Privacy Policy
Last updated: 20 September 2026
The short version. Kahlao is booking software for sports courts. A court's booking data belongs to that court, we hold it for them, we do not sell it, and we never show it to another court. Our website sets no cookies and runs no analytics. We have never asked anyone for a card number. If you want to know what we hold, or want it gone, email hello@kahlao.com and a real person will answer.
That is the whole policy in a paragraph. The rest is the detail.
Who we are
Kahlao is booking software for sports courts in the Philippines. This policy covers our website at kahlao.com, the booking pages we host for courts at book.kahlao.com, and the court management app at partners.kahlao.com.
For anything about your information (a question, a request, a complaint), email hello@kahlao.com or message us on Messenger. One inbox, real people, no ticket number.
The important part: whose data it is
Kahlao does two different jobs, and your rights depend on which one is in play.
A court's data is the court's. Everything a court puts into Kahlao (its clients, their contact details, their bookings, its prices, its takings) belongs to that court. Under the Data Privacy Act the court is the personal information controller and Kahlao is its personal information processor. We hold that data on the court's instructions and for nothing else. We do not mine it, we do not sell it, and we do not use one court's data to serve another.
Our own data is ours. A few things we decide about ourselves: who asked us for a demo, who the account holder at a court is, how our service is running. For those, Kahlao is the controller.
Why it matters in practice: if you are a player and you want a booking corrected or deleted, the court holds it: ask the court first, and we will help them do it. If they cannot be reached, come to us.
What Kahlao is not. Kahlao is not a marketplace. There is no Kahlao-wide directory of players, no account shared across venues, and no profile that follows you between courts. Book at two courts that both use Kahlao and that is two separate records at two separate businesses, with two separate passwords. Neither court can see the other. That is a design decision rather than a setting: the software has no way to join them.
If you visit kahlao.com
This website sets no cookies and runs no analytics. There is no tracking pixel, no advertising tag, no session recorder. We do not know you were here.
Every page but one also ships no JavaScript and loads nothing from anybody else. The exception is the demo form at kahlao.com/get-started, which needs a little JavaScript to send what you type and runs Google reCAPTCHA to keep spam out. What that means for you is set out below.
The site is served by Cloudflare, which keeps ordinary technical logs (IP address, what was requested, when) to keep the site up and stop abuse, as any web host does. We do not read those logs to work out who you are.
If you ask us for a demo
The demo form asks for your name, your email address, your mobile number, and one optional thing: a Facebook page or profile. That field invites your own profile where the court has no Page of its own, so it may point at you personally rather than at a business. It is optional for that reason, and leaving it blank costs you nothing.
The form is on kahlao.com, at /get-started/, and what you type goes straight to Kahlao's own server when you send it. It is not hosted by anyone else and nobody else holds it before we do.
That page runs Google reCAPTCHA to tell a real person from a bot, because a form anyone can post to is a form that fills up with rubbish. To score the request, Google receives it: your IP address, what your browser says about itself, and how you moved on the page. Google handles that under its own privacy policy. We get back a score and never the details behind it. reCAPTCHA runs on that one page and nowhere else on this website.
We use it to get in touch about a demo, and for nothing else. We do not add you to a marketing list you did not ask for, and we do not pass it to anyone else. Our lawful basis is your consent, given by sending the form.
We keep demo enquiries indefinitely, including from courts we never end up working with: a conversation that goes nowhere this year is often worth picking up in a few years' time. If you would rather we did not, say so and we will delete yours.
If you book a court
When you book at a court's Kahlao page, the court receives what it needs to hold the slot for you: your name, your mobile number, your email address, and the booking itself. Some courts also record a date of birth, a second contact number, or their own notes and tags about you. Those fields belong to the court and the court decides what goes in them.
If you create an account on a court's booking page, we also store a one-way hash of your password (we cannot read it and neither can the court), whether your email address has been verified, and when you last signed in. That account works at that one court, for the reason above.
We use this to show the court its bookings, show you yours, send you booking and account email, and let you sign back in. Our lawful bases are performing the booking you asked for, and our legitimate interest in running the service and keeping it secure.
Payments
Money never passes through Kahlao. Players pay the court directly: GCash, bank transfer, or cash at the counter. We do not hold your money and we take no cut of it.
We have never asked anyone for a card number. Kahlao stores no card details of any kind: not a full number, not the last four digits, not an expiry date. If someone asks you for card details "for Kahlao", it is not us. Should we ever add an online card processor, this page changes before it goes live.
What we do store is what the court needs to reconcile its takings: the amount, the method, when it was paid, and (if you upload one) the screenshot of your GCash or bank transfer as proof. That proof is shown to the court's staff and to nobody else. A court's own QR code and logo are published on its booking page, so those are public by design; your payment proof is not.
