Privacy Policy.

KLASUMI is currently operated by an individual. For purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), the operator is identified below as the person responsible for the personal information processing described in this Policy. The legal role and any registration or notification obligations should be confirmed before publication.

Personal Information Controller / Operator: AR-JAY M. MOYA.

Privacy contact email: jhay06314@gmail.com. This is the current contact address and may be updated if KLASUMI establishes a dedicated privacy contact address. The current version of this Policy will identify the active contact address.

KLASUMI is currently operated by an individual, and no separate DPO has been appointed. The National Privacy Commission states that an individual personal information controller or processor is a de facto DPO. The operator therefore currently performs that role and may be contacted through the privacy email above. If the arrangement changes, this Policy will be updated.

This Privacy Policy applies to KLASUMI users and visitors whose personal information is processed through the website and its features. KLASUMI is currently intended only for people who are at least eighteen (18) years old. Do not create an account if you are under 18.

Account and identity information: name, email address, account identifier, password authentication data handled by our authentication provider, profile photo, cover photo, biography, school, course or program, year level, and other information you choose to add to your profile.

Student verification information: student email, school, student ID details, uploaded student ID or supporting-document image, verification status, submission attempts, review outcome, rejection reason, administrator notes, resubmission deadline, extension request and decision information, and related audit records.

User content and communications: posts, comments, reposts, profile content, marketplace and lost-and-found listings, direct messages, images, files, and other material you submit or exchange through KLASUMI.

Safety and moderation information: reports you submit, reported content, moderation decisions, notifications, relevant account identifiers, and records of administrator actions.

Business partnership and sponsorship information: if you represent a business that discusses or purchases a sponsored placement, we may process your business name, contact person details, business contact information, campaign details, invoices, agreed fees, payment status, payment dates, payment method details, and transaction or receipt references. We request only information reasonably needed to manage the business relationship and payment records.

Technical and usage information: information made available through the website, hosting, authentication, storage, and security services, which may include IP address, browser and device information, timestamps, logs, and diagnostic or security events. The exact information depends on the services and configuration used.

We generally collect information directly from you when you register, update your profile, submit verification documents, publish content, send messages, create listings, or contact us. Some information is generated through your use of KLASUMI, such as verification history, reports, notifications, and security logs. We may also receive information from other users when they report content or interact with you.

We may process personal information to create and maintain accounts; authenticate users; provide profiles, communities, posts, messaging, notifications, marketplace, and lost-and-found features; verify student eligibility; review resubmissions and extension requests; prevent fraud, impersonation, abuse, and security incidents; receive and investigate reports; moderate content; enforce our Terms of Service and Community Guidelines; provide support; maintain and improve the Platform; administer business partnerships and sponsored campaigns; issue or manage invoices and payment records for businesses that pay KLASUMI directly for sponsored placements; and comply with legal obligations or respond to lawful requests.

We will identify and rely on an appropriate lawful basis for each processing activity under applicable law. Where consent is the appropriate basis, we will request it in a manner that is specific, informed, and freely given. A general statement in this Policy does not replace any consent or notice that the law requires for a particular activity.

Student ID images and verification details may contain personal information and, depending on their contents, sensitive personal information. We use them to assess student eligibility, investigate suspected fraudulent submissions, administer verification deadlines and extensions, and maintain an appropriate record of verification decisions.

Verification documents are stored in the private Supabase Storage bucket configured for student verification. The application generates time-limited signed links for authorized administrative review. This describes the current application design; actual access controls, retention, backup behavior, and provider arrangements must be checked before launch.

Do not upload documents unrelated to student verification. Our intended practice is to delete the uploaded student ID image after the verification process for that submission has been completed and the image is no longer needed for review, resubmission, or a related investigation. We may retain the verification outcome, relevant decision details, and audit records for a separately defined retention period where reasonably necessary for accountability, security, dispute handling, or legal compliance. Before launch, KLASUMI must set and follow a documented retention schedule, including how promptly ID images are deleted, how any review or appeal period is handled, and how copies in backups are treated.

Messages, attachments, posts, comments, reposts, and listings are processed to deliver the features you use, store and display content, enable notifications, respond to reports, and protect users and the Platform. Content visibility depends on the feature and your choices; public posts and listings may be visible to other users.

Direct messages should not be treated as legally privileged or guaranteed end-to-end encrypted. Authorized access may occur when reasonably necessary for security, a user report, legal compliance, support, or enforcement of the Terms of Service, subject to applicable law and access controls. We should not access message content for unrelated purposes.

