Privacy Policy · Pinoy Reviewer Hub

1. Who we are

This Privacy Policy describes how Bacolod Information Technology Solutions (a sole proprietorship registered with the Department of Trade and Industry of the Philippines), operating the product “Pinoy Reviewer Hub”(the “Service”), collects, uses, stores, and protects your personal data when you use our website (pinoyreviewerhub.com) or mobile applications.

We are committed to protecting your personal data in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission (NPC).

Business name: Bacolod Information Technology Solutions (DBA Pinoy Reviewer Hub)
Address: Manila, Metro Manila, Philippines
Email: pinoyreviewerhub@gmail.com
Personal Information Controller (PIC): Joselito Bacolod
NPC registration status: Pending

2. Data Protection Officer (DPO)

As a sole proprietorship, our Data Protection Officer is the proprietor himself:

Name: Joselito Bacolod
Role: Proprietor and Data Protection Officer
Contact: pinoyreviewerhub@gmail.com

The DPO is responsible for ensuring our compliance with the Data Privacy Act and handling all privacy-related concerns from data subjects. For privacy questions, complaints, or data access requests, please contact the DPO directly via email.

3. What personal data we collect

When you use Pinoy Reviewer Hub, we collect the following:

3.1 Account information

Email address
Display name (chosen by you)
Profile photo, if you choose to add one (from your Google account or a photo you pick from your device)
Exam goal and, for LET reviewers, the majorship you select
Password (stored as a one-way cryptographic hash via Firebase Authentication; we cannot read or recover your password)
Account creation date and last login timestamps

3.2 Usage data

Exams selected, questions answered, scores, and time spent
Learning streaks, XP, and progress milestones
Preferences (e.g., daily reminder settings, dark mode)
Your session history (each practice set, pack and pre-board with its score and item-by-item review), shown in History on the app and the web
Notes and saved questions (bookmarks) you keep in the app or on the web, and the names of the devices you sign in from (used to keep one active session)

3.3 Device and technical data

Device type, OS version, and app version
IP address (for security and fraud prevention only)
Browser type and language (for the web)
Crash reports and diagnostic logs (no personal content)

3.4 Payment data

Subscriptions are sold only in the mobile apps, through Google Play Billing (Android) or the Apple App Store (iOS), and managed through RevenueCat. We receive the subscription status, the plan and the store transaction reference. We never see, store, or have access to your credit card, debit card, or bank account numbers.
The website does not sell subscriptions. A subscription bought in the app unlocks the same features on the web.

3.5 Optional data

Communications you send to us via email or Facebook (we retain these for support and reference)
Feedback, suggestions, or content you voluntarily share with us

4. Lawful basis for processing

Under the Data Privacy Act, we process your personal data based on the following lawful grounds:

Consent: You expressly agree to this Privacy Policy when you create an account or subscribe.
Contractual necessity: Processing is necessary to provide the subscription service you purchased.
Legal obligation: Retention of payment records for compliance with Bureau of Internal Revenue (BIR) regulations.
Legitimate interests: Fraud prevention, security monitoring, and service improvement, provided these do not override your rights as a data subject.

5. How we use your data

We use your personal data for the following purposes only:

To create and maintain your user account
To provide, personalize, and improve the reviewer service
To sync your progress across web and mobile devices using your single account
To process and manage your subscription (billing, renewals, cancellations, refunds)
To send transactional emails: email verification, password reset, payment receipts, subscription notifications, and important service updates
To enforce subscription access and prevent unauthorized account sharing or abuse
To respond to your inquiries and provide customer support
To detect and prevent fraud, security incidents, or violations of our Terms of Service
To comply with our legal obligations (e.g., BIR record-keeping, NPC inquiries, court orders)

What we DO NOT do with your data:

We do not sell your personal data to anyone, ever.
We do not share your personal data with third parties for advertising purposes.
We do not use your usage data to train external AI models.
We do not display third-party advertisements on our website or apps.

6. Minors and parental consent

Pinoy Reviewer Hub is intended for users 13 years of age and older. Users between 13 and 17 require verifiable parental or guardian consent to use the Service.

For users under 13: We do not knowingly collect personal data from children under 13. If we discover such data has been collected, we will promptly delete it, terminate the account, and notify the parent or guardian if known.

For minors aged 13-17: We collect only the minimum necessary information needed to provide the Service. We do not engage in targeted advertising directed at minors, and we do not sell or share their data beyond the disclosures in Section 7 (Third-party service providers).

Parents or guardians who believe a child has provided personal data without proper consent should contact our DPO immediately at pinoyreviewerhub@gmail.com for deletion. Parents or guardians may also request access to or deletion of their child’s data, subject to proof of guardianship.

7. Third-party service providers

We rely on a small number of trusted, contractually-bound service providers to operate. Each has been chosen for their strong data protection standards:

Google Firebase(Google LLC) — authentication, database (Cloud Firestore), cloud functions, crash reporting, and push notifications. Data is processed primarily in Google’s data centers in the United States and other regions, governed by Firebase’s privacy and security commitments.
RevenueCat — mobile subscription management (Android and iOS). Subject to RevenueCat’s Privacy Policy.
Google Generative AI (Google LLC) — the AI features: AI question generation and AI explanations. Our question banks and packs are written by our team. Subject to Google’s Privacy Policy.
Google Play Store / Apple App Store — mobile app distribution and billing.
Google Analytics for Firebase(Google LLC) — aggregated usage statistics for the website and apps (for example pages and screens visited, device type and approximate region), used to improve the Service and never for advertising. Subject to Google’s Privacy Policy.
Firebase App Check with Google reCAPTCHA(Google LLC) — protects our servers from bots and abuse by checking that requests come from the genuine website or app. reCAPTCHA collects hardware and software information from your browser for this purpose. Subject to Google’s Privacy Policy and Terms of Service.
Firebase App Hosting(Google LLC) — website hosting infrastructure. Subject to Google’s Privacy Policy.

8. International data transfers

Some of our service providers (notably Google Firebase and Google Cloud, RevenueCat, Google Play and Apple) process data outside the Philippines, including in the United States, European Union, and Asia-Pacific regions. By using our Service, you consent to the transfer of your personal data to these jurisdictions for the purposes described in this Policy.

We require all third-party processors to maintain data protection standards at least equivalent to those required by the Philippine Data Privacy Act, including through contractual safeguards and adherence to internationally recognized frameworks.

9. Cookies and tracking technologies

Our website uses a minimal set of cookies and similar technologies:

Strictly necessary cookies: Required for the Service to function (e.g., your sign-in session and the App Check / reCAPTCHA security check). These cannot be disabled.
Functional storage:Remembers your preferences on your own device (e.g., light or dark theme, sound effects, the collapsed sidebar, and an unfinished practice set or pre-board so it survives a reload). This is kept in your browser’s local storage and is not sent to us.
Analytics cookies: Google Analytics for Firebase sets cookies to count visits and measure aggregated usage. We use the statistics to improve the Service, not for advertising.

We do not use advertising cookies, third-party tracking pixels (e.g., Facebook Pixel, Google Ads), or behavioral retargeting tools.

You may control cookies through your browser settings. Note that disabling necessary cookies will prevent the Service from functioning properly.

10. Security measures

We implement reasonable and appropriate technical, organizational, and physical safeguards to protect your personal data:

Encryption in transit: All data exchanged between your device and our servers is encrypted via HTTPS (TLS 1.2+).
Encryption at rest: Personal data stored in Firebase is encrypted at rest using industry-standard algorithms.
Access controls: Only authorized personnel (the proprietor) can access user data, and only when necessary for support or service operations.
Password hashing: Passwords are stored as one-way cryptographic hashes; we never store or transmit passwords in readable form.
App Check: Our servers accept requests only from the genuine website and apps (Firebase App Check), which blocks most automated scraping and abuse.
Security monitoring: Our infrastructure providers (Google Firebase and Google Cloud) maintain industry-standard security monitoring and apply security patches at the infrastructure level. We review application-level security as part of routine maintenance.

However, no system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

11. Data breach notification

In the unlikely event of a personal data breach that is likely to give rise to a real risk of serious harm to affected data subjects, we will:

Notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, as required by Section 38 of the Data Privacy Act IRR.
Notify affected data subjects promptly via email with a description of the nature of the breach, the data involved, the measures taken, and recommended actions.
Cooperate fully with the NPC and law enforcement during any investigation.

12. Data retention

We retain personal data only as long as necessary for the purposes for which it was collected:

Active accounts: Data is retained for the duration your account remains active.
Inactive accounts: Accounts with no login activity for 24 consecutive months may be flagged for archival or deletion (with prior email notification).
Deleted accounts: Upon your deletion request, personal data is removed from active systems within 30 days, and from backups within 90 days.
Payment records: Retained for at least 10 years in compliance with BIR record-keeping requirements (NIRC and BIR Revenue Regulations).
Anonymized usage analytics: May be retained indefinitely as they no longer identify you.

13. Your rights as a data subject

Under the Philippine Data Privacy Act, you have the following rights:

Right to be informed: About how your data is collected and processed (this Policy fulfills that).
Right to access: Request a copy of the personal data we hold about you.
Right to rectification: Request correction of inaccurate or incomplete data.
Right to erasure (deletion): Request deletion of your data, subject to legal retention obligations.
Right to object: Object to processing based on legitimate interests.
Right to data portability: Request your data in a structured, commonly-used, machine-readable format.
Right to withdraw consent: Withdraw consent at any time (note: this may end your access to the Service).
Right to damages: Claim compensation for damages suffered due to inaccurate, incomplete, outdated, false, or unlawfully processed personal data.
Right to file a complaint: Lodge a complaint with the National Privacy Commission if you believe your rights have been violated. Visit privacy.gov.ph.

How to exercise your rights: Email our DPO at pinoyreviewerhub@gmail.com with the subject “Data Subject Request” and a clear description of your request. We will respond within 15 working days as required by the NPC, and may require identity verification to protect your data.

14. Marketing communications

We send transactional emails (account verification, payment receipts, important service updates) as part of providing the Service. These cannot be opted out of while you maintain an active account.

We may occasionally send product update emails (new exams, new features, important announcements). If you do not wish to receive these, you may opt out at any time by replying to any such email with “UNSUBSCRIBE” in the subject line, or by emailing pinoyreviewerhub@gmail.com. Opting out does not affect transactional emails.

We do not send promotional emails from third parties.

15. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes, we will:

Update the “Last updated” date at the top of this page.
Provide notice through reasonable means, which may include email, in-app notifications, a prominent notice on our website, or announcements on our official Facebook page and Facebook group.
For substantial changes affecting your rights, we will endeavor to provide at least 30 days’ advance notice and an opportunity to discontinue use of the Service if you disagree.

Continued use of the Service after the effective date constitutes acceptance of the revised Policy.

16. How to contact us

For any privacy-related concerns, requests, or complaints:

Data Protection Officer: Joselito Bacolod
Email: pinoyreviewerhub@gmail.com
Subject line:“Data Privacy Request” or “Privacy Concern”
Response time: Within 15 working days

You may also file a complaint with the National Privacy Commission:

Website: privacy.gov.ph
Email: complaints@privacy.gov.ph