Privacy Policy

This Privacy Policy is issued by TLDR — The Laundry Development Repository, operating under MDE Business Center (Miguel DE Business Development Services) (“TLDR”, “we”, “us”), the operator of the GrowthOS™ platform at tldrphilippines.com and the workspaces, funnels, websites and documents it generates for members of the ELS Regional Business Partnership Network (“RBPN”, “Partners”).

We process personal data in accordance with Republic Act No. 10173, the Data Privacy Act of 2012 (“DPA”), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (“NPC”). Where our Partners use the platform to handle their own customers’ data, we also honour the roles the DPA assigns to a personal information controller and a personal information processor (see Section 3).

This policy covers:

• visitors to tldrphilippines.com and to public funnel, course and website pages our Partners publish;
• Partner accounts and their team members who log in to a GrowthOS™ workspace;
• people who submit a lead form, message a Partner’s Facebook Page or Instagram account connected to the platform, or otherwise contact a Partner through pages we host.

Account and workspace data (Partners and their teams). Full name, email address, password (stored only as a one-way hash by our authentication provider), role, the business name, handle, logo, brand colours, letterhead, address and contact numbers you place on your documents, and the content you create — funnels, website pages, courses, quotations, to-dos, support requests and files you upload.

Prospect and customer data (collected on behalf of Partners). When someone fills in a lead form, takes a client course, or messages a connected Facebook Page or Instagram account, we receive the name, contact details, message content, pipeline stage, tags, notes and source that the Partner records in their Leads, CRM, Chat and Sites modules — including site addresses, installed machines and warranty records for won customers.

Usage and technical data. Log records (IP address, browser and device type, pages visited, timestamps), session cookies needed to keep you signed in, funnel and website page-view counts, and an activity log of actions taken inside a workspace (for example “lead captured”, “document issued”).

Advertising performance data. For Partners on the managed Ads service, aggregate campaign metrics from Meta (spend, reach, impressions, clicks, results). We do not receive the personal profiles of people who see or click an ad.

Support and communications. Support requests, Migo chat messages, and email correspondence with our team.

We do not knowingly collect sensitive personal information as defined in Section 3(l) of the DPA (such as health, religion, political affiliation, government-issued identifiers or financial account numbers), and we ask Partners not to enter such data into free-text fields. The platform is not directed at persons under 18.

For Partner accounts, team members and site visitors, TLDR is the personal information controller. We decide why and how that data is processed and are accountable for it under the DPA.

For a Partner’s prospects and customers, the Partner is the personal information controller and TLDR is the personal information processor. We process that data only on the Partner’s documented instructions (their use of the platform), keep it confidential, secure it as described in Section 8, and return or delete it when the Partner’s subscription ends. Each Partner is responsible for giving its own customers a privacy notice, obtaining any consent its own marketing requires, and honouring their data-subject requests; we provide the tools to do so and will assist on request. This allocation is set out in the Terms of Use & Service.

• Performance of a contract — to provide the GrowthOS™ workspace and services you or your Partner subscribed to, issue quotations and billing statements, deliver invitations and password resets, and run the support desk.
• Consent — when a prospect submits a lead form, opts in to a course, or messages a Partner’s Page; and for optional features such as the AI Auto-Reply add-on, which a Partner must switch on. Consent may be withdrawn at any time (Section 6).
• Legitimate interests — securing the platform, preventing abuse and fraud, keeping audit logs, measuring how features are used, and improving the service — balanced against your rights and never for purposes you would not reasonably expect.
• Compliance with legal obligations — tax and accounting records required by the Bureau of Internal Revenue (including invoicing with 12% VAT), responses to lawful orders of Philippine courts or regulators, and breach notification duties to the NPC.

We do not sell personal data, and we do not use Partner or customer data to train artificial-intelligence models.

We share personal data only with service providers that help us run the platform, each bound by contract to process it solely for us and to protect it:

• Supabase — database, authentication and file storage.
• Vercel — application hosting and content delivery.
• Resend — transactional email (invitations, confirmations, alerts) sent from tldrphilippines.com.
• Meta Platforms (Facebook, Instagram) — only for Partners who connect a Page, Instagram account or ad account: messages you send and receive through Messenger/Instagram, and campaign metrics, pass through Meta’s APIs under Meta’s own terms and data policy.
• Anthropic — only when a Partner enables the AI Auto-Reply add-on: the recent messages of a conversation and the Partner’s business description are sent to generate a reply. The add-on is off by default.

