Privacy Policy

def scope_approach():

This privacy statement applies to all services, websites and products of Valleys & Bytes where this document is referenced. We process your personal data in a lawful, fair and minimised way — designed to protect your rights while delivering intelligent functionality.

I act as a data controller for the information collected from you. This policy is governed by the Philippines Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations. For questions or to exercise your rights, see the Contact section at the bottom of this page.

class DataCollection:

I collect only what is necessary for the purposes described. The categories below reflect our current data map — intelligent by design, not by excess.

def sensitive_data():

I do not request or process sensitive personal data (racial origin, political opinions, health, biometrics) unless you voluntarily provide it within a support ticket — in which case we ask you to avoid sharing it, and if received, we will delete or anonymise it within 7 days in accordance with RA 10173 Section 13.

class LegalBases:

Under the Philippines Data Privacy Act of 2012 and its Implementing Rules and Regulations, we rely on the following criteria for lawful processing:

• contract_performance: to deliver our services according to our Terms of Service.
• legitimate_interests: improve products, prevent fraud, maintain network security — always balanced with your rights and freedoms.
• consent: for optional cookies, marketing emails, or precise location. Withdraw at any time via the preference centre.
• legal_obligation: e.g. financial records, or responding to lawful requests from Philippine authorities.

def data_sharing():

I do not sell your personal data. We share only with trusted subprocessors under strict data processing agreements. Categories of recipients:

• Cloud infrastructure: AWS (Singapore & Sydney regions) — encrypted at rest and in transit.
• Customer support & communication: Zendesk, SendGrid — governed by NPC-aligned contractual frameworks.
• Professional advisors: legal counsel and auditors, where required, under confidentiality.
• Authorities: only if legally compelled under Philippine law (e.g. NPC, law enforcement), and we will notify you unless prohibited.

subprocessors = [...]

Full transparency: below is our current list of third-party subprocessors. All are bound by a Data Processing Agreement (DPA) and must meet our security and privacy standards. We update this list whenever a subprocessor is added or removed.

Last reviewed: 26 Feb 2026. To be notified of subprocessor changes, contact us via the Contact section.

class AIDecisionMaking:

I believe in explainable, human-supervised AI. This section details how automated processing and profiling operates within our platform — and where humans always remain in the loop.

class YourRights:

Under the Philippines Data Privacy Act of 2012 (RA 10173), you have the following rights as a data subject:

• ✅ right_to_be_informed — know how your data is collected, processed, and used.
• ✅ right_to_access — request a copy of personal data we hold about you.
• ✅ right_to_object — object to processing, including for direct marketing.
• ✅ right_to_erasure — have inaccurate, incomplete, or unlawfully processed data deleted.
• ✅ right_to_rectification — correct inaccurate or incomplete personal data.
• ✅ right_to_portability — receive a structured, machine-readable copy of your data.
• ✅ right_to_damages — claim compensation for any damage caused by inaccurate or unlawfully processed data.
• ✅ right_to_file_complaint — lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise your rights, use the contact details in the Contact section. We respond within 15 business days as required under RA 10173.

def response_timeline():

def cookies_tracker():

I use cookies and local storage to make our sites work, analyse traffic, and personalise content. You can manage your preferences using the panel below. Categories:

• Essential: authentication, security, load balancing — cannot be disabled.
• Functional: remember language and region preferences, optional.
• Analytics: aggregated, anonymised — self-hosted Plausible, no cross-site tracking.
• Marketing: only with explicit opt-in.

cookie_preferences.update()

def privacy_by_design():

Privacy is not an afterthought — it is baked into our engineering and organisational culture from day one. Below are the concrete technical and organisational measures (TOMs) we operate.

def breach_response_sla():

I operate a documented incident response plan. In the event of a personal data breach:

class SecurityProtocol:

I apply modern cryptographic controls (TLS 1.3, AES-256 at rest), regular access audits, and penetration tests. Our retention policy deletes or anonymises data when the purpose ends — unless Philippine law requires longer retention.

In the event of a notifiable breach, we will inform affected individuals and the NPC within 72 h as required by NPC Circular 16-03. See the Privacy by Design section above for the full SLA.

class PrivacySnapshot: # tl;dr

Too long to read right now? Here's the short version — tap any question to expand.

def children_privacy():

My services are not directed to individuals under 18 years of age. Under Philippine law, minors cannot give valid consent to data processing without parental or guardian authority. If we become aware that we have collected data from a minor without verifiable parental consent, we will delete it promptly — typically within 48 hours of discovery — and notify the NPC if required. Parents or guardians may contact us via the Contact section to request deletion.

def policy_updates():

I may revise this page to reflect legal or product changes. Material updates will be notified via email or prominent website notice at least 14 days before they take effect. The __version__ date at the top reflects the latest revision. We keep an archived changelog of past versions — request it from us via the Contact section.

class Contact:

If you have any concerns, wish to exercise your data subject rights, or need to speak with our Data Privacy Officer, reach out through any of the following channels. We aim to respond within 15 business days.