Privacy Notice
This notice explains how Arki Codes (“we”) collects, uses, shares and protects your personal information, under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). We are the personal information controller for the data described here. Who runs Arki Codes and how to reach us is in section 10.
In short: we ask for what we need to run your account and payments, and nothing about your school, studies, work or licence. Emails about offers and location are optional, each with its own choice, and you can change them on your account page. Reading this notice is not the same as agreeing to everything in it: we ask for your consent separately, only where consent is the reason we process something.
1. What we collect, why, and for how long
| Information | Why | Lawful basis | Who can see it | How long |
|---|---|---|---|---|
| Email address and password (stored only as a secure hash). Required. | To create your account, let you sign in and send sign-in, reset and account emails. | Contract | You; staff (email only) | Until you delete your account. |
| Full name. Required. We ask for your real name but don't check it. | To identify your account in support and payment matters (for example, matching a payment message to your account). It greets you in the app and is not shown publicly. | Contract | You; staff | Until you delete your account. You can correct it anytime. |
| Mobile number. Optional. | Account recovery and questions about your payments. Never shared or sold. | Consent (you choose to give it, and can remove it anytime) | You; staff (viewers see only the last 4 digits) | Until you remove it or delete your account. |
| Province and city or municipality (chosen by you). Required. | Account records and support, and to see, in totals, where our users are. | Legitimate interest | You; staff | Until you delete your account. You can change it anytime. |
| Your privacy choices: when you accepted the Terms (which include being 18 or older), which Privacy Notice you were shown, and each optional consent you gave or withdrew (with its version, time and where you made it). | To respect your choices and show we asked properly. | Legal obligation (proof of consent); legitimate interest | You; staff | Until you delete your account. |
| Approximate location: country and region from your internet connection, on your profile and devices. Optional. | Account security, for example noticing sign-ins from two places at once. | Consent | You; staff | Until you turn it off (what was recorded is deleted then) or delete your account. |
| Devices: browser and device type (for example "Chrome on Android"), a random device id in a cookie, when each device was first and last used, and sharing alerts about your account. | To keep each account to one person on up to 2 devices: we warn you, and staff review, when an account is used on more devices (or, with location on, in two places at once). Nobody is blocked automatically. | Legitimate interest (account security, enforcing our Terms) | You (your devices); staff | Until you remove the device or delete your account. Devices unused for 30 days stop counting. |
| Study data: lesson and Test Hall progress, your answers and results, bookmarks, notes, timer sessions, to-dos, reminders and study plans. | To run the study app and keep your progress the same on each of your devices. | Contract | You. Our staff console doesn't show it; people with database administrator access could technically reach it, and we don't look at it except to fix a problem you report. | On our servers until you delete your account. The study app also keeps a copy in your browser (see section 6). |
| Passes and payments: plan, amount, dates, status, your AC- code, the transaction number on your receipt, any promo code, refund requests and our notes on them. | To give you access, check payments, handle refunds and keep the records tax law requires. | Contract; legal obligation | You; staff who handle payments (editors and up) | While your account exists. After you delete it: kept for 5 years after the end of the year of the payment, no longer linked to your account. |
| Payment messages: the receipt screenshot and details you send us on Facebook or TikTok (these may show your name, account number and amount). | To confirm your payment and, if you ask, return a refund to the account you paid from. | Contract | Staff who handle payments; the platform you message us on | In our inbox on that platform: deleted 90 days after the payment or refund is settled. The platforms keep their own copies under their own policies. |
| Usage: when you signed up and last visited, and your trial and pass dates. | To run your access and keep the Service working. | Contract; legitimate interest | You; staff | Until you delete your account. |
| After you delete your account: a one-way code made from your email address (not the address itself), and when the free trial and the mistaken-purchase refund were used. | So the free trial and that refund can be used only once per email address. | Legitimate interest (preventing abuse of the free trial) | No one through the app; only the database checks it | Kept for 2 years after the account is deleted. This code is still personal data: anyone who knows your email could make the same code and match it, so we protect it like the rest. |
| Early access list: your email and, if you give it, your name. | To email you once when Arki Codes opens. We send nothing else and don't share or sell the list. | Consent | Our admins and the owner | Deleted within 30 days after the launch email, or earlier when you ask us or delete an account with the same email. |
| Staff actions on your account (for example viewing your record, adding days, confirming a payment or refund), with the staff member and any note. | Accountability: every staff view of one account and every change is logged. | Legitimate interest; legal obligation (security of processing) | Our admins and the owner | Kept for 5 years. Kept after you delete your account, linked only to its account number; your email is removed from entries you made yourself. |
| Security counters: a code made from your IP address and email when you sign in, sign up or ask for a code. | To slow down repeated attempts and stop abuse. | Legitimate interest | No one through the app | Up to about a day. |
We never ask for your card number, PIN, one-time codes or e-wallet password. We don't ask for government IDs, student ID numbers, selfies or other identity documents. Please don't send us such information. We don't use your information for automated decisions with legal or similarly significant effects on you, and we don't build profiles for advertising.
