Privacy Policy

Changes in Version 1.4

This version adds a mobile-applications framework covering our Android and iOS apps, and makes the payment, sub-processor, retention, and rights language model-agnostic so it applies to free, paid, and in-app-purchase apps:

• Extended the policy scope to mobile applications distributed through the Google Play Store and Apple App Store (Section 1).
• Added a Mobile Applications section describing on-device data, permissions, purchases and entitlements, accounts, notifications, diagnostics, and app-store platform processing (Section 2.7).
• Added processing purposes for operating mobile apps and processing in-app purchases and entitlements (Section 3).
• Added mobile purchase/entitlement retention and the mobile deletion path (Section 8), rights guidance for device-local and store-processed data (Section 10), and a mobile no-cookies statement (Section 11).
• Added Google Play and Apple App Store as mobile platform providers, used only where an app is distributed through them or offers paid features (Section 7).
• Added Schedule A — Mobile Applications, a per-app listing of data practices, permissions, and monetization (currently Capydoro: free, no account, device-local only). New apps are added before their public release.

1. Overview

ObraHaus IT Solutions ("ObraHaus," "we," "us," "our") respects your privacy and is committed to protecting your personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) and the issuances of the National Privacy Commission (NPC).

As a Personal Information Controller (PIC) under the DPA, we are responsible for ensuring that all personal data under our custody is processed lawfully, fairly, and with due respect to your rights.

This policy applies to all visitors of obrahaus.com, clients of ObraHaus custom engagements, users of any SaaS product developed and operated by ObraHaus, and users of any mobile application developed and operated by ObraHaus for Android or iOS. Because our apps differ — some are fully on-device and free, others may be paid or offer in-app purchases — the specific data practices for each app are listed in Schedule A — Mobile Applications at the end of this policy.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you voluntarily provide when you contact us, submit a project brief, register for an account, or subscribe to a product. This may include your name, email address, and any details you include in your project brief or communications with us. When you register for an account, you may also optionally add a mobile phone number to your profile, which we use for account-related notifications and, where you opt in, SMS features. When you submit an inquiry or contact form, we may also collect optional fields such as company name and job title to better understand your needs. We collect only what is necessary and proportionate for the declared purpose, consistent with Section 11 of the DPA.

2.2 Information Collected Automatically

When you visit obrahaus.com or use any ObraHaus product, we automatically collect technical information including your IP address, the full HTTP user-agent string sent by your client (which contains your browser type and version and your operating system), pages visited, and the date and time of your visit. This information is recorded in our system and audit logs and is used to maintain the security and integrity of our services, to troubleshoot issues, and to improve our products. It is not used to identify you personally unless combined with other data. In accordance with NPC Advisory Opinion No. 2017-063, information such as IP addresses, when combined with other data, may constitute personal information and will be treated accordingly. Mobile apps that operate fully on-device and make no network requests do not transmit this information to us; see Section 2.7 and Schedule A.

2.3 Payment Information

ObraHaus does not store payment card information directly. All payment transactions are processed through trusted third-party payment providers. We retain transaction records such as amounts, dates, and invoice references solely for accounting, legal, and regulatory compliance purposes.

Payments for web subscriptions are processed by PayMongo (PayMongo Philippines, Inc. and PayMongo Payments, Inc.), a Philippine payment processor licensed and regulated by the Bangko Sentral ng Pilipinas and registered with the National Privacy Commission. Payment card details are entered directly into PayMongo's PCI-DSS Level 1 certified, tokenized environment; ObraHaus does not collect, receive, or store your full card number, expiry, or CVV. PayMongo processes data primarily within the Philippines; card transactions may be routed through international card networks (for example, Visa and Mastercard). PayMongo's handling of your data is further governed by its own Privacy Policy at paymongo.com/privacy.

Purchases made inside a mobile application — a paid download, in-app purchase, or subscription — are processed by the app store you use (Google Play or the Apple App Store), which acts as the merchant of record. ObraHaus does not receive your card number for those purchases. See Section 2.7.

2.4 Information From Third Parties

In some cases, we may receive information about you from third-party platforms or services used in the course of delivering a project or operating a product. Such information is handled with the same care and in accordance with the same principles as information collected directly from you. For mobile apps, this includes aggregate developer statistics provided by Google Play Console or App Store Connect (for example, install counts and platform-reported crashes), which do not identify you.

2.5 Discord Account Verification (Optional)

If you choose to verify or link your account through our Discord verification bot, we collect your Discord user ID, and your Discord username where available, as part of the verification process. This data is exchanged with Discord in accordance with Discord's own Terms of Service and Privacy Policy. Your Discord identifiers are stored on your ObraHaus profile and are used solely for identity verification, account linking, and granting the corresponding community roles within our applications. You may unlink your Discord account at any time from your account settings, which removes the stored Discord identifiers.

