Privacy policy

Scope & operator

This draft covers the Fidescript public website and connected account, document, attorney application, appointment, development identity and configured communication workflows. Synthetic mock data stays separate from connected API data.

The legal operator name, business address, personal information controller and Data Protection Officer or accountable privacy contact are not confirmed for publication. Those details and an accessible request channel must be completed by the operator before this draft can become an effective notice.

Information handled

The implementation can handle the following information, depending on the workflow and configured providers:

• Account name, email, password hash, role, sessions and account profile information.
• Uploaded PDF bytes, titles, metadata, checksums, annotations, document revisions and draft acknowledgements.
• Attorney commission information, professional credential PDFs, application status and review reasons.
• Appointment participants, selected documents and revisions, time slots, availability, status and preparation checkpoints.
• Communication text, read state and access leases when the relevant integrations are configured.
• Development identity consent versions, attempt references, minimal outcomes and audit records. Capture media is processed through the configured identity verification service; the application does not persist capture media or full provider responses.
• Security and operational records such as request identifiers, rate-limit information and workflow audit events.

Documents and identity workflows may involve sensitive personal information. Development and test use must use synthetic records.

Purposes & lawful processing

The implemented purposes are account access, document preparation, internal credential review, appointment coordination, configured communications, eligibility decisions and operational security. This description does not select a lawful basis for every activity.

The operator and counsel must map each processing activity to an applicable basis, including a separate assessment for sensitive information and identity processing. Workflow consent records do not automatically authorize all other processing.

The Philippine Data Privacy Act calls for transparency, legitimate purpose and proportionality. Counsel must assess the specific requirements in sections 12 and 13. See the Data Privacy Act of 2012.

Access & service providers

Customers access owned resources. Attorneys access resources within the applicable assigned appointment and eligibility rules. Administrators review credentials within qualifying ENP applications. These roles do not confer unrestricted access to private files.

Depending on the features in use, Fidescript works with service providers that support account authentication, data and document storage, live-presence checks, communications and application hosting. These services help operate the relevant platform workflows; this does not give other users unrestricted access to your information.

The operator must confirm actual providers, processor roles, contracts, subprocessors, recipients, hosting and processing locations, cross-border safeguards and any required notices. No region or data processing agreement is asserted by this draft.

Storage, retention & deletion

Private PDFs are not served as public assets. Access checks, immutable revisions and checksum validation protect the implemented preparation workflow. These safeguards do not complete production storage security or privacy operations.

Document deletion is constrained by workflow state and retained appointment preparation records. An action that removes a document from a list must not be understood as erasing every revision, audit record, backup or provider copy.

No approved comprehensive retention schedule is documented for accounts, documents, identity outcomes, communications, audit records or backups. The operator must define retention criteria, deletion and reconciliation procedures, legal holds and provider disposal arrangements. This draft promises no deletion deadline.

Your privacy rights

Subject to applicable conditions and exceptions, Philippine privacy law provides rights to be informed, access, object, correction, erasure or blocking, data portability, damages and complaint. See the NPC’s overview of data subject rights.

The operator must establish a verified request channel, proportionate identity checks, response procedures and an escalation process. These are unresolved operational requirements; this page does not offer an automated rights-request service. A public privacy contact is not yet published.

The NPC’s right-to-be-informed guidance informs the outstanding notice details. Privacy complaints may also fall within the National Privacy Commission’s remit, subject to its procedures.

Cookies & browser storage

Authentication uses essential session cookies. The development demo uses browser session storage for synthetic state. No optional analytics or advertising tracker was found in the reviewed public application. See the Cookie Policy draft for verified configuration and remaining deployment checks.

Review before activation

Before activation, the operator and counsel must complete operator identity and contact details, lawful-basis mapping, provider and transfer disclosures, retention and rights procedures, incident response, eligibility requirements and the final notice version.

Review must account for the Data Privacy Act implementing rules and applicable NPC guidance. This draft does not establish legal compliance. It has no effective date and does not replace a versioned workflow consent. Approved future revisions need an explicit publication and change-notice decision.