Privacy Policy
This policy explains how PRINTABLES.PH CONSUMER GOODS TRADING collects, uses and protects personal data in WAppOTP, in line with the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.
1. Our two roles
- Controller for data about our customers and website visitors: account holders, workspace members and billing contacts.
- Processor for data our customers send through the service about their own recipients, such as phone numbers, message content and consent records. Our customer is the personal information controller for that data; recipients should contact the business that messaged them first.
2. Data we collect
- Account data: email address, name, verified login phone number, workspace and role information.
- Billing data: plan, orders, amounts and payment references. Card and wallet details are handled by our payment partners; we do not receive or store full card numbers.
- Service data processed for customers: recipient phone numbers, message text and media links, delivery statuses, consent and opt-out records, webhook deliveries. OTP codes are stored only as keyed hashes and expire within minutes; a code is kept encrypted only while a requested fallback (SMS or email) is pending.
- Linked account credentials: the WhatsApp Linked Devices session for numbers you connect, stored encrypted.
- Technical data: IP addresses, request identifiers, device and browser information and security logs, used for rate limiting, fraud prevention and troubleshooting.
- Cookies and local storage: a strictly necessary sign-in cookie (
wa_session), and optional preferences (theme, currency) kept in your browser. Website analytics run only if you accept them.
3. Why we use it (and legal basis)
- To provide, secure and support the service and perform our contract with you.
- To process payments, keep accounting records and meet legal obligations.
- To send service messages: sign-in codes, security notices, billing receipts and connection alerts.
- To prevent spam, fraud and abuse, and enforce our terms (legitimate interests).
- For optional analytics and product updates, with your consent, which you can withdraw at any time.
We do not sell personal data. We do not use customers' recipient data for our own marketing.
4. Who we share it with
We share data only as needed to run the service, with providers bound by confidentiality and data protection obligations:
- WhatsApp / Meta, when messages are sent through a number you linked;
- our Philippine SMS provider (Semaphore) and mobile networks, for SMS;
- our email delivery provider (Brevo), for sign-in codes, alerts and OTP email fallback;
- our payment partners (PayPrintables and PayMongo), for checkout;
- Google Analytics, only if you accept analytics;
- our hosting and infrastructure providers;
- authorities, when required by law or to protect rights and safety.
Some providers may process data outside the Philippines. Where they do, we require protection comparable to the Data Privacy Act.
5. Retention
We keep account and service data while your account is active and as long as needed for the purposes above, including billing, security, dispute and legal requirements. Expired OTP challenges and one-time tokens are removed automatically. When you ask us to close your account, we delete or anonymise personal data we no longer need, except records we must keep by law.
6. Security
We use encryption in transit, encryption at rest for linked-account sessions and webhook secrets, hashed API keys and OTP codes, role-based workspace access, rate limiting and audit logs. No system is perfectly secure; we will notify you and the National Privacy Commission of a personal data breach where the law requires.
7. Your rights
Under the Data Privacy Act you have the right to be informed, to access, to object, to correct, to erasure or blocking, to data portability, to damages, and to file a complaint with the National Privacy Commission (privacy.gov.ph). To exercise them, email [email protected]. We may need to verify your identity. If your request concerns messages a business sent you through WAppOTP, we will refer it to that business and help it respond.
8. Data processing for customers
For recipient data you send through the service, we: process it only on your documented instructions (your API calls and settings); keep it confidential; apply the security measures above; use the sub-processors listed in section 4; help you respond to data subject requests and breach obligations; and delete or return it when you close your account, unless the law requires us to keep it. You confirm you have a lawful basis to share it with us.
9. Children
WAppOTP is a business service for people aged 18 and over. We do not knowingly collect children's data for our own purposes.
10. Changes and contact
We will post updates here with a new effective date and notify account owners of material changes. Data protection contact: PRINTABLES.PH CONSUMER GOODS TRADING, [email protected].