Privacy Policy

This site is operated by Repomanta Information Technology Services, a sole proprietorship registered in the Philippines, trading as Repomanta Digital Lab. The proprietor is responsible for how personal data is handled, and is named on the business name registration held by the Department of Trade and Industry.

In the language of the Philippine Data Privacy Act we are the personal information controller for the data described here, and the proprietor is the designated Data Protection Officer, reachable at the address below. In a business this size that is one person rather than a department, which means your enquiry reaches someone who can actually answer it rather than a ticket queue.

Registered address: Daraga, Albay, Philippines. The full registered address is on our invoices and contracts, and available on request. Privacy enquiries, data-subject requests and anything addressed to the Data Protection Officer: build@repomanta.com.

This policy covers personal data we collect about our own visitors, enquirers and customers through this website.

It does not cover personal data we process on behalf of a client inside automations we build for them. In that situation the client decides what happens to the data and we act on their instructions under a separate Data Processing Agreement. If you are a customer of one of our clients, their privacy notice applies, not ours.

Only what the interaction actually requires:

• Contact or quote form — your name, email, and whatever you choose to type. Used to answer you and to quote. Sent with it are the page you submitted from, the site you arrived from (its address only, not the page or the search you typed), and any campaign tags in the link you followed. That tells us which pages actually lead people to get in touch. It is read from your browser at the moment you press send and stored nowhere before that — no cookie, no identifier, nothing kept if you do not submit.
• Booking a call — your name, email and the slot you pick. The booking widget is provided by Calendly and is not loaded at all unless you allow it (see the Cookie Policy).
• Buying a template — your name, email, billing details and the order record. Needed to deliver the product, support it, and keep the tax records we are legally required to keep.
• Becoming a client — business and contact details, tax identifiers, agreements and invoices.
• Visiting the site — your IP address and request details appear in standard server logs kept by our host.

We do not run analytics, advertising pixels or cross-site tracking on this site. There is no Google Analytics, no Meta pixel, no session recording. Nobody is measured for browsing: the only thing we learn about a visit is what the enquiry itself carries, from people who choose to send one. If that ever changes, this policy will change with it and the new provider will be listed in section 4 and gated behind consent.

We do not ask for sensitive personal information, and card details go straight to the payment provider — we never see or store them.

• Consent — for the optional booking embed and for marketing emails. You can withdraw it at any time, and withdrawing is as easy as giving it.
• Performance of a contract — to deliver what you bought or commissioned.
• Legal obligation — tax and accounting records we are required to retain.
• Legitimate interests — answering enquiries and keeping the site secure, balanced against your privacy. You can object to processing on this basis.

Only providers who need it to deliver the service, and never sold, rented or traded. This is the complete list:

We may also disclose data where the law requires it, or to establish or defend a legal claim.

We are based in the Philippines and several of the providers above are outside it, so your data may cross borders. That does not reduce our responsibility for it: under section 21 of the Philippine Data Privacy Act we stay accountable for personal data we hand to a processor, wherever that processor sits.

The safeguards we rely on, in order:

• The provider's data processing agreement. Every provider above is engaged under published terms that bind it to process data only on our instructions and to keep it secure.
• Standard Contractual Clauses. Where a provider offers the European Commission's Standard Contractual Clauses, or the equivalