Template — not yet complete. The operator of this site must fill in the highlighted details (in the settings described in README.md) and have this text reviewed by a lawyer before real people use the service.
This notice explains what personal information Craftbase handles, why, how long we keep it, and your rights under the Data Privacy Act of 2012 (Republic Act No. 10173).
1. Who is responsible
For your Craftbase account: [operator's legal name], [postal address]. Privacy questions and requests: [privacy email]. Data Protection Officer: [DPO name].
Apps built with Craftbase are run by the people who made them. When you use such an app, its maker decides what it collects and is responsible for it; we store that data on their behalf. Ask the app's maker first about data you gave an app. If you can't reach them, contact us.
2. What we collect
Your account: name, email address, a scrambled (hashed) version of your password, an optional short bio, and when you accepted these terms.
Sign-ins and security: your active sessions (with a rough device description such as “Chrome on Windows”), and a security log of sign-ins, password changes and admin or access changes. IP addresses in the log are stored only as a scrambled code.
What you make: your apps, their designs, databases and uploaded files.
Apps you use: when you choose “Continue” in someone's app, we record that choice. That app then sees your name and email address and an ID that exists only in that app. Until you choose to continue, apps can't tell who you are.
What visitors send to apps: form answers and files, stored for the app's maker.
We don't sell personal information and we don't use it for advertising.
3. Why, and on what basis
To provide the service you signed up for — our contract with you.
To keep the service and its users safe (preventing abuse, investigating reports, keeping a security log) — our legitimate interest, and our legal obligations.
To share your name and email with an app — only with your consent, which you can withdraw in Settings.
Craftbase doesn't need sensitive personal information about you. App makers who collect sensitive information (for example health or religious details) must have a lawful basis for it, usually your explicit consent.
4. Who else sees it
App makers — only what you send to their app, and your name and email only if you chose to share them.
People who edit an app with you — your name, and what you select and where your pointer is while you both have it open (this isn't stored).
Our service providers, who work under contract and only on our instructions: [hosting provider and where data is stored].
Authorities, when the law requires it.
Some apps show content from other services. Your browser then connects to them directly and they can see your IP address: Google Fonts (lettering in apps), Google Maps (maps), YouTube and Vimeo (videos), image hosts such as Picsum (sample photos), and any website an app embeds. Maps, videos and embedded websites load only after you click to show them.
5. How long we keep it
Your account and apps: until you delete them. Deleting your account deletes your apps, their data and your files straight away.
Sign-in sessions: until they expire, 30 days after you sign in (or when you sign out).
Files attached to a form that was never sent: 1 day.
The security log: 365 days.
Backups: [how long backups are kept].
Data in other people's apps: until the app's maker deletes it or the app.
6. Your rights
You have the right to be informed, to access your data, to object, to have it corrected, blocked or erased, to data portability, to damages, and to file a complaint with the National Privacy Commission (privacy.gov.ph). How:
Settings: download all your data, change your name, stop sharing your details with apps, sign out other devices, or delete your account.
Anything else — correcting your email, objecting, or data you sent to an app whose maker you can't reach — write to [privacy email]. We may ask you to confirm your identity and will reply within [number] days.
7. Security
Passwords are stored only as scrambled hashes, connections are encrypted, access is limited to those who need it, and important changes are logged. No system is perfect: if a breach puts your information at risk, we will notify you and the National Privacy Commission as the law requires (within 72 hours of knowing about it where notification is required).
8. Children
Craftbase accounts are for people aged 18 and over. App makers must not knowingly collect children's information without a parent's or guardian's consent.
9. Changes
When this notice changes we update the version date above; we will tell you about important changes before they apply.