Last updated: 26 September 2026

1. Who we are

Schema ("Schema", "we", "us", "our") is a Philippine web development and software studio operating as schema-ph.dev. This policy explains what personal information we collect, why we collect it, what we do with it, and what you can do about it.

We handle personal information in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules, and the issuances of the National Privacy Commission.

Privacy questions go to [email protected].

2. What this policy covers

This policy applies to:

• the schema-ph.dev website;
• the SchemaTIC telemetry script, wherever it is embedded on a website we built;
• the client systems we host and operate — SchemaCAS, SchemaPMS, SchemaCRM, and the client portal;
• the ordinary business correspondence we have with clients and prospective clients.

It does not cover a third-party website you reach by following a link from ours. Those sites have their own policies.

3. Our two roles

Which role we are in decides who answers a request about a piece of data.

We are the controller for data we decide the purpose of: our own website's visitors, our client records, our billing, and our correspondence. Requests about that data come to us.

We are a processor for data our clients put into a Platform we host — a hotel's guest bookings in SchemaPMS, a company's counterparties in SchemaCAS, a client's site visitors in SchemaTIC. That data belongs to the client. We act on their instructions, we do not use it for our own purposes, and a request about it should go to that client. If you send us one, we will pass it on.

4. What we collect

Website visitors — SchemaTIC telemetry

When you load a page carrying our SchemaTIC script, we record a small, anonymous set of facts about the visit:

• Anonymous visitor ID — a random identifier generated in your browser so repeat visits can be told apart from new ones. It is not tied to your name, your email, or any real-world identity.
• Page visited — the canonical address of the page. Query strings and URL fragments, including campaign and tracking parameters, are stripped before anything is stored.
• Device information — broad device type (desktop, mobile, tablet), operating system, and browser, derived from your user-agent string.
• Engagement — how long the page was active or backgrounded, and a count of interactions such as clicks, scrolls, and key presses. We store counts only, never the content of a keystroke or a field.
• Referral and campaign source — UTM parameters, if the link you followed carried them.
• Approximate country — a two-letter country code derived from your IP address using an offline lookup table. The IP address itself is used in memory to derive that code and is never written to storage.

Clients and prospective clients

When you engage us, enquire, or are added to our outreach list, we hold ordinary business contact and account information: name, business name, email address, phone number, billing address, service history, invoices, payments, and our correspondence with you.

Users of a hosted Platform

When you sign in to a Platform we host for a client, we hold your account identifier, a hashed password, your role, your session records, and an audit trail of the actions you take inside the system. The audit trail exists so a client can see who changed what — it is a security and accountability control, not a productivity monitor.

Server logs

Our servers keep short-lived operational logs — request paths, status codes, timings, and error traces — used to keep the service running and to investigate faults and abuse.

5. What we never collect

Through SchemaTIC we do not collect names, email addresses, phone numbers, passwords, payment details, form contents, precise location, or the text of anything you type.

Across all our systems we do not:

• sell, rent, or trade personal information;
• run browser fingerprinting;
• build advertising or behavioural profiles of visitors ourselves;
• show ads inside our signed-in systems or the client portal;
• store payment card numbers — payments go through the provider you choose, and we see only the record that a payment happened.

6. Cookies and browser storage

SchemaTIC does not use cookies. Its anonymous visitor ID lives in your browser's local storage. Clearing your browser's site data removes it, and your next visit simply starts a new one.

Our signed-in systems use strictly necessary cookies to hold your session. Without them you cannot stay logged in. They carry no advertising or tracking function, and they expire when the session ends or when you sign out.

Our free tools. The calculators, converters, text, PDF and image tools at /tools run in your browser. What you type and the files you pick are processed on your device and are never sent to us or stored by us.

Ads on our free pages. Our free learning pages (/learn) and free tools (/tools) may show ads from Google AdSense.

• Google and its partners may use cookies to show ads, including ads based on your past visits to this and other websites. Learn how Google uses this data at How Google uses information from sites that use its services.
• You can turn off personalised ads at Google Ads Settings, also linked as Ad choices in the page footer.
• You can also opt out of personalised ads from many other ad companies at aboutads.info.
• If you visit from the European Economic Area, the UK or Switzerland, Google asks for your consent before it uses cookies for ads.

Ads never appear inside our signed-in systems or the client portal.

We set no analytics cookies, and no advertising cookies anywhere else.

7. Why we use it, and on what basis

We do not use personal information for automated decision-making that produces a legal or similarly significant effect on you.

8. Who we share it with

We do not sell your data. We share it only in these cases:

• Service providers we depend on — hosting, database, email delivery, media storage, and payment providers. They act on our instructions and may use the data only to provide their service to us.
• Google, for ads — only on our free pages. Google then receives your IP address, browser details and the page you are on, as its own controller.
• The client who owns the data — a Platform's records and a website's aggregate statistics are visible to Schema and to that client, and to nobody else.
• When the law requires it — a valid court order, subpoena, or lawful request from an authority.
• To protect rights and safety — where disclosure is necessary to prevent fraud, abuse, or serious harm, or to establish or defend a legal claim.
• A business transfer — if Schema is acquired or merged, records may transfer with the business. You will be told, and this policy continues to apply until it is replaced.

9. Where the data is stored

Our servers and databases are hosted with providers who may operate outside the Philippines. Where personal information leaves the country, we take reasonable steps to ensure it stays protected at a standard comparable to that required by RA 10173, including contractual commitments from our providers.

10. How long we keep it

• SchemaTIC telemetry — kept while it remains useful for reporting, then aggregated or deleted. Because the visitor ID is anonymous, clearing your browser storage already breaks the link between past and future visits.
• Client account and billing records — kept for the life of the relationship and then for as long as tax, accounting, and corporate record-keeping law requires.
• Platform data — kept while the client's service is active. After termination it stays available for export for thirty (30) days and may then be permanently deleted.
• Server logs — kept for a short operational period, then rotated out.
• Correspondence — kept while it is useful and while a claim could still arise from it.

11. How we protect it

We use TLS on every connection, hash all stored passwords, scope every session, and restrict data access to the people who need it to do their work. Platform data is separated per client, and sensitive actions are written to an audit trail.

No system is perfectly secure. If a breach occurs that is likely to seriously harm those affected, we will notify the National Privacy Commission and the affected data subjects within the period the Data Privacy Act requires.

12. Your rights

Under the Data Privacy Act you have the right to:

• be informed that your personal data is being processed;
• access the personal data we hold about you;
• object to processing, and to withdraw consent where consent is the basis;
• rectify data that is inaccurate or incomplete;
• erasure or blocking of data that is incomplete, outdated, false, unlawfully obtained, or no longer necessary;
• data portability — receive your data in a commonly used electronic format;
• damages for a violation of your rights;
• lodge a complaint with the National Privacy Commission.

To exercise a right, email [email protected]. We may need to verify your identity first, and we will respond within a reasonable period and no later than the law requires. There is no charge for a reasonable request.

If your request concerns data held inside a client's Platform, we will forward it to that client, because it is theirs to decide.

13. Children

Our services are for businesses and are not directed at children. We do not knowingly collect personal information from anyone under eighteen. If you believe a child's data has reached us, tell us and we will delete it.

14. Changes to this policy

We may update this policy. The current version always lives at schema-ph.dev/privacy-policy, and the "Last updated" date at the top of this page tells you when it last changed.

For a material change we will give notice by email or through the client's dashboard before it takes effect.

15. Contact

Questions, requests, and complaints about privacy go to [email protected].

You may also contact the National Privacy Commission at privacy.gov.ph if you believe your rights have been infringed.