Data & Compliance

TLDR designs and operates GrowthOS™ to comply with the laws of the Republic of the Philippines that apply to a business software platform handling personal and commercial data:

• RA 10173 — Data Privacy Act of 2012, its 2016 Implementing Rules, and National Privacy Commission (NPC) issuances, including Circular 16-01 (security of personal data), 16-03 (breach management), 16-04 (rules of procedure) and 2022-04 (registration of data processing systems).
• RA 8792 — Electronic Commerce Act of 2000: legal recognition of electronic documents, signatures and records generated by the platform (quotations, billing statements, receipts, warranty cards, accepted terms).
• RA 11967 — Internet Transactions Act of 2023 and RA 7394 — Consumer Act: fair dealing and transparency for the online offers our Partners publish to consumers.
• RA 10175 — Cybercrime Prevention Act of 2012: protection against illegal access, data interference and related offences.
• National Internal Revenue Code and BIR regulations (including the Ease of Paying Taxes Act, RA 11976): VAT-inclusive invoicing and retention of tax records.
• RA 8293 — Intellectual Property Code: protection of platform, brand and creative assets.

• Data Protection Officer. TLDR designates a DPO, reachable via the Support desk in your GrowthOS™ workspace (Migo chat) or Viber 0917 520 1317, responsible for our privacy programme, data-subject requests and liaison with the NPC.
• NPC registration. We maintain the DPO and data-processing-system registrations the NPC requires of us, and update them when our processing changes.
• Privacy by design. New features go through a privacy and security review before launch; each module is built to collect only the fields it needs (Section 11 of the DPA — proportionality).
• Records of processing. We keep an inventory of the personal data we process, its purpose, lawful basis, retention period and the providers involved (summarised in the Privacy Policy).
• Training. TLDR staff who support Partner workspaces complete data-privacy training and are bound by confidentiality.

Technical and organisational safeguards under Sections 20–21 of the DPA and NPC Circular 16-01:

• Tenant isolation. Every table is protected by database row-level security keyed to workspace membership, so a Partner can only ever read or write its own records — enforced by the database itself, not just the application.
• Encryption. TLS 1.2+ for all traffic; provider-managed encryption at rest for databases, backups and file storage.
• Authentication. Hashed passwords, email verification links, time-limited password resets, and secure, HTTP-only session cookies.
• Least privilege. Staff can only open a Partner workspace through an audited path that displays a “viewing as TLDR staff” banner; service credentials never reach the browser.
• Private files. Uploaded documents, contracts and course media are served through signed, expiring links; only public brand assets are world-readable.
• Integration security. Every inbound Meta webhook delivery is verified with an HMAC signature and rejected when signing is not configured; outbound Graph API calls carry an app-secret proof; Meta page tokens are stored server-side only and never displayed in the interface.
• Abuse controls. Rate limiting on public lead forms, durable capture with a recovery path so a lead is never lost mid-submit, and a schema-drift gate that blocks deployments that do not match the database.
• Logging and monitoring. Activity logs for significant workspace actions; alerting to TLDR on lead-capture failures and new support requests.
• Change control. Every deployment passes type checking, linting, a production build and a migration ledger check before release.

We use a small number of established cloud providers, each under data-processing terms that require protection comparable to the DPA:

• Supabase — PostgreSQL database, authentication and file storage (Asia-Pacific region).
• Vercel — application hosting and global content delivery.
• Resend — transactional email from the tldrphilippines.com domain (SPF/DKIM-verified).
• Meta Platforms — Messenger, Instagram and Marketing APIs, only for Partners who connect them.
• Anthropic — AI Auto-Reply add-on only, only when a Partner enables it.

Under Section 21 of the DPA, TLDR remains accountable for personal data transferred to these providers. We will update this list at least 15 days before adding a sub-processor that will handle Partner customer data.

• Retention schedule. Workspace content for the life of the subscription (+ 90 days); tax records 10 years; access logs up to 12 months; support threads 2 years after resolution; lead-capture safety copies up to 30 days.
• Export. Partners can download their documents and files at any time, and may request a full export of leads, contacts and CRM records in CSV/JSON within 30 days of termination.
• Deletion. Team members can be removed instantly; leads, contacts, conversations and files can be deleted by the Partner. On termination, all workspace data is deleted or returned within 90 days, except what tax or other laws require us to keep, after which it is deleted or anonymised.
• Backups. Provider backups are encrypted and expire on a rolling schedule; deleted data ages out of backups within that window.

We acknowledge requests to access, correct, block, erase, port or object within 5 business days and act on them without undue delay, within the periods set by the NPC. Where the request concerns data a Partner holds about its own customer, we forward it to the Partner the same day and provide the tooling to fulfil it. Requests are verified against the account email or other reasonable proof of identity, and are logged.

• Detection and triage within 24 hours of a report, with containment as the first priority.
• Notification to the NPC and affected data subjects within 72 hours where the breach involves personal data likely to cause serious harm (NPC Circular 16-03), including the nature of the breach, data involved, and remedial measures — and to affected Partners so they can meet their own obligations as controllers.
• Post-incident review with documented root cause and corrective actions.
• Security concerns can be reported at any time via the Support desk in your GrowthOS™ workspace (Migo chat) or Viber 0917 520 1317; we welcome responsible disclosure.

Because Partners are the controllers of their own customers’ data, compliance is shared. To stay compliant, each Partner should:

• display a privacy notice on its funnels and website — add a footer section linking to your own notice, or to this policy, on every page you publish;
• only collect what its business needs, and never sensitive personal information in free-text fields;
• use chat automations and campaigns in line with Meta’s policies and the DPA — clear opt-outs, no messaging people who have objected;
• remove team members who leave, and keep login credentials private;
• route customer privacy requests through the Leads/CRM/Chat tools, or to us for assistance;
• register its own DPO and data-processing systems with the NPC where the thresholds in NPC Circular 2022-04 apply to it.

• Plan prices are quoted exclusive of 12% VAT; every invoice states VAT separately and follows BIR invoicing rules.
• Documents the platform generates for Partners (quotations, billing statements, receipts, warranty cards) are electronic documents valid under RA 8792; Partners remain responsible for their own BIR registration and official invoicing.
• Offers Partners publish to consumers must be accurate and not misleading under RA 7394 and RA 11967; TLDR may take down content that is not.

Data Protection Officer: reachable via the Support desk in your GrowthOS™ workspace (Migo chat) or Viber 0917 520 1317. If you are not satisfied with our response, you may file a complaint with the National Privacy Commission (privacy.gov.ph). Consumer concerns may also be raised with the Department of Trade and Industry. Our Terms of Use & Service set out how disputes are resolved under Philippine law.