2.6 Usage and Metering Data

For products that use metered features — such as AI-assisted functionality or SMS — we keep per-user usage records and a credit balance tied to your account. These records include the feature used, the model or service invoked, the credits and corresponding cost consumed, and timestamps. We use them to operate the feature, enforce per-tier usage limits and fair-use caps, prevent abuse, and bill paid usage. We do not retain the content of your AI prompts, or the recipient and content of your SMS messages, in these usage records; that content is transmitted to the relevant sub-processor (see Section 7) only as needed to fulfil your request.

2.7 Mobile Applications

ObraHaus develops and operates mobile applications for Android and iOS. This section describes the data practices that may apply to those apps. The per-app specifics — what each app collects, which permissions it requests, and how it is monetized — are listed in Schedule A at the end of this policy.

• On-device data. Unless an app's schedule states otherwise, the content you create in an app (for example timer sessions, tasks, statistics, and preferences) is stored only on your device. We do not receive a copy. Uninstalling the app or clearing its data deletes it from the device, and any export or backup is initiated by you and saved where you choose. Your device's operating-system backup or device-transfer features may keep their own copies of app data; you control those features in your device settings.
• Permissions. Apps request only the device permissions their features need (for example notifications, exact alarms, or vibration). Permissions are used for on-device functionality only; they are not used to collect or share personal data. Schedule A lists each app's permissions and their purposes.
• Purchases and entitlements. If an app is paid, or offers in-app purchases or subscriptions, the transaction is processed by the app store (Google Play or the Apple App Store) as merchant of record, and we never receive your card number. To provide the purchased features, we or the store process entitlement records such as the product purchased, its status, renewal state, and store transaction identifiers. Where a backend validates a purchase, those records are linked to your account (if the app has accounts) or to a pseudonymous installation identifier.
• Accounts. Some apps may offer optional accounts. If an app supports accounts, the account and profile data described in Sections 2.1–2.6 apply to the extent relevant, and you can delete your account in the app.
• Notifications. Apps that send server-driven push notifications process a device push token for that purpose. Apps whose notifications are generated locally on your device — such as a timer alarm — use no push token and send us nothing.
• Diagnostics and analytics. By default, our mobile apps contain no advertising, analytics, or crash-reporting SDKs. If an app enables one, it is described in Schedule A, and we update this policy before the release that includes it.
• Updates. We deliver app updates through new store releases; our apps do not fetch over-the-air updates from our or a third party's servers in normal operation. If we ever enable over-the-air updates, that introduces server contact (including IP and device metadata), and we will update this policy and the app's schedule before enabling it.
• Platform providers. Google and Apple process store-account, download/install, and purchase data for apps distributed through their stores, under their own terms and privacy policies (Section 7).
• Monetization changes. If an app that is currently free adds paid features, in-app purchases, a subscription, or a data-collecting SDK, we will update this policy and the app's schedule, and the corresponding store disclosures, before that change ships.

3. How We Use Your Information

ObraHaus processes personal data only when there is a lawful basis for doing so under Section 12 of the DPA. We use your personal data to:

• Respond to inquiries and communicate with prospective and active clients
• Deliver, operate, and improve our services and SaaS products
• Operate our mobile applications, including on-device functionality and any paid features
• Process payments and manage billing, including validating in-app purchases and managing subscriptions
• Operate metered features (such as AI assistance and SMS) and enforce per-tier usage limits and fair-use caps
• Send project-related updates, invoices, and service notifications
• Maintain the security and integrity of our systems
• Comply with applicable legal and regulatory obligations

Processing is limited to what is adequate, relevant, suitable, necessary, and not excessive in relation to each declared purpose, consistent with Section 11(c) of the DPA. ObraHaus does not currently use your information for advertising purposes and does not sell your data to any third party; any future data-collecting feature or SDK is added only after this policy is updated (Section 2.7).

4. Legal Basis for Processing

We process personal data on one or more of the following lawful bases:

• Contractual necessity — processing required to fulfill a project agreement, service contract, or provide access to a SaaS product or mobile app, including delivering purchased features (Section 12(b), DPA)
• Legitimate interest — processing necessary for the ordinary and lawful operation of the studio, including security, fraud prevention, and service improvement, subject to the balancing test under NPC Circular No. 2023-07 (Section 12(f), DPA)
• Legal obligation — processing required to comply with Philippine laws and regulations (Section 12(c), DPA)
• Consent — where you have freely, specifically, and informedly agreed to a particular use of your personal data (Section 12(a), DPA), consistent with NPC Circular No. 2023-04

Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out prior to such withdrawal.

