Privacy Policy

Depending on how you use the platform, we may collect:

• Account and authentication data: email address, user identifier, authentication provider details (such as email OTP or Google sign-in), and session information.
• Google sign-in data:if you choose “Continue with Google,” we receive your name, email address, Google account ID, and profile photo from Google. We do not receive your Google password.
• Profile data: display name and profile fields you choose to provide.
• Learning activity data: practice attempts, simulation attempts, answers, scores, timestamps, and related progress history.
• Saved content data: bookmarked questions and related study preferences.
• Feedback data: question reports, issue categories, and optional feedback or suggestion text you submit.
• Cookies and similar technologies: we use cookies and browser local storage for authentication sessions and product analytics. See Section 4 for details.
• Technical and usage data: device type, browser type, operating system, IP address, page views, and request metadata collected through analytics and error monitoring tools.

Note: PostHog (product analytics) and Sentry (error monitoring) are active in all production deployments of Aral2x. These tools collect usage and technical data automatically when you use the platform.

We use collected information to:

• Authenticate users and secure account access.
• Operate reviewer features and save your attempts, bookmarks, and progress.
• Improve question quality and prioritize content fixes from user reports.
• Maintain platform reliability, detect abuse, and troubleshoot incidents.
• Measure feature usage and improve user experience through analytics.
• Send transactional messages related to your account, such as OTP login codes.
• Comply with legal obligations, including the Philippine Data Privacy Act (RA 10173), and enforce platform rules.

Under the Philippine Data Privacy Act (RA 10173) and applicable privacy laws, we process your personal data on the following bases:

• Contract performance: processing necessary to provide the platform and its features to you.
• Legitimate interests: analytics, error monitoring, and platform security — balanced against your privacy rights.
• Legal obligation: compliance with RA 10173 and other applicable Philippine laws.
• Consent: where required (e.g., optional analytics cookies), we obtain your consent and you may withdraw it at any time.

Aral2x uses cookies and browser local storage for the following purposes:

You can manage cookie preferences through the consent banner shown on your first visit, or by contacting us at info@aralaral.ph. Disabling analytics cookies will not affect your ability to use the platform.

Aral2x uses the following third-party service providers to operate core platform functions. These providers process data on our behalf under their own terms and privacy policies.

• Supabase — authentication, database storage, and related infrastructure. Data is stored in Supabase-managed servers. See supabase.com/privacy.
• Google OAuth— optional sign-in via Google. When you use “Continue with Google,” Google shares your name, email, Google account ID, and profile photo with us. See policies.google.com/privacy.
• PostHog — product analytics. PostHog collects usage events, session data, and an anonymous user identifier. PostHog is active in all production deployments. See posthog.com/privacy.
• Sentry — error monitoring and crash reporting. Sentry collects technical error data including stack traces and browser/device context. Sentry is active in all production deployments. See sentry.io/privacy.

We do not sell your personal data. We may share information:

• With service providers listed in Section 5 that host or support the platform.
• To comply with Philippine law (including RA 10173), legal process, or valid government requests, including the National Privacy Commission.
• To investigate abuse, fraud, or security issues affecting the platform.
• As part of a merger, acquisition, financing, or asset transfer involving Aral2x, subject to applicable law. We will notify you of any such change via email or a prominent notice on the platform.

We retain your data for as long as needed to operate the platform and meet legal obligations. Specific timelines:

Under the Philippine Data Privacy Act (RA 10173) and applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data, subject to legal retention requirements.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent (e.g., analytics cookies), withdraw it at any time without affecting the lawfulness of prior processing.
• Data portability — request your learning data in a structured, machine-readable format.
• Lodge a complaint — file a complaint with the National Privacy Commission (privacy.gov.ph) if you believe your rights have been violated.

To exercise any of these rights, email us at info@aralaral.ph. We will respond within 15 business days as required by RA 10173. Some requests may require identity verification and may be limited where data must be retained for security, legal, or operational reasons.

Aral2x is committed to compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

• Data Protection Officer (DPO): Aral2x has designated a Data Protection Officer responsible for overseeing compliance with RA 10173. The DPO can be reached at info@aralaral.ph.
• NPC Registration: Aral2x will register with the National Privacy Commission as required under RA 10173 and its implementing rules. Registration status will be updated in this policy when completed.
• Privacy Impact Assessment: we conduct privacy impact assessments when introducing new features that materially affect the processing of personal data.
• Data Breach Notification: in the event of a personal data breach that poses a real risk of serious harm, we will notify affected users and the National Privacy Commission within 72 hours of discovery, as required by law.

For privacy-related questions, data subject requests, or concerns:

• Email: info@aralaral.ph
• Data Protection Officer: info@aralaral.ph (mark subject line: “Privacy / DPO Request”)
• National Privacy Commission (for unresolved complaints): privacy.gov.ph

We aim to respond to all privacy inquiries within 15 business days.