Privacy policy
Arkitekto ("we," "our," or "us") is committed to protecting your privacy in accordance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website and services at arkitekto.review.
1.Information we collect
1.1 Account information
When you create an account, we collect the following personal information:
- Full name
- Email address
- Password, only for older accounts that use one (stored in hashed form)
New accounts are created with Google sign-in. When you sign in with Google, Google shares your name, email address and profile photo with us; we never see your Google password.
1.2 Profile information
You may optionally provide additional information to personalize your experience:
- Display name and avatar
- Target exam date
- Daily study goals (questions and minutes)
- Preferred timezone
1.3 Study and performance data
As you use our services, we automatically collect data about your study activity:
- Questions answered, answers selected, and correctness
- Time spent studying and session duration
- Mock exam scores and completion data
- Subject and topic mastery levels
- Study streaks and daily progress
- Bookmarked questions and notes
1.4 User-generated content
When you participate in community features, we collect the content you create:
- Discussion comments posted on question discussion threads
- Study group messages sent in group chat
- Weekly check-ins including reflections, mood, and study hours shared with your study group
- Reactions on discussion comments
- Content flags submitted through our moderation system
1.5 Newsletter subscription
If you subscribe to our newsletter, we collect your email address and the source of subscription (e.g., blog, homepage). You may unsubscribe at any time.
1.6 Technical information
We automatically collect certain technical information when you access our services:
- IP address
- Browser type and version
- Device type and operating system
- Pages visited and referring URLs
2.How we use your information
We process your personal information based on the following lawful criteria under the DPA:
2.1 Performance of contract
- Provide, maintain, and improve our review platform
- Track your study progress and generate personalized recommendations
- Calculate readiness scores and study plans
- Deliver and improve platform features
2.2 Legitimate interest
- Analyze usage patterns to improve our platform
- Detect and prevent fraud or abuse
- Moderate user-generated content for community safety
2.3 Consent
- Send newsletter updates and study tips (opt-in)
- Display your profile information to study group members
3.Information sharing and disclosure
We do not sell, trade, or rent your personal information to third parties.
Your information may be shared in the following circumstances:
3.1 With other users
- Study Groups: When you join a study group, your display name, avatar, study progress, and messages are visible to other group members.
- Discussions: Comments you post on question discussions are visible to all authenticated users, along with your display name.
3.2 With service providers
- Supabase (database and authentication): Your account data and application data are stored on Supabase's cloud infrastructure. Supabase processes data in accordance with their privacy policy and applicable data protection laws.
- Vercel (hosting): Our application is hosted on Vercel. Technical request data (IP address, headers) is processed by Vercel in accordance with their privacy policy.
- Payments (Polar): If you buy Arkitekto Pro, the purchase is processed by Polar Software, Inc., which acts as merchant of record. Your email address and a pseudonymous account identifier are shared with Polar so the purchase can be linked to your account. Card details are entered on Polar's systems and are never seen or stored by us. We receive only the subscription status, plan, and billing period needed to unlock Pro features.
- GCash payments: If you pay by GCash QR, the receipt screenshot and reference number you send are stored privately and seen only by our admins. To confirm payments quickly, the screenshot is read by Anthropic's Claude AI model, which transcribes the amount, date, recipient and reference number for us. We use these details only to confirm your payment. Because they are a record of a payment, we keep them for accounting and fraud prevention even if you later delete your account.
- Google (sign-in): If you sign in with Google, Google authenticates you and shares your basic profile with us, under Google's privacy policy.
- Sentry (error monitoring): When something breaks, error reports are sent to Sentry with technical details and, if you are signed in, your account ID and email address. Sentry also records a replay of a small share of sessions, and of sessions where an error occurs, so we can see what went wrong.
- Resend (email delivery): Study reminder emails and payment confirmations are sent through Resend, which receives your email address and the message. Every reminder has an unsubscribe link.
