Privacy Policy

VisitGenSan.com respects the privacy of our visitors. This Privacy Policy describes the limited information processed by the website as it operates today, including its Contact Us form, guide reactions, search, Cloudflare infrastructure, Google services, and embedded Google Maps.

VisitGenSan.com does not currently use analytics or advertising tracking systems. The specific data flows that do exist are explained below.

1. Information Processed When You Use the Website

Most VisitGenSan pages can be viewed without providing your name, email address, or other contact information. Normal technical request information is processed by Cloudflare when it delivers the website, and additional limited information is processed when you use search, visit a reaction-enabled guide, load an embedded map, or voluntarily submit the Contact Us form.

Depending on the feature, this information can include a requested page or URL, a search term included in the VisitGenSan URL, a random reaction identifier, a guide-page name, a selected reaction, normal browser request information, or a name, email address, subject, and message you choose to submit.

2. Information You Choose to Send Through Contact Us

When you submit the Contact Us form, you voluntarily provide your name, email address, subject, and message. VisitGenSan uses this information to review and respond to questions, corrections, business or listing inquiries, privacy requests, suggestions, and other messages.

The form sends this information to the same-origin /api/contact endpoint. The browser does not receive or contact the private recipient email address or the server-to-server delivery endpoint.

VisitGenSan does not store contact names, visitor email addresses, subjects, or message contents in Cloudflare D1. Validated messages are forwarded as described in Sections 5 and 7 and are retained according to the applicable Google account and operational practices described in Section 10.

3. Guide Reactions

Four VisitGenSan guide pages contain reaction buttons. When a reaction-enabled guide loads, the website creates or reads a random browser identifier, stores it in localStorage, and automatically sends the identifier and guide-page name to the same-origin /api/reactions endpoint. This allows the page to display shared totals and determine whether that browser has already reacted.

The reactions service stores a hashed version of the browser identifier. If a visitor submits a reaction, Cloudflare D1 stores the guide-page name, selected reaction, hashed identifier, and timestamps.

During reaction submission, the Pages Function also uses the request IP address and browser User-Agent with the hashed browser identifier to create a separate hashed rate-limit key. VisitGenSan does not store the raw IP address or raw User-Agent in the reaction database.

This processing is used to display shared reaction counts, determine whether a browser has already reacted, prevent duplicate reactions, apply rate limits, and prevent abuse. It is not used for advertising, cross-site tracking, or visitor profiling.

4. Browser Storage and Cookies

VisitGenSan’s own code does not currently set or read first-party cookies. VisitGenSan features do not rely on first-party cookies.

The guide reaction feature uses localStorage to keep a random reaction visitor identifier and the selected reaction for supported guide pages. These values currently remain until they are cleared by the visitor, browser policy, or site code.

Cloudflare Turnstile, Cloudflare infrastructure, or Google Maps may process cookies or similar technologies according to their own systems and policies. Those technologies are separate from VisitGenSan’s own code.

5. Cloudflare Hosting and Infrastructure

VisitGenSan is hosted and delivered through Cloudflare. The website uses Cloudflare Pages, Cloudflare Pages Functions for /api/reactions and /api/contact, and Cloudflare D1.

To deliver and secure the website, Cloudflare may process normal technical request information such as an IP address, requested URL and query string, date and time, HTTP headers, browser User-Agent, referrer when supplied, and transport or security information.

For Contact Us submissions, Cloudflare processes the request through a Pages Function and verifies a Cloudflare Turnstile anti-bot token. The Function also uses the request IP address with a private server-side key to create a keyed hash for rate limiting and duplicate-submission protection. VisitGenSan does not store the raw IP address for this contact feature.

Cloudflare D1 stores only temporary keyed abuse-control records for Contact Us, including a keyed identifier, rate-limit or duplicate-record type, counters, window timestamps, and expiry timestamps. These records do not contain the visitor’s name, email address, subject, message, raw IP address, Turnstile token, or email recipient. They expire within no more than 24 hours and expired records are automatically removed during later contact requests.

Cloudflare may also provide infrastructure-level functions such as Network Error Logging and email-address protection. These are hosting, anti-abuse, security, and delivery functions; VisitGenSan does not use them as website audience analytics.

