Privacy Notice
This notice explains what personal data WEdodemy collects when you reserve a seat, why we collect it, who else handles it, and what you can ask us to do with it. It is written to comply with the Philippine Data Privacy Act of 2012 (RA 10173).
Who is responsible for your data
WEdothetalk Inc. is the Personal Information Controller. We operate WEdodemy, the Digital Services Academy of WEdothetalk Inc.
- Registered address
- [TO CONFIRM: registered business address]
- SEC registration
- [TO CONFIRM: SEC registration number]
- Data Protection Officer
- [TO CONFIRM: Data Protection Officer name]
- Contact for data requests
- [TO CONFIRM: Data Protection Officer email]
What we collect
We collect only what the registration and sign-in flow needs to work.
| Data | Why we need it |
|---|---|
| Full name | To address you correctly in emails and in your account |
| Email address | It is your account. We send your sign-in code to it |
| Password | Sent once by email when your account is created, then stored only as a one-way scrypt hash, never in readable form. |
| Mobile number | Program announcements and support if email fails |
| Consent record | The date and time you agreed, so we can show a lawful basis |
| Sign-in activity | When you last signed in, to keep your session valid and spot abuse |
| Device and network signals | Your browser identifier and a one-way keyed hash of your IP address, used to rate-limit abuse |
| Email delivery records | Whether a message to you was delivered or failed, so we can fix it |
We do not collect payment details, government identifiers, or any of the sensitive personal information categories defined in RA 10173. Your password is stored only as a one-way hash. We cannot read it, and neither can anyone who obtains a copy of our database.
Why we are allowed to process it
For sign-in codes and running your account, our basis is the performance of our service to you — you cannot have an account without an email address to sign in with. For program announcements and learning updates, our basis is your consent, given by ticking the box on the registration form. You can withdraw that consent at any time without losing access to your account.
Who else handles it
We use three service providers to run the platform. They process data on our instructions only, and they do not sell it or use it for their own purposes. All three operate outside the Philippines, so your data is transferred abroad — RA 10173 requires us to tell you that, and it does not reduce our responsibility for protecting it.
| Provider | Role | What it holds |
|---|---|---|
| Supabase | Database hosting | Name, email address, mobile number, consent record, sign-in history |
| Resend | Email delivery | Email address and the contents of messages sent to it |
| Railway | Application hosting | Data in transit while a page or request is being served |
We do not sell your personal data, and we do not share it with advertisers or data brokers. There is no advertising or analytics tracking on this site.
How we protect it
- Sign-in codes are stored only as a one-way hash, expire after 10 minutes, and are destroyed after five wrong attempts.
- Your IP address is never stored in readable form — only as a keyed one-way hash that cannot practically be reversed back to your address.
- Sign-in sessions are held in a signed, tamper-evident cookie and expire automatically.
- All traffic is encrypted in transit (HTTPS), and the database is not reachable from the public internet.
How long we keep it
Account data is retained for [TO CONFIRM: retention period, e.g. "three years after last activity"]. Sign-in codes are deleted or invalidated within minutes. Email delivery logs are kept only as long as they are useful for diagnosing delivery problems. When data is no longer needed for the purpose it was collected for, we delete it.
Your rights
Under RA 10173 you have the right to:
- Be informed about how your data is processed — this notice.
- Access a copy of the personal data we hold about you.
- Correct anything inaccurate or out of date.
- Object to processing, including withdrawing consent to announcements.
- Request erasure or blocking where the law allows it.
- Obtain your data in a portable form.
- Be indemnified for damages caused by inaccurate or unlawfully obtained data.
To exercise any of these, email [TO CONFIRM: Data Protection Officer email]. We will respond within a reasonable period. Deleting your account removes your registration and sign-in records.
If you are not satisfied
Please contact our Data Protection Officer first — most issues are faster to resolve directly. If we do not resolve it, you may file a complaint with the National Privacy Commission.
Changes to this notice
If we change how we handle personal data, we will update this page and change the effective date above. Material changes affecting how we use data you already gave us will be announced by email.