platform Improvement and Development: • Analyze usage patterns, trends, and User behavior • Conduct research and analytics to improve Services • Develop new features and functionality • Optimize Platform performance and user experience • Personalize content and recommendations • A/B test new features 2.3. Communication and Support: • Send transactional emails (account verification, password resets) • Deliver service-related notifications • Respond to User inquiries and support requests • Provide customer assistance • Send administrative announcements • Communicate updates to Terms of Service or Privacy Policy 2.4. Safety, Security, and Fraud Prevention: • Detect and prevent fraudulent listings and User conduct • Monitor for spam, harassment, and abusive behavior • Enforce our Terms of Service and Community Guidelines • Investigate reports and appeals • Suspend or terminate accounts that violate policies • Implement anti-spam measures and rate limiting • Secure the Platform against unauthorized access • Prevent data breaches and cyberattacks 2.5. Legal Compliance and Protection: • Comply with applicable laws and regulations • Respond to legal requests, subpoenas, and court orders • Cooperate with law enforcement investigations • Protect our legal rights and interests • Resolve disputes and enforce agreements • Maintain records for audit and compliance purposes 2.6. Marketing and Promotional Activities (Optional, with Consent): • Send newsletters and promotional offers (if you opt in) • Display relevant advertisements (if implemented) • Conduct surveys and request feedback You may opt out of marketing communications at any time by following the unsubscribe instructions in emails or contacting us at support@beerook.com.

We may share your personal information in the following circumstances: 3.1. With Other Users of the Platform: • Your public profile information (name, avatar, bio, member since date, verification status) is visible to all Users • Property listings (including photos, descriptions, pricing, address, contact information) are publicly accessible • When you send an inquiry about a property, your name, email, and message are shared with the Landlord • Landlords can see your inquiry history and conversation details • Messages exchanged between Users are visible to both parties 3.2. With Third-Party Service Providers: [LAWYER REVIEW RECOMMENDED] We share personal information with the following third-party service providers who process data on our behalf: (a) Supabase, Inc. (Cloud Infrastructure and Database): • Purpose: Backend infrastructure, database hosting, user authentication, file storage, real-time messaging • Data Shared: All User account data, property listings, messages, profile information, usage analytics • Location: Data may be stored on servers outside the Philippines (specific regions to be determined based on Supabase's infrastructure) • Security: Supabase implements industry-standard encryption and security measures • Data Processing Agreement: Supabase's Terms of Service and Privacy Policy apply • Website: https://supabase.com/privacy (b) Google LLC (Google Maps API): • Purpose: Geocoding addresses to coordinates, displaying property locations on maps, fetching nearby places (schools, malls, hospitals, tourist spots) • Data Shared: Property addresses, geographic coordinates, search queries • Privacy Policy: https://policies.google.com/privacy • Note: By using the Platform, you acknowledge that property location data is shared with Google's services (c) Resend Corporation (Email Service Provider): • Purpose: Sending transactional emails (account verification, password resets, magic link authentication, notifications) • Data Shared: Email addresses, recipient names, email content • Privacy Policy: https://resend.com/privacy • Security: Emails transmitted via secure protocols (d) Meta Platforms, Inc. (Facebook OAuth): • Purpose: Third-party authentication (sign up / log in with Facebook) • Data Shared: Facebook provides us with your basic profile information (name, email, profile picture) only if you choose to authenticate via Facebook • Privacy Policy: https://www.facebook.com/privacy/policy • Note: We do not have access to your full Facebook profile or friends list; only the information you authorize 3.3. For Legal Compliance and Protection: We may disclose your personal information when required by law or when we believe disclosure is necessary to: • Comply with legal obligations, court orders, subpoenas, or government requests • Respond to lawful requests from public authorities (e.g., law enforcement, National Privacy Commission) • Enforce our Terms of Service, Privacy Policy, or other agreements • Protect the rights, property, safety, and security of BeeRook, our Users, or the public • Detect, prevent, or investigate fraud, security breaches, or illegal activity • Defend against legal claims or litigation 3.4. Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your personal information may be transferred to the acquiring entity. We will notify you via email and/or prominent notice on the Platform before your information is transferred and becomes subject to a different privacy policy. 3.5. With Your Consent: We may share your information with other third parties when you explicitly consent to such sharing. IMPORTANT: We do NOT sell, rent, or trade your personal information to third parties for their marketing purposes. We do not engage in the commercial sale of User data.