We may also disclose data where required by Philippine law, a court order, or a lawful request of a government authority, and to professional advisers under a duty of confidentiality. Within the platform, data is visible only to the members of the workspace it belongs to, and to authorised TLDR staff who support that workspace (staff access is logged and flagged inside the workspace).

Under Sections 16 to 18 of the DPA you have the right to:

• be informed that your personal data is being collected and processed, and of the purposes;
• access the personal data we hold about you and how it has been processed;
• object to processing, including for direct marketing, and to withdraw consent at any time — withdrawal does not affect processing already carried out lawfully;
• rectification of inaccurate or incomplete data;
• erasure or blocking of data that is incomplete, outdated, false, unlawfully obtained, no longer necessary, or being used for an unauthorised purpose;
• data portability — a copy of data you supplied, in a commonly used electronic format;
• damages for inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of your personal data; and
• lodge a complaint with the National Privacy Commission (privacy.gov.ph).

To exercise a right, contact us via the Support desk in your GrowthOS™ workspace (Migo chat) or Viber 0917 520 1317, from the account you hold or with enough detail for us to verify you. Partners can self-serve most of these for their own workspace (edit or delete leads, contacts, files and team members). If your request concerns data held by a Partner about you as their customer, we will pass it to that Partner and help them respond.

We keep personal data only for as long as necessary for the purposes above, consistent with Section 11(e) of the DPA:

• Workspace content (leads, CRM, chat, documents, files) — for the life of the Partner’s subscription, then deleted or returned within 90 days of termination unless a longer period is required by law.
• Billing and tax records — 10 years, as required by the National Internal Revenue Code and BIR regulations.
• Server and access logs — up to 12 months for security and troubleshooting.
• Support threads — 2 years after the request is resolved.
• Lead-capture failure backups (a safety copy kept only when a form submission could not be saved normally) — until the lead is recovered, and no more than 30 days.

Data no longer needed is deleted or irreversibly anonymised.

We apply the organisational, physical and technical measures required by Sections 20 and 21 of the DPA and NPC Circular 16-01, including: encryption in transit (TLS) and at rest; row-level security so each workspace can only ever read its own records; hashed passwords and optional email verification; least-privilege staff access with an in-app banner whenever staff view a Partner workspace; signed, time-limited links for private files; signature verification on all inbound Meta webhook deliveries; rate-limited public forms; and audit logs of significant actions. Our full programme is described on the Data & Compliance page.

Our service providers host data in cloud regions outside the Philippines (Asia-Pacific and the United States). Under Section 21 of the DPA, TLDR remains accountable for personal data it transfers to third parties for processing. We select providers that maintain recognised security certifications and bind them by data-processing terms that require protection comparable to the DPA. By using the platform you acknowledge that your data will be processed in these locations.

The platform sets a strictly necessary authentication cookie to keep you signed in, and uses browser session storage for small conveniences (for example, remembering that Migo has already shown you a tip on a page). We do not run third-party advertising or tracking cookies on tldrphilippines.com. Videos embedded on Partner funnels and websites (YouTube, Vimeo) and Meta’s Messenger surfaces set their own cookies under their own policies.

If a personal data breach is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the affected data subjects within 72 hours of becoming aware of it, as required by Section 20(f) of the DPA and NPC Circular 16-03, describing the nature of the breach, the data involved, and the measures taken. Partners whose customers are affected will be informed so they can meet their own obligations.

We may update this policy to reflect changes in the law, our services or our providers. Material changes will be announced inside the workspace (Dashboard announcements) and by email to workspace owners at least 15 days before they take effect. The date at the top shows the current version.

Data Protection Officer: reachable via the Support desk in your GrowthOS™ workspace (Migo chat) or Viber 0917 520 1317 · TLDR — The Laundry Development Repository, operating under MDE Business Center (Miguel DE Business Development Services), Philippines.