5. Data Sharing and Disclosure

ObraHaus does not sell, rent, or trade personal information to any third party. We may disclose personal data only in the following limited circumstances:

• Service providers — trusted third-party processors (hosting providers, payment processors, communication tools, app-store platform providers, and identity-verification services such as Discord) who assist in delivering our services. Any such disclosure is governed by contractual arrangements requiring compliance with applicable data privacy obligations. The specific sub-processors we rely on are listed in Section 7.
• Legal compliance — when required by law, court order, regulation, or lawful instruction of a government authority
• Protection of rights — when necessary for the establishment, exercise, or defense of legal claims, consistent with Section 13(f) of the DPA and NPC Advisory No. 2024-02
• Business continuity — in the event of a merger, acquisition, or transfer of assets, personal data may be transferred as part of that process, with prior notice to affected data subjects

6. Cross-Border Data Transfers

ObraHaus uses third-party hosting and service providers that may process personal data outside the Philippines. By using our services, you acknowledge that your data may be transferred to and processed in jurisdictions outside the Philippines. We ensure that appropriate safeguards are in place when transferring personal data internationally, including contractual obligations with our service providers to maintain data protection standards consistent with the DPA and NPC Circular No. 2020-03 on Data Sharing Agreements. In particular, when you use AI-assisted or SMS features, the content of your request is transmitted to service providers located outside the Philippines to fulfil it (see Section 7). Where an app is distributed through Google Play or the Apple App Store, or offers in-app purchases, Google or Apple may process store-account and purchase data in the United States and other jurisdictions under their own terms.

7. Sub-Processors and Service Providers

We rely on the following sub-processors to operate our services. Each is engaged under terms requiring it to process personal data only on our instructions and to apply protections consistent with the Data Privacy Act of 2012 and NPC issuances.

Mobile platform providers — independent third parties, not sub-processors. Where an app is distributed through a store, or offers store-billed purchases, the store processes platform data under its own terms and privacy policy, as an independent provider — it does not act on our instructions, and for purchases it is the merchant of record:

If a future mobile app adopts a third-party entitlement manager (for example RevenueCat), it will be added to the sub-processor table above before the app's public release. Capydoro (Schedule A) transmits no personal data to any sub-processor, and Google's role for Capydoro is limited to store distribution (platform provider, not a sub-processor).

This list reflects our current sub-processors and may change as our services evolve. Material changes will be reflected in an updated version of this policy. You may request further detail about any sub-processor, including the safeguards applied to cross-border transfers, by contacting hello@obrahaus.com.

8. Data Retention

We retain personal data only as long as necessary for the declared purpose:

• Prospective client inquiries — retained for the duration of pre-engagement communications and securely disposed of if no project agreement is reached within a reasonable period.
• Active client engagement data — retained for the duration of the project and for a minimum of three (3) years following completion, in line with applicable prescription periods under Philippine law, unless a longer period is required.
• SaaS user data — retained for the duration of the active subscription. Upon cancellation, data is retained for thirty (30) calendar days to allow for retrieval requests, after which it is securely disposed of unless the user requests earlier deletion.
• Mobile app data stored on your device — ObraHaus holds no copy. It is deleted from the device when you uninstall the app or clear its data; your device's own OS backup/transfer features may keep separate copies that you control, and export/backup files are user-initiated and remain wherever you save them.
• Mobile purchase and entitlement records — retained for as long as needed to provide the purchased feature and to meet tax, accounting, and regulatory requirements. Where a purchase is validated by a backend and linked to an account, the entitlement follows the account retention rules, while the underlying transaction records are kept for the statutory tax and accounting period even after the account is deleted; account-free, pseudonymous validation records are deleted once the entitlement no longer needs verification.
• Billing and transaction records — retained for the period required by applicable tax, accounting, and regulatory obligations (including BIR requirements).

We do not retain personal data beyond what is reasonably necessary. Once the purpose has been fulfilled and no legal, regulatory, or contractual obligation requires continued storage, personal data is securely disposed of or anonymized. Data subjects may request deletion prior to the expiration of the retention period, subject to any overriding legal obligations, by contacting hello@obrahaus.com.

9. Data Security

As a sole proprietorship, access to personal data is restricted to the business owner and authorized service providers. We implement appropriate technical and organizational measures to protect personal data, including:

• Encrypting personal data in transit and at rest using industry-standard methods (AES-256)
• Restricting access to systems containing personal data through secure authentication
• Maintaining up-to-date firewall protection, security patches, and malware protection
• Storing data in secured cloud environments with appropriate access restrictions

Security measures are reviewed periodically and updated as needed. In the event of a personal data breach, we will take prompt responsive action and, where required by law or NPC regulations, notify affected data subjects and the National Privacy Commission within 72 hours, in accordance with NPC Circular 16-03 on Personal Data Breach Management.

