Privacy policy

RESQ-Link ("RESQ-Link," "we," "us," or "our") is an emergency-response platform that connects civilians, dispatch command centers, and field responders. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the RESQ-Link civilian mobile application, related websites (including www.resq-link.com), and associated services (collectively, the "Services").

The Services are developed and operated in coordination with St. Paul University Philippines Institutional Innovations and municipal emergency-response stakeholders in Tuguegarao City, Philippines. By creating an account or using the Services, you acknowledge that you have read and understood this Privacy Policy.

Account and profile information. When you register, we collect your name, residential address, mobile phone number, email address, and account credentials. This information is required to create and secure your account.

Identity verification (KYC) information. To reduce misuse of emergency services and protect responders and the public, we require identity verification before full access is granted. This includes the type of government-issued ID you select (for example, Philippine national ID, driver's license, passport, or other accepted IDs) and a photograph of the front of that ID. ID images are uploaded to secure cloud storage and reviewed manually by authorized RESQ-Link administrators.

Location information. With your permission, we collect precise or approximate location data when you use location features such as auto-filling your address during registration or submitting an emergency report with your current position. Location may be collected in the foreground while you are using the app.

Emergency report content. When you file a report, we collect the information you submit, which may include incident type, description, photos, timestamps, and location coordinates associated with the incident.

Communications and verification. We send email one-time passwords (OTP) for account verification and may retain logs of verification attempts. We do not send marketing SMS without separate consent.

Device and usage information. We automatically collect technical data such as device type, operating system version, app version, IP address, and diagnostic logs needed to maintain security, prevent abuse, and troubleshoot errors.

We use personal information for the following purposes:

• Creating, authenticating, and managing your account;
• Verifying your identity through our KYC review process;
• Receiving, routing, and coordinating emergency reports to authorized dispatch and responder personnel;
• Displaying incident status and response activity relevant to your reports;
• Improving reliability, security, and performance of the Services;
• Complying with legal obligations and responding to lawful requests;
• Communicating with you about your account, verification status, or critical service notices.

We do not sell your personal information. We do not use government ID images for advertising or unrelated profiling.

Where the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") applies, we process personal information based on one or more of the following:

• Consent — for example, when you agree to this policy, upload an ID photo, or enable location access;
• Contract — to provide the Services you request, including account registration and emergency reporting;
• Legitimate interest — to secure the platform, prevent fraud, and improve emergency coordination, balanced against your privacy rights;
• Vital interest or public interest — where processing is necessary to protect life, physical safety, or public safety in emergency-response contexts.

RESQ-Link requires manual review of government-issued identification before approving civilian accounts. This is not a credit check and we do not use third-party identity scoring services for KYC at this time.

What happens to your ID photo:

• Uploaded to Firebase Cloud Storage under a path restricted to your account and authorized administrators;
• Reviewed by trained super-admin personnel through the RESQ-Link admin console;
• Used solely to confirm that the registrant matches the submitted ID and is eligible to use civilian reporting features;
• Retained only as long as necessary for verification, account integrity, audit, and legal compliance, then deleted or anonymized in accordance with our retention schedule (see Section 9).

If you do not wish to provide a government ID, you cannot complete civilian registration. You may still contact local emergency services directly by telephone (for example, 911 in the Philippines where available).

We share personal information only as described below:

• Authorized emergency personnel — dispatch operators and verified responders who need incident and reporter contact details to respond to your reports;
• Service providers — infrastructure partners that host and operate the Services under contractual safeguards, including Google Firebase (authentication, database, storage, hosting), Mapbox (mapping), and Resend (transactional email). These providers process data on our instructions and may not use it for their own marketing;
• Institutional partners — St. Paul University Philippines and municipal stakeholders involved in operating or auditing the platform, subject to confidentiality and access controls;
• Legal and safety — when required by law, court order, or to protect the rights, safety, or property of users, responders, or the public.

We do not publicly publish your government ID images or sell personal data to data brokers.

Our cloud infrastructure may process and store information in data centers outside the Philippines (for example, United States or other regions used by Google Cloud/Firebase). Where required, we implement appropriate contractual and organizational safeguards consistent with the DPA and applicable cross-border transfer requirements.

We use industry-standard measures including encrypted transport (HTTPS/TLS), Firebase security rules, role-based access controls for admin consoles, and secure authentication. No method of transmission or storage is completely secure; we cannot guarantee absolute security, but we work to protect information against unauthorized access, alteration, disclosure, or destruction.

We retain personal information only as long as reasonably necessary for the purposes described in this policy, including:

• Account data — for the life of your account and a reasonable period after closure for audit and dispute resolution;
• KYC / ID images — for the verification period and thereafter as required for fraud prevention, legal compliance, or institutional audit (typically reviewed for deletion when no longer needed, unless retention is required by law);
• Emergency reports — for operational, safety, and historical response records as required by participating agencies and applicable regulations;
• Logs — for a limited period for security and diagnostics.

You may request deletion subject to Section 10 and applicable legal exceptions.

Under the DPA and our internal policies, you may have the right to:

• Be informed about how your personal data is processed;
• Access and obtain a copy of your personal data;
• Object to or restrict certain processing;
• Correct inaccurate or incomplete data;
• Withdraw consent where processing is consent-based (withdrawal may limit Service availability);
• Request erasure where applicable;
• File a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise these rights, contact us at [email protected]. We may need to verify your identity before fulfilling requests. We will respond within the timeframes required by applicable law.

The civilian mobile app may request the following device permissions:

• Location — to attach accurate coordinates to emergency reports and optionally fill your registration address;
• Camera — to photograph your government ID and incident-related images you choose to attach;
• Photo library — to select an existing photo of your government ID or incident images;
• Notifications (if enabled) — to alert you about report status updates.

You can change many permissions in your device settings. Denying required permissions may limit features.

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 without appropriate parental or guardian consent and legal authorization. If you believe a child has provided personal information without consent, contact us and we will take appropriate steps to delete it.

The Services may link to third-party websites or services (for example, map providers or institutional pages). We are not responsible for the privacy practices of those third parties. Review their policies before providing personal information.

We may update this Privacy Policy from time to time. We will post the revised policy on www.resq-link.com and update the effective date. Material changes may be communicated through the app or email where appropriate. Continued use after changes take effect constitutes acceptance of the updated policy.

For privacy questions, data subject requests, or concerns about identity verification:

RESQ-Link Privacy Office
Email: [email protected]
Web: www.resq-link.com/contact

Institutional development: St. Paul University Philippines — Institutional Innovations, Tuguegarao City, Philippines.