We use cookies and similar tracking technologies to enhance your experience on the Platform. A "cookie" is a small text file stored on your device that helps us recognize you and remember your preferences. 4.1. Types of Cookies We Use: (a) Essential / Strictly Necessary Cookies: • Purpose: Enable core Platform functionality, user authentication, and security • Examples: Session tokens, authentication cookies, security tokens • Storage Duration: Session-based (deleted when you close browser) or persistent (until expiration or manual deletion) • Legal Basis: These cookies are necessary for the Platform to function and cannot be disabled • Specific Cookies: Supabase authentication tokens (HTTP-only, secure) (b) Functional / Preference Cookies: • Purpose: Remember your settings, preferences, and choices • Examples: Language preference, display settings, filter selections • Storage Duration: Persistent (up to 1 year) • You can disable these, but some features may not work properly (c) Analytics / Performance Cookies (If Implemented): • Purpose: Understand how Users interact with the Platform, identify errors, measure performance • Examples: Page views, time spent, click patterns, popular properties • Storage Duration: Up to 2 years • Note: Currently, we conduct analytics using server-side data only; client-side analytics cookies (e.g., Google Analytics) are not yet implemented (d) Marketing / Advertising Cookies (Not Currently Used): • We do not currently use marketing or advertising cookies • If introduced in the future, we will obtain your explicit consent 4.2. Managing Cookie Preferences: You can control and manage cookies through your browser settings: • Chrome: Settings > Privacy and Security > Cookies and other site data • Firefox: Settings > Privacy & Security > Cookies and Site Data • Safari: Preferences > Privacy > Manage Website Data • Edge: Settings > Cookies and site permissions Warning: Disabling essential cookies will prevent you from logging in and using key Platform features. 4.3. Third-Party Cookies: Third-party services may set their own cookies when you interact with their features: • Google Maps: May set cookies when viewing property locations • Facebook: May set cookies when logging in via Facebook OAuth These third-party cookies are governed by their respective privacy policies. 4.4. Local Storage and Session Storage: In addition to cookies, we use browser local storage and session storage to: • Store user preferences (e.g., cookie consent status, chat widget minimize/maximize state) • Cache data for faster performance • Maintain session state For more details, see our Cookie Policy at /cookie-policy

We implement reasonable technical, organizational, and physical security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. 5.1. Security Measures We Implement: (a) Encryption and Transmission Security: • All data transmitted between your device and our servers is encrypted using HTTPS/TLS (Transport Layer Security) • Passwords are hashed and salted using industry-standard algorithms; we never store passwords in plain text • Supabase authentication tokens are HTTP-only and secure cookies (b) Access Controls: • Role-based access control (RBAC) limiting staff access to User data • Admin access logged and monitored • Multi-factor authentication for administrative accounts (c) Database Security: • Row-Level Security (RLS) policies on all database tables • Automated backups and disaster recovery procedures • Database hosted by Supabase with enterprise-grade security (d) Application Security: • Regular security updates and patches • Input validation and sanitization to prevent injection attacks • Rate limiting and anti-spam measures • Protection against cross-site scripting (XSS) and cross-site request forgery (CSRF) (e) Monitoring and Incident Response: • Security monitoring for unauthorized access attempts • Logging of suspicious activity • Incident response plan for data breaches 5.2. Important Limitations: IMPORTANT: Messages exchanged through our Platform are NOT end-to-end encrypted. Messages are stored in plain text in our database and are accessible to: • The sender and recipient • Platform administrators and authorized personnel DO NOT share sensitive personal information, financial account details, passwords, or government-issued identification numbers via our messaging system. 5.3. Your Responsibilities: You play a critical role in protecting your account: • Use a strong, unique password (minimum 8 characters, mix of letters, numbers, symbols) • Do not share your password with anyone • Log out after using shared or public devices • Enable two-factor authentication (if available) • Keep your email account secure (used for password resets) • Report suspicious activity to support@beerook.com immediately • Be cautious of phishing attempts claiming to be from BeeRook 5.4. Data Breach Notification: In the event of a data breach that compromises your personal information, we will: • Notify affected Users via email within seventy-two (72) hours of discovery • Report the breach to the National Privacy Commission as required by law • Provide information about the nature of the breach, data affected, and steps being taken • Offer guidance on protective measures you can take [LAWYER REVIEW RECOMMENDED] 5.5. No Absolute Security: Despite our security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data. You acknowledge that: • Data transmission over the Internet carries inherent risks • Unauthorized access, hacking, or data breaches may occur despite our safeguards • You use the Platform at your own risk • We are not liable for security breaches caused by factors outside our reasonable control