- Meta (ad measurement): We use the Meta Pixel on our website and the Meta Conversions API on our servers to learn which of our ads lead to sign-ups and purchases. When you sign up or buy Pro, we send Meta a hashed (SHA-256) copy of your email address, a hashed copy of your account ID, your IP address and browser type, the Meta click and browser cookies described in our Cookie Policy, and for purchases the plan and price. Hashing means Meta receives a scrambled code, not your email in plain text. Meta uses this to match the event to its own users and report ad results to us. We also record where you first came from (for example an ad, a Facebook post, or a search engine) with your account so we can see which channels work.
- YouTube (video embeds): We embed videos using YouTube's privacy-enhanced mode (youtube-nocookie.com), which limits tracking. When you play an embedded video, YouTube/Google may collect technical data in accordance with Google's privacy policy.
- Self-hosted Fonts: All typefaces are served directly from our own domain. No third-party font delivery services are used, so no data is shared for font loading.
- Google Favicons: In study group chats, we use Google's favicon service to display website icons for shared links. The domain of the shared link is sent to Google to retrieve the icon.
3.3 Legal requirements
We may disclose your information if required to:
- Comply with a legal obligation or lawful court order
- Respond to requests from the National Privacy Commission (NPC)
- Protect our rights, property, or safety
4.Data storage and international transfer
Your data is stored on cloud servers operated by our service providers (Supabase and Vercel), which may be located outside the Philippines. By using our services, you consent to the transfer of your data to these servers. We ensure that appropriate safeguards are in place in accordance with the DPA and NPC guidelines for cross-border data transfers.
5.Data retention
- Account data: Retained for as long as your account is active. Upon receiving a deletion request, your personal data will be permanently deleted within 30 days, except where retention is required by law.
- Study performance data: Retained for as long as your account is active to provide progress tracking and recommendations.
- User-generated content: Discussion comments and study group messages may be retained in anonymized form after account deletion to preserve community content integrity.
- Newsletter subscriptions: Retained until you unsubscribe.
- Technical logs: Retained for up to 90 days for security and debugging purposes.
6.Your rights under the Data Privacy Act
As a data subject under RA 10173, you have the following rights:
- Right to be informed: You have the right to know how your data is being collected and processed.
- Right to access: You may request a copy of your personal data that we hold.
- Right to correction: You may request correction of inaccurate or incomplete personal data.
- Right to erasure or blocking: You may request deletion or blocking of your personal data under certain conditions.
- Right to object: You may object to the processing of your personal data, including for direct marketing.
- Right to data portability: You may request your data in a structured, commonly used format. Contact us to request an export of your personal data.
- Right to file a complaint: You may file a complaint with the National Privacy Commission if you believe your data privacy rights have been violated.
To exercise any of these rights, contact us at privacy@arkitekto.review. We will respond to your request within 30 days.
7.Data security
We implement appropriate technical and organizational measures to protect your personal information, including:
- Encrypted data transmission (HTTPS/TLS)
- Hashed and salted password storage
- Row-level security policies on our database
- Security headers (X-Frame-Options, Content-Type-Options, Referrer-Policy)
- Server-side authentication and authorization checks
However, no method of transmission over the Internet is 100% secure. In the event of a personal data breach, we will notify affected users and the NPC within 72 hours as required by the DPA.
8.Cookies
We use cookies and similar technologies to maintain your authentication session and enhance your experience. See our Cookie Policy for detailed information about the cookies we use.
9.Children's privacy
Our services are intended for individuals preparing for the Philippine Architect Licensure Examination, who are typically 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If we learn that we have collected personal data from a minor without parental consent, we will take steps to delete that information promptly.
10.Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on our website and updating the "Last updated" date. Your continued use of our services after such changes constitutes acceptance of the updated policy.
11.Data protection officer
For questions or concerns about this Privacy Policy or our data practices, please contact our Data Protection Officer:
Email: privacy@arkitekto.review
You may also contact the National Privacy Commission at www.privacy.gov.ph if you have unresolved concerns about your data privacy.