Privacy policy
Last updated 7 September 2026.
The short version
We collect what an order needs and very little else. We do not sell your data, we do not share it for advertising, and the only third parties involved are the ones that actually deliver the service — a database host, an email sender and a web host, all named below.
Who we are
jomarxStore is an online shop selling to customers in the Philippines, operating the site at jomarx.com.
To be completed: registered business name, address and any DTI or SEC registration number.
For any question about this policy or your data, email jomar@jomarx.com.
What we collect, and why
Placing an order
Your email address, phone number, and the delivery name and address you type. Without these an order cannot be delivered or its status told to you. We keep the order record as our business record of a sale.
Paying
Payment happens in GCash, outside this site. We never see your GCash credentials or account balance. If you choose to upload a payment screenshot, we store that image so we can match your transfer by hand. A GCash receipt often shows your name, mobile number and running balance, so those images are held in private storage that is not readable from the web, and are only ever opened by us through a short-lived link.
Messaging us about an order, or asking about a product
The message, your email address, and the name you give. For a pre-sales question we also send one confirmation email, and the question does not reach us at all until you confirm it — that is what stops the form being used to send mail to somebody else's address.
Reviews
Your display name and rating and review text, which are shown publicly on the product page. A review can only be left against a paid order containing that product.
Signing in (optional)
If you sign in with Google or an email link, we store your email address so that your orders can be shown to you. Guest checkout does not create an account.
IP addresses
Your IP address is recorded alongside a payment screenshot, an order message, and a product enquiry. It is kept as an abuse record — it is what lets us tell one person asking a question from a script sending thousands. It is also used briefly, in a rate-limit counter keyed by address, which is deleted once its time window has passed. It is never used to build a profile of you or shared for advertising.
Site analytics
We count page views ourselves, in our own database, to see which products people look at. This part deliberately stores no IP address and sets no cookie: a visitor is recorded as an irreversible hash of the address, the browser and the date, which changes every day, so the same person cannot be recognised tomorrow or identified at all. We also use Vercel Web Analytics, which is cookie-free and aggregate.
Cookies
There are no advertising or tracking cookies on this site. What we set:
- cart_token — remembers your basket for 30 days.
- last_order — lets the browser that placed an order see that order's page without signing in.
- A session cookie, only if you choose to sign in, to keep you signed in.
- A theme preference, stored in your browser and never sent to us.
Who else sees it
Only the companies that run the service. None of them are given your data for their own purposes:
- Supabase — the database and file storage holding orders, messages and payment screenshots.
- Vercel — hosts the site, and so handles the requests your browser makes.
- Resend — sends order and message emails to your address.
- Google — sign-in, if you use it, and a verification tag for AdSense that loads nothing and collects nothing.
- The courier you choose, which needs the delivery name, address and phone number to bring you the parcel.
Some of these store data outside the Philippines. We never sell your data, and we would only hand it to anyone else if the law required it.
How long we keep it
- Orders and their messages: kept as business records.
- Baskets that were never checked out: deleted automatically once they expire.
- Product questions that were never confirmed: deleted automatically, unread — nobody here ever saw them.
- Rate-limit counters: deleted once their window passes.
- Individual page views: folded into a daily total after 90 days, and the detail deleted.
Your rights
Under the Philippine Data Privacy Act of 2012 (RA 10173) you can ask what we hold about you, ask for it to be corrected, ask for it to be deleted, and object to how it is used. Email jomar@jomarx.com and we will answer.
Deleting an order record may not always be possible where we are required to keep it as a record of a sale — if so, we will say which part and why. You may also complain to the National Privacy Commission.
Children
This shop is not aimed at children, and we do not knowingly collect anything from anyone under 18. If you believe a child has given us information, email us and we will delete it.
Changes
If this policy changes, the date at the top changes with it. Substantial changes to what we collect will be said plainly here rather than buried.