Data privacy inquiries may be directed to hello@obrahaus.com.

10. Your Rights as a Data Subject

Under the Data Privacy Act of 2012 and NPC Advisory No. 2021-01, you are entitled to the following rights:

• Right to be informed — to be notified of the nature, purpose, and extent of processing of your personal data before or at the time of collection
• Right to access — to obtain a copy of your personal data being processed, upon written request
• Right to rectification — to have inaccurate or incomplete personal data corrected within a reasonable period
• Right to erasure or blocking — to request the blocking or removal of your personal data where processing is unlawful or the data is no longer necessary, subject to applicable legal exceptions
• Right to object — to object to processing based on consent or legitimate interest, including processing for direct marketing or profiling
• Right to data portability — to obtain your personal data in a structured, commonly used, and electronic format
• Right to damages — to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data

We will not charge any fee for processing rights requests, except for reasonable fees for providing copies. Valid requests will be acted upon within thirty (30) working days from receipt, subject to a fifteen (15) working day extension if necessary.

To exercise any of these rights, submit your written request to hello@obrahaus.com. We may verify your identity before acting on your request. Account holders may also exercise the rights to access, data portability, and erasure directly from their account settings where self-service tools are provided. For data a mobile app stores only on your device, you exercise these rights directly in the app or by uninstalling it — we hold no copy to act on. For purchases made through an app store, the store provides your receipts and handles refund requests under its own policies.

11. Cookies and Tracking

We may use cookies and similar tracking technologies on our website and web products to maintain session state, improve user experience, and gather aggregate usage data. In accordance with NPC Advisory Opinion No. 2017-063, cookies that can be combined with other data to identify an individual will be treated as personal information. You may control cookie preferences through your browser settings; disabling cookies may affect certain features.

For aggregate site and product analytics we use Umami, a privacy-friendly analytics tool hosted on our own infrastructure; it does not share data with third-party advertising networks. We do not use cookies for advertising or cross-site tracking purposes and do not sell or share cookie-derived data with third parties.

Our mobile applications do not use cookies or browser storage, and by default contain no advertising, analytics, or crash-reporting SDKs. If an app ever enables an SDK that stores or reads data on your device, we will disclose it in that app's schedule in Schedule A and update this policy before the release that includes it.

For a detailed list of the specific cookies we use, their purposes, durations, and how to control them, see our Cookie Policy.

12. Children's Privacy

Our services are not directed at children. We do not knowingly collect personal data from anyone under the age of 18. Mobile apps are rated for general audiences in their store listings and are not directed at children. If we become aware that personal data has been inadvertently collected from a child, we will take prompt action to delete such data. To report such concerns, contact us at hello@obrahaus.com.

13. National Privacy Commission Registration

ObraHaus will register with the National Privacy Commission in accordance with applicable requirements as its data processing operations scale. Registration status and relevant details will be reflected here once completed.

14. Automated Decision-Making and Profiling

ObraHaus currently does not engage in automated decision-making or profiling that produces legal effects concerning data subjects. Should this change, we will update this policy and provide appropriate notice in accordance with the DPA and NPC issuances.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law and NPC issuances. We will notify affected clients and users of material changes via email or in-product notice before such changes take effect, consistent with the right to be informed under the DPA and NPC Advisory No. 2021-01. Continued use of our services following such notice constitutes acceptance of the updated policy. The most current version is always available at obrahaus.com.

16. Complaints and the NPC

If you believe that ObraHaus has violated your data privacy rights, you may file a complaint with the National Privacy Commission through its official channels at privacy.gov.ph. You are encouraged to first reach out to us directly so we may address your concern promptly.

Schedule A — Mobile Applications

This schedule forms part of the Privacy Policy. Add a row and a permissions table for each new app before its public release. The information here must match the app's Google Play Data Safety / Apple App Privacy answers and the privacy text shown in the app.

Capydoro — Android permissions

Deletion: uninstall the app or use Android's "Clear data" — this deletes everything ObraHaus-related on the device. Your device's own OS backup/transfer features may keep separate copies that you control, and export/backup files are user-initiated and stay wherever you save them; ObraHaus holds no copy.

Payments: none — Capydoro v1 is free. If paid features are added later, this schedule and Section 2.7 will be updated before release, and Google Play or Apple would act as merchant of record.