Privacy & Data Practices

Clear, Honest Privacy Policy

We do not make a misleading "we collect nothing" claim. Instead, we explain honestly our adherence to the Philippine Data Privacy Act of 2012 (RA 10173), safeguards for minor students, and the minimal operational data processed by the platform.

Personal Information Controller & Operating Entity

Legal operational identity and contact disclosures under Republic Act No. 10173.

Personal Information Controller

This directory is operated by John Lloyd S. Parungao (individual developer and project lead) under the project/business name Hashira Tech Solutions (business registration is pending in the Philippines; it is not yet a registered corporate entity). All operations are based in the Republic of the Philippines.

Privacy Contact Channel

For data subject inquiries, correction requests, or privacy concerns, you may contact the operator via the /submit reporting channel or through our dedicated support mailbox (support@iskolarph.app).

Protections for Students & Minor Learners (NPC Advisory 2024-03)

We recognize that many high school and college scholarship applicants in the Philippines are minors (under 18 years of age). In alignment with National Privacy Commission guidance:

  • No Student Accounts or Sign-Ups: Students of any age can search, filter, and use the eligibility matcher without registering, logging in, or providing birthdays, phone numbers, or passwords.
  • Strict Prohibition on Sensitive Records: Never submit PSA birth certificates, school IDs, report cards/GWA transcripts, certificates of indigency, parents’ income tax returns, or bank details. The submission form is solely for public scholarship program details.
  • Plain-Language Transparency: We state our privacy terms in clear Filipino and English so students and parents can easily understand how their privacy is safeguarded.

What Data Is Processed by Feature

Our architecture strictly separates student browsing from contributor submissions and moderator review.

1. Student Browsing & Matching (On Your Device)

There are no student accounts. Search queries, filters, and Match quiz responses (grade, family income, province, school) execute purely in browser memory and URL fragments (#...) that are never transmitted to our backend. Edge hosting processes standard HTTP routing logs without ad trackers or tracking cookies.

2. Scholarship & Correction Submissions (/submit)

When submitting via /submit, our backend receives the scholarship details, optional submitter name/email/organization, and a Cloudflare Turnstile token verified server-side. A transient keyed HMAC-SHA256 hash of the IP address enforces anti-spam rate limiting. Submitter contacts reside in a restricted PostgreSQL table with Row-Level Security (RLS) and are excluded from public catalog data and exports.

3. Voluntary Support & Public Solicitation Note

The /support page lists direct wallet/bank numbers (GCash, BPI, Maya) and local QR codes strictly for voluntary community contributions toward hosting costs. It runs zero payment scripts and stores no donor database. We acknowledge Department of Social Welfare and Development (DSWD) guidelines on public solicitation (PD 1564) and are actively assessing regulatory compliance.

Your Rights as a Data Subject (Philippine DPA)

Under the Philippine Data Privacy Act of 2012, you are entitled to the following statutory rights:

Right to Be Informed

You have the right to know whether personal data pertaining to you is being processed, the purposes of processing, and the measures safeguarding it.

Right to Access & Rectify

You may request verification or correction of any inaccurate or outdated information you submitted through our /submit reporting workflow.

Right to Erasure or Blocking

You may request the suspension, withdrawal, or blocking of your personal contact information from our private records when no longer necessary.

Right to Lodge a Complaint

If you feel that your personal information has been mishandled or your data privacy rights violated, you have the right to file a complaint with the National Privacy Commission (privacy.gov.ph).

Third-Party Service Providers & Technical Infrastructure

We engage a minimal set of established infrastructure providers strictly necessary to deliver a fast, secure website. None of these providers serve advertisements or behavioral tracking cookies on our site:

  • Vercel Inc. — Edge content delivery network and serverless hosting; handles encrypted HTTPS requests and transient runtime execution.
  • Supabase Inc. — Managed PostgreSQL database hosting the public scholarship catalog and private moderation tables secured by Row-Level Security.
  • Cloudflare Inc. (Turnstile) — Privacy-preserving bot verification on /submit that prevents spam abuse without setting cross-site tracking cookies.