If you work at a court
An operator account holds your name, work email address, username, contact number, an optional profile picture, a one-way hash of your password, and when you last signed in. A separate record says which court you work for, which is what lets one person work at two.
Your employer's admin creates the account and sets the first password; you change it yourself afterwards. Your employer can see the account, edit it, and switch it off. It is a work account and it belongs to the business, so questions about it go to them first.
Cookies
Kahlao sets cookies to keep you signed in. That is the entire list:
- kahlao_session: on partners.kahlao.com, keeps a court's staff signed in.
- kahlao_customer_session_[court]: on book.kahlao.com, keeps you signed in at one court's booking page. One per court, deliberately.
Both are httpOnly, so no script can read them, restricted to same-site requests, and sent over HTTPS only. A session lasts an hour, or thirty days if you asked to be remembered. A password reset link expires after thirty minutes.
We set no advertising cookies, no analytics cookies, and no third-party cookies anywhere. There is no cookie banner because there is nothing to consent to.
Who else touches your information
We use a short list of suppliers to run the service. They process data for us, under contract, and for nothing of their own:
- Hetzner Cloud: the servers the application runs on.
- Supabase: the managed PostgreSQL database everything is stored in.
- Cloudflare: DNS and the network in front of our servers, object storage for uploaded logos, QR codes and payment proofs, and hosting for this website.
- Google Workspace: our email, including the booking and password-reset mail we send you.
- Google reCAPTCHA: the spam check on the demo form, and the only third party any page of this website contacts.
That is the list. We will update this page when it changes.
Beyond those, we share information only:
- with the court you booked with: that is the point of the product;
- when the law requires it: a court order, a lawful request from an authority, or a direction from the National Privacy Commission;
- to protect someone's safety, or to deal with fraud or abuse;
- with professional advisers who are under a duty of confidence; and
- if Kahlao is ever sold or merged, with the buyer, who takes on this policy with it. If that ever changes anything for you, we will tell you before it does.
We do not sell personal information. We do not share it with advertising networks. We do not hand one court's data to another.
Where your information is stored
Our suppliers run outside the Philippines, so your information is transferred to and stored on servers abroad. Under the Data Privacy Act we stay accountable for it wherever it sits, and we only use suppliers contractually bound to protect it to the standard the Act requires.
How we protect it
- Everything travels over HTTPS.
- Passwords (yours and a court's staff's) are stored as one-way bcrypt hashes. Nobody at Kahlao can read them; a reset is the only way back in.
- Session cookies cannot be read by scripts, and they expire.
- Every query is scoped to a single court. The separation between courts is enforced by the software rather than by policy, and it is tested.
- Uploaded files are stored under keys that cannot be guessed.
The honest limit: nothing on the internet is perfectly secure and we will not pretend otherwise. If we ever suffer a breach that puts you at real risk, we will tell you and notify the National Privacy Commission as the law requires.
How long we keep it
While a court's account is open we keep its data. Its bookings and takings are its business records and it needs them.
- Financial records (invoices, payments, receipts) may be kept longer than the rest where Philippine tax and accounting law requires it.
- Password reset tokens expire after thirty minutes and are then useless.
- Deleted data can survive for a short while in database backups before those backups roll off.
- Demo enquiries we keep indefinitely, as set out above, unless you ask us to delete yours.
Your rights
Under the Data Privacy Act of 2012 you have the right to:
- be told what we hold about you and why;
- get a copy of it;
- have it corrected when it is wrong;
- object to how it is being used;
- have it erased or blocked, where the law allows;
- have it handed to you in a portable form;
- complain, and to be compensated for damage caused by mishandling it.
To use any of them, email hello@kahlao.com. We will ask enough to be sure it is really you (we are not going to hand your booking history to someone who happens to know your name), and then answer as quickly as we can, and never more than fifteen working days.
Where the data is the court's rather than ours (your bookings, the notes a court keeps about you), we pass your request to that court and help them act on it. Where the decision is ours, we act ourselves.
Children
Courts run junior sessions, and we know it. A booking for a child should be made by a parent or guardian, whose details go on the booking. If you are under 18, ask a parent or guardian to book for you. If we learn we are holding a child's information without a guardian's consent, we will delete it.
Complaints
Tell us first: email hello@kahlao.com with "Privacy" in the subject line. We will acknowledge it within five working days and tell you what we have done about it.
If we do not fix it, you can complain to the National Privacy Commission at complaints@privacy.gov.ph or privacy.gov.ph.
Changes to this policy
We will post changes on this page and update the date at the top. If a change materially affects you, we will email account holders rather than leave it to you to notice.