2. Sensitive personal information
We don't collect sensitive personal information. The law counts, for example, your education (school, year level and the like), a government licence (such as being a licensed architect), your health, religion or government ID numbers as sensitive; we don't ask for any of these. Please don't put them in your name or other fields.
Earlier versions of our sign-up and early-access forms asked, optionally, whether you study or work. We have stopped asking, and we delete those earlier answers, on accounts, in sign-up records and on the early-access list, when this version of the notice takes effect.
3. Your choices, and withdrawing consent
- Your age and the Terms of Service: confirming you are 18 or older and accepting the Terms are needed to have an account. This notice: we ask you to confirm you have read it; that confirmation is not consent.
- Study tips and offers by email and approximate location: each is a separate, optional consent, unticked until you tick it.
- Withdraw either anytime on your account page by unticking the box and saving; it is as quick as giving it. Withdrawing location deletes the recorded locations; withdrawing emails stops them. The rest of the app keeps working. Processing done before you withdrew stays lawful.
4. Who can see it
Inside Arki Codes, staff see only what their role needs, every staff member signs in with an authenticator code, and every view of one person's account and every change is recorded. Staff are bound by confidentiality. Viewers see contact numbers only partly; editors also handle payments and devices; admins and the owner can also see the early-access list.
We use these service providers (personal information processors), only for the purposes listed:
- Supabase: accounts, sign-in, sign-in emails and the database (Singapore (AWS ap-southeast-1), as set up for this project)
- Netlify: hosting the website (United States, served worldwide)
- Meta (Facebook) and TikTok: messages you send us about a payment or refund, under their own privacy policies (outside the Philippines)
These providers store or handle data outside the Philippines. We remain responsible for your information when they process it for us. We never sell your personal information. We may disclose information when required by law, court order or a government authority, or to protect the rights and safety of users and the public.
5. How we protect it
Encrypted connections (HTTPS); passwords stored only as hashes; database rules that let each person read only their own records; an authenticator code for all staff; limits on repeated sign-in attempts; and logs of staff access. Payments go from your own bank or e-wallet app straight to ours; we never see your login details. No system is perfectly secure. If a breach involving your personal information is likely to cause you real harm, we will notify you and the NPC as the law requires (within 72 hours of knowing about it).
6. On your device
The study app keeps your progress, notes and plans in your browser too, so it works offline, and syncs them to your account. Its own “Your name” and “You in the 3D models” (height and figure) settings stay only in your browser and are never sent to us. When you sign out, the study app locks and its copy is set aside in the browser; deleting your account removes it from the browser you delete it in. On other devices, clear the site's data in the browser to remove it. Cookies and similar storage are listed on our Cookies page.
7. Your rights
Under the Data Privacy Act you have the right to:
- be informed about how your data is processed (this notice);
- access your data: download a copy anytime from your account page (profile, choices, consent records, payments, devices and synced study data);
- object to processing based on legitimate interest, and withdraw consent (section 3);
- correct it: edit your profile on your account page;
- erase or block it: delete your account on your account page, or ask us; section 1 says what is kept after that and why;
- data portability: your download is in a common, machine-readable format (JSON);
- damages, and to file a complaint with the National Privacy Commission (privacy.gov.ph).
Your lawful heirs and assigns may exercise these rights if you pass away or can't act yourself. Some data may be kept where the law requires it (section 1). For anything you can't do from your account page, contact us (section 10).
8. People under 18
Arki Codes is only for people 18 years old or older. We ask you to confirm your age when you sign up, join the early-access list, and whenever our Terms change; without that confirmation no account is opened and nothing is added to the list. We don't check IDs. If we learn that an account or early-access entry belongs to someone under 18, we delete it. If you believe this has happened, contact us (section 10).
9. Changes to this notice
Every version has a number and date (above). If a change matters to how your information is used (new kinds of information, new purposes or new recipients), we show you the updated notice before you continue. If it changes an optional purpose you consented to, we ask for your consent again, and until you give it we treat it as not given. Small edits that change nothing about your information (wording, typos, contact details) don't interrupt you.
10. Contact us
Arki Codes is run by Arki Codes Online Streaming Service, Bagumbayan, Taguig City, Metro Manila, Philippines. Data Protection Officer: arkicodes@gmail.com. We aim to answer privacy requests within 15 working days.