How BatasHub handles personal information.

Introduction

BatasHub ("BatasHub", "we", "us", or "our") is committed to handling personal information transparently and proportionately. Account access is currently limited to invited users. BatasHub does not yet accept real legal matters, confidential documents, payments, identity checks, signatures, Court transactions, or electronic notarization.

Privacy questions and data-subject requests may be sent to rradofina@gmail.com. The legal operator and designated data protection contact will be published before BatasHub accepts real legal-service data.

1. Information we collect

1.1 Information you provide

• Account information: your email address and, when supplied through Google sign-in, your display name and profile image.
• Authentication information: provider identifiers, sign-in method, session state, and verification events needed to establish and protect your account.
• Support and privacy requests: the information you choose to include when asking for support or exercising a privacy right.
• Restricted evaluation content: non-live information submitted through an invited account to evaluate an available workflow. Do not submit information about a real person or legal matter unless BatasHub has expressly activated that data category in writing.

1.2 Information collected automatically

• Technical information: IP address, browser and device details, request timestamps, routes used, and diagnostic information.
• Security information: authentication attempts, session and access events, abuse signals, audit records, and error reports.
• Necessary browser storage: cookies or equivalent storage used for sign-in, security, and basic application operation.

3. Email one-time-code sign-in

If you use email sign-in, BatasHub, Supabase, and Resend process your email address, a short-lived verification challenge, delivery status, and related security signals. The code is used only to authenticate your account. BatasHub will never ask you to send or disclose that code to another person.

4. How we use information

• Create, authenticate, and secure BatasHub accounts.
• Route an authenticated user only to workspaces and records they are authorized to access.
• Operate, maintain, diagnose, and improve the BatasHub service.
• Detect abuse, investigate security events, and preserve trustworthy audit records.
• Respond to support, privacy, and legal requests.
• Comply with applicable Philippine law and enforce the Terms of Service.

We process personal information only for a declared, lawful, and proportionate purpose. The applicable basis may include consent, steps requested before a contract, performance of a contract, compliance with law, protection of lawful interests, or another basis permitted by the Philippine Data Privacy Act of 2012.

5. How information is shared

BatasHub does not sell personal information or use Google user data for advertising.

Information may be processed by a service provider only when needed for the function it supplies:

• Supabase: authentication, database, and storage services.
• Vercel: public website hosting and request delivery.
• Railway: application programming interface and background-service hosting.
• Upstash: managed queue, cache, or rate-control functions.
• Resend: delivery and operational records for account email.
• Google: optional Google account authentication.
• AlonChat: the embedded public guide, when you choose to use it.

We may also disclose information when required by valid law, Court process, or an authorized regulator; to investigate fraud, abuse, or a security incident; or as part of a lawful corporate transaction subject to appropriate safeguards and notice.

6. Storage, international processing, and retention

BatasHub's service providers may process information in the Philippines or other countries where they operate. We use data minimization, contractual controls where applicable, and provider security measures appropriate to the information and currently enabled services.

Account, authentication, support, and security information is kept only as long as reasonably necessary for the purpose collected, dispute and abuse prevention, protected backup cycles, and applicable legal obligations. It is then deleted or de-identified. Matter, professional, payment, identity, Court, and notarial retention schedules will be separately approved and published before those data categories are enabled.

7. Security

Safeguards include encrypted network connections, managed authentication, role and matter-level authorization, environment separation, restricted administrative access, audit records, provider security controls, and monitoring. Hosted access uses Google sign-in or email one-time codes. No online service can guarantee absolute security.

8. Your privacy rights

Subject to applicable law and appropriate identity verification, you may ask to be informed about processing and request access, correction, deletion or blocking, restriction, objection, portability, or withdrawal of consent. You may also lodge a complaint with the National Privacy Commission.

Some information may be retained where necessary for security, legal claims, compliance, or another lawful exception. A BatasHub sign-in session alone may not be enough identity evidence for a high-risk production privacy decision.

9. Cookies and similar technologies

The current application uses only storage necessary for authentication, session continuity, security, and essential operation. It does not use advertising cookies. If analytics or optional tracking is introduced, this policy and any required consent controls will be updated before that processing begins.

10. Children's privacy

The account service is intended for adults who can enter a binding agreement. Do not create an account for a child or submit a child's information. Any legal service involving a minor will require an approved workflow, appropriate parent or guardian authority, and additional privacy safeguards.

12. Changes and contact

We will update the date on this page when the policy changes and provide additional notice where applicable law requires it. Before real legal-service data is accepted, this policy will identify the production operator, approved data protection contact, service-specific purposes, recipients, and retention schedules.

Questions, account-data deletion requests, and other privacy requests may be sent to rradofina@gmail.com.