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. 6.1. Retention Periods by Data Type: (a) Account Information: • Active accounts: Retained while your account is active • Deleted accounts: Soft-deleted data retained for thirty (30) days, then permanently deleted • Exception: We may retain certain information longer if required for legal compliance or fraud prevention (b) Property Listings: • Active listings: Retained while listing is published • Archived listings: Retained for ninety (90) days after archiving, then permanently deleted • Exception: Soft-deleted listings marked with deleted_at timestamp but remain in database for backup and recovery purposes (c) Messages and Communications: • Messages: Currently retained indefinitely to maintain conversation history • Future Policy: We may implement automatic deletion of messages older than two (2) years with advance notice • Legal holds: Messages may be retained longer if required for legal proceedings or investigations (d) Property Views and Analytics: • View tracking data: Retained indefinitely for landlord analytics • Aggregated analytics: Anonymized and retained for statistical purposes (e) Logs and Security Data: • Access logs: Retained for ninety (90) days • Security incident logs: Retained for one (1) year • Audit logs: Retained as required by law (f) Reports and Appeals: • Report records: Retained for one (1) year after resolution • Suspended/banned account records: Retained for three (3) years for fraud prevention 6.2. Legal and Regulatory Requirements: Certain data must be retained to comply with Philippine laws, including: • Tax records: Seven (7) years (if applicable when fees are introduced) • Business records: Five (5) years (as required by the Corporation Code) • Data breach records: Five (5) years (as required by the National Privacy Commission) 6.3. Data Deletion Upon Account Termination: When you delete your account or we terminate your account, the following occurs: • Your profile information is marked as deleted and hidden from public view • Your property listings are removed from search results and public pages • Your ability to log in and access the Platform is immediately revoked • Personal data is permanently deleted after the thirty (30) day retention period Data that may be retained after account deletion: • Anonymized analytics data (cannot be linked back to you) • Messages sent to other Users (visible only to recipients) • Transaction logs required for legal compliance • Records of Terms of Service violations or fraudulent activity 6.4. Your Right to Request Deletion: You have the right to request deletion of your personal data at any time by contacting support@beerook.com. We will delete your data within thirty (30) days unless retention is required by law. See Section 7 for full details on your privacy rights.