Information may be processed by the KLASUMI operator and authorized administrators who need access to perform verification, moderation, support, or security duties. Access should be limited according to role and legitimate need.

KLASUMI uses Supabase for database, authentication, and storage functions. Depending on the deployed application configuration, the website may also use a hosting provider and other technical vendors. Those providers may process information on the operator's behalf under their applicable terms and data-processing arrangements. Before publication, identify all actual providers, relevant processing locations, and any other recipients.

We may disclose information when required by law, valid legal process, or a competent authority, or when reasonably necessary to protect users, investigate fraud or security incidents, enforce our Terms, or establish, exercise, or defend legal claims. If a business payment is made using a bank, e-wallet, or other financial service, that provider may separately process transaction information under its own privacy notice. KLASUMI does not sell student personal information to advertisers. Business partners receive campaign or business information needed to arrange their own sponsored placements; they are not given access to private student profiles, student ID documents, direct messages, or other student account data merely because they sponsor a post.

Our technical providers may store or process information in locations outside the Philippines, depending on the services, project settings, and provider infrastructure. Before launch, the operator must confirm the actual data locations and assess applicable cross-border transfer requirements and safeguards. We will provide further details when confirmed.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including account operation, student verification, safety and moderation, security, dispute handling, and legal compliance. Different categories may require different retention periods.

KLASUMI will delete student ID images once they are no longer needed to complete the relevant verification process, subject to any documented, lawful need to retain them temporarily for review, resubmission, or an investigation. Verification decisions and necessary audit records may be retained separately for a defined period. KLASUMI must establish and follow a documented retention schedule covering the exact deletion timeframe for ID images, verification decisions and audit logs, account data, messages and attachments, reports, and backups. The precise periods must be set before publication; this Policy does not invent a fixed number of days.

You may request account deletion or erasure using the privacy contact below. Deletion may be subject to identity verification and lawful exceptions. Under the current account-deletion design, the account is disabled and identifying profile details and specified personal files are removed; some previously shared posts, comments, and message records may be retained in an anonymized or unavailable form to preserve conversation or thread context and protect other participants. This means account deletion does not necessarily erase every message or shared record from every participant's view. Some information may remain in backups for a limited period or be retained where required or permitted by law, for security, to resolve disputes, or to establish, exercise, or defend legal claims. Where appropriate, retained information will be blocked from ordinary use.

We aim to apply reasonable and appropriate organizational, physical, and technical safeguards to protect personal information against accidental or unlawful destruction, alteration, disclosure, and access. Measures should include access restrictions, secure authentication, least-privilege administrator access, private storage for verification documents, secure handling of credentials and secrets, software updates, backups, monitoring, and staff or administrator confidentiality obligations as appropriate.

No website or storage system can be guaranteed completely secure. If a personal data breach occurs, the operator will assess and respond to it, document the incident, and make notifications to the National Privacy Commission and affected individuals when required by applicable law and NPC rules.

Subject to the Data Privacy Act and its implementing rules, you may have the right to be informed; access your personal information; request correction or rectification; object to certain processing; request erasure or blocking where legally available; seek data portability where applicable; claim damages where legally warranted; and file a complaint with the National Privacy Commission.

To exercise a right, contact us using the privacy email below and describe your request. We may ask for reasonable information to verify your identity and protect another person's rights. We will respond within the period required by applicable law. Some requests may be limited where a legal exception applies.

KLASUMI and its technical providers may use cookies, local storage, or similar technologies to keep you signed in, maintain sessions, protect accounts, remember essential settings, and provide core site functions. These technologies may be set by KLASUMI or by a service provider used to operate the Platform. Their exact names, duration, and behavior depend on the deployed application and provider configuration.

This notice does not mean that KLASUMI uses advertising cookies or cross-site tracking. Before introducing analytics, targeted advertising, or other non-essential tracking technologies, KLASUMI will review the applicable privacy requirements, update this Policy with the actual technologies and purposes, and provide consent or preference controls where required. You can also manage or delete cookies through your browser settings, although blocking essential cookies or storage may prevent login or other Platform features from working.

We may update this Policy when KLASUMI's features, data practices, providers, or legal obligations change. We will post the updated version and revise the date. If a change materially affects users or requires consent, we will provide appropriate notice and obtain consent where required.

For privacy questions, access or correction requests, deletion requests, or complaints, contact the current privacy contact at jhay06314@gmail.com. This address may change; KLASUMI will update this Policy if it does.

National Privacy Commission: https://privacy.gov.ph/ . You may contact the Commission or file a complaint in accordance with its procedures. Contacting KLASUMI first may help us address your concern, but does not remove any right you have to approach the Commission.