6. Search

VisitGenSan search runs in the visitor’s browser and searches same-origin VisitGenSan JSON data files. The search query is not sent to an external search provider.

The query appears in the VisitGenSan search-page URL in the form search.html?q=.... Because it is part of the requested URL, Cloudflare processes it when delivering the search page.

7. Google Services, Maps, and External Services

After a Contact Us submission passes validation and anti-abuse checks, the Cloudflare Pages Function forwards the name, visitor email address, subject, and message server-to-server to a secured Google Apps Script endpoint. Google Apps Script delivers the message to the VisitGenSan owner’s Google or Gmail account. Google therefore processes the contact message as the script, delivery, and mail provider. The private recipient address is not published on the website.

Some VisitGenSan pages contain embedded Google Maps. A map may load automatically as a visitor scrolls near it. When an embedded map loads, Google may receive normal browser request information such as an IP address, browser information, and referrer. Google may also use cookies or other technologies according to Google’s own policies.

VisitGenSan also links to hotels, restaurants, attractions, tourism businesses, social media pages, booking services, maps, and other external websites. When a visitor follows one of these links, the destination service’s privacy practices apply. VisitGenSan does not control the destination’s content, cookies, security, or data processing.

8. Business Listings and Public Information

VisitGenSan may publish information about hotels, restaurants, attractions, tourism businesses, destinations, events, and other travel information related to General Santos City and surrounding areas.

Information may come from publicly available sources, official business information, direct communication with an establishment, or voluntary submissions. Businesses or individuals who want to propose a listing, correction, or update may use the Contact Us page. VisitGenSan may reply with instructions for sharing any photos or supporting material that the contact form does not accept.

9. Analytics and Advertising

VisitGenSan does not currently use Google Analytics, Google Tag Manager, Google AdSense, Meta or Facebook Pixel, Microsoft Clarity, Hotjar, Cloudflare Web Analytics, or comparable analytics or advertising tracking systems.

Cloudflare Turnstile is used for contact-form security and abuse prevention. It is not used by VisitGenSan for advertising or audience analytics.

If analytics or advertising services are enabled in the future, this Privacy Policy will be updated to describe them and the Last Updated date will be changed.

10. Data Retention and Security

Reaction and reaction rate-limit records in Cloudflare D1 currently do not have an automatic deletion schedule. Contact-form message contents and contact fields are not stored in D1. Temporary contact abuse-control records expire within no more than 24 hours and are opportunistically deleted during contact requests after expiry.

Contact messages delivered through Google Apps Script and Gmail may be retained according to operational needs and the applicable Google-account practices. Cloudflare and Google may retain operational, security, delivery, or service records according to their own policies.

The reaction database uses hashed identifiers as described above rather than storing the raw reaction browser identifier, IP address, or User-Agent. The contact abuse controls use a private-keyed hash rather than storing the raw contact-request IP address. However, no website, internet transmission, or electronic storage system can be guaranteed to be completely secure.

11. Children’s Privacy

VisitGenSan is a general tourism and travel-information website and is not specifically directed toward children.

VisitGenSan does not knowingly seek child-specific personal information. If you believe a child has provided personal information through Contact Us, please contact VisitGenSan so the matter can be reviewed.

12. Your Privacy Rights and Choices

Subject to applicable law, you may use the Contact Us page regarding personal information you voluntarily provided and request:

• Access to information concerning you
• Correction of inaccurate information
• Deletion or blocking where applicable
• Objection to certain processing where applicable
• Other data-subject rights available under applicable law

Whether and how a request can be fulfilled depends on the information involved, applicable law, and any valid legal or operational requirements. VisitGenSan does not promise that every request will result in disclosure, deletion, or another requested action.

You also have the following practical choices:

• You may clear VisitGenSan localStorage through your browser to remove the browser-side reaction identifier and saved reaction preferences. Clearing browser storage does not automatically delete an existing server-side reaction record.
• You may manage third-party cookies and privacy settings through your browser or the controls offered by Cloudflare, Google, your email provider, or another relevant service.

You may also raise privacy concerns with the appropriate data-protection authority, including the Philippine National Privacy Commission where applicable.

VisitGenSan does not currently provide an automated privacy dashboard or automated deletion system.

13. Contact Us

For privacy questions, concerns, or requests relating to information you voluntarily submitted, please use the Contact Us page.