Under the Data Privacy Act of 2012 (Republic Act No. 10173), you have the following rights as a data subject: 7.1. Right to Be Informed: • You have the right to be informed about the collection, processing, and use of your personal data • This Privacy Policy serves as our notice to you regarding how we handle your data • You may request additional information about specific processing activities 7.2. Right to Access: • You have the right to obtain from us: - Confirmation of whether your personal data is being processed - Access to your personal data - Information about how your data is being processed • To request access, email support@beerook.com with subject line "Data Access Request" • We will respond within fifteen (15) business days 7.3. Right to Correction/Rectification: • You have the right to correct inaccurate or incomplete personal data • You can update most information directly in your account settings (name, email, phone, bio, avatar) • For data you cannot change yourself, contact us at support@beerook.com 7.4. Right to Erasure/Deletion ("Right to Be Forgotten"): • You have the right to request deletion of your personal data when: - The data is no longer necessary for the purposes it was collected - You withdraw consent and there is no other legal basis for processing - The data was unlawfully processed - The data must be deleted to comply with legal obligations • To request deletion: Email support@beerook.com with subject line "Account Deletion Request" • We will delete your data within thirty (30) days, except where retention is required by law • Note: Some anonymized data may be retained for statistical purposes 7.5. Right to Data Portability: • You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV, JSON) • You may request transfer of your data to another service provider • To request data export: Email support@beerook.com with subject line "Data Portability Request" • We will provide your data within fifteen (15) business days 7.6. Right to Object: • You have the right to object to processing of your personal data for: - Direct marketing purposes (you may opt out of marketing emails at any time) - Automated decision-making or profiling (if implemented) • To object: Email support@beerook.com or use the unsubscribe link in marketing emails 7.7. Right to Restrict Processing: • You have the right to request restriction of processing when: - You contest the accuracy of your personal data - Processing is unlawful but you prefer restriction over deletion - We no longer need the data, but you require it for legal claims - You have objected to processing pending verification • To request restriction: Email support@beerook.com 7.8. Right to Withdraw Consent: • Where processing is based on consent, you have the right to withdraw consent at any time • Withdrawal does not affect the lawfulness of processing prior to withdrawal • To withdraw consent: Email support@beerook.com or update your account settings 7.9. Right to File a Complaint: • You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated • National Privacy Commission Contact: - Website: https://www.privacy.gov.ph - Email: info@privacy.gov.ph - Hotline: (+632) 8234-2228 7.10. How to Exercise Your Rights: To exercise any of the above rights, please contact us at: • Email: support@beerook.com • Subject Line: Specify the right you wish to exercise (e.g., "Data Access Request") • Include: Full name, email address associated with your account, description of your request We will verify your identity before processing requests and respond within fifteen (15) business days. If we need additional time, we will notify you of the delay and the reason. 7.11. No Fees: Exercising your privacy rights is free of charge. However, we reserve the right to charge a reasonable fee or refuse requests that are manifestly unfounded, excessive, or repetitive.

BeeRook is NOT intended for individuals under eighteen (18) years of age. We do not knowingly collect, process, or retain personal information from children under 18. 8.1. Age Verification: • By using the Platform, you represent and warrant that you are at least 18 years old • We require Users to confirm their age during account registration • We do not have a mechanism to independently verify User age 8.2. Parental Notice: If you are a parent or legal guardian and believe your child under 18 has created an account or provided personal information to us, please contact us immediately at: • Email: support@beerook.com • Subject Line: "Minor Account - Immediate Attention Required" 8.3. Our Response: Upon discovering that we have collected information from a child under 18, we will: • Immediately suspend or terminate the account • Delete all personal information associated with the account within seventy-two (72) hours • Notify the parent/guardian (if contact information is available) • Take steps to prevent future access by the minor 8.4. Parental Consent (If Applicable): Under the Data Privacy Act of 2012, processing of personal information of minors requires parental consent. If you are under 18, DO NOT use this Platform unless you have obtained express written consent from your parent or legal guardian.

[LAWYER REVIEW RECOMMENDED] Your personal information may be transferred to, stored, and processed in countries outside the Philippines, including countries that may not have data protection laws equivalent to those in the Philippines. 9.1. Data Transfer Locations: Our third-party service providers may store or process data in the following jurisdictions: • Supabase: Servers located in [to be specified based on Supabase region selection] • Google Maps API: Data processed by Google LLC (United States) • Resend: Email infrastructure (region to be confirmed) • Facebook OAuth: Data processed by Meta Platforms, Inc. (United States) 9.2. Legal Basis for Transfers: We rely on the following mechanisms to lawfully transfer data internationally: • Your explicit consent (by using the Platform, you consent to international transfers) • Necessity for performance of a contract between you and us • Standard contractual clauses or data processing agreements with third-party providers • Adequacy decisions recognized by the National Privacy Commission (if applicable) 9.3. Safeguards: We ensure appropriate safeguards are in place to protect your data during international transfers, including: • Contractual obligations requiring service providers to implement adequate security measures • Encryption of data in transit and at rest • Compliance with applicable data protection laws in destination countries • Regular audits and assessments of third-party providers 9.4. Your Rights: If you have concerns about international data transfers or wish to withdraw consent, you may: • Contact us at support@beerook.com • Request deletion of your account and data • Exercise your rights under Section 7 of this Privacy Policy Please note that refusing international data transfers may prevent you from using certain Platform features or services that rely on third-party infrastructure.

Our Platform may contain links to third-party websites, services, or applications that are not operated or controlled by BeeRook. 10.1. Third-Party Websites: • Facebook (OAuth authentication) • Google Maps (property location display) • External websites linked from property listings or User-generated content 10.2. No Endorsement or Responsibility: We do NOT endorse, control, or assume responsibility for: • The content, privacy policies, or practices of third-party websites • The accuracy or safety of third-party services • Data collection or processing by third parties 10.3. Your Responsibility: Before providing any personal information to third-party websites or services: • Review their privacy policies and terms of service • Understand how they collect, use, and protect your data • Exercise caution and use your judgment 10.4. Social Media Integration: If you choose to authenticate via Facebook OAuth or share content on social media platforms: • Those platforms' privacy policies and terms apply • We are not responsible for data collected by social media companies • Sharing personal information on social media is at your own risk For questions about third-party data practices, contact the third party directly. We cannot control or intervene in their data handling.

We reserve the right to modify, amend, or update this Privacy Policy at any time to reflect changes in our practices, Services, legal requirements, or for other operational reasons. 11.1. Notice of Changes: Material changes to this Privacy Policy will be communicated through: • Email notification to the address associated with your account (at least seven (7) days before changes take effect) • Prominent banner notice on the Platform homepage • In-app notification upon login • Updated "Last Updated" date at the top of this Policy 11.2. Types of Changes: Changes may include: • Addition of new data collection practices or processing purposes • Changes to third-party service providers • Updates to data retention periods • Modifications to User rights or how to exercise them • Changes to international data transfer mechanisms • Updates required by new laws or regulations 11.3. Effective Date: • Material changes will take effect seven (7) days after notice is provided • Non-material changes (e.g., clarifications, formatting) take effect immediately upon posting • The "Last Updated" date at the bottom of this Policy reflects the most recent revision 11.4. Your Acceptance: By continuing to use the Platform after changes become effective, you acknowledge that you have read, understood, and agree to the updated Privacy Policy. 11.5. Right to Object: If you do not agree with changes to this Privacy Policy, you have the right to: • Stop using the Platform • Delete your account by contacting support@beerook.com • Exercise your data deletion rights under Section 7 We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

If you have any questions, concerns, comments, or requests regarding this Privacy Policy, our data practices, or your privacy rights, please contact us: BeeRook Data Privacy Office General Support: support@beerook.com Address: Baguio City, Benguet, Philippines Response Time: We will make reasonable efforts to respond to all inquiries within fifteen (15) business days. For urgent matters (e.g., suspected data breach, unauthorized access), please indicate "URGENT" in the email subject line. Data Protection Officer (DPO): The DPO is responsible for overseeing our data protection strategy and ensuring compliance with the Data Privacy Act of 2012. National Privacy Commission (NPC): If you believe your data privacy rights have been violated, you may file a complaint with the National Privacy Commission: • Website: https://www.privacy.gov.ph • Email: info@privacy.gov.ph • Telephone: (+632) 8234-2228 • Address: 3rd Floor, Manila Bay View Tower, 108 Roxas Boulevard, Pasay City 1300, Philippines Last Updated: November 18, 2025 By using BeeRook, you acknowledge that you have read, understood, and agree to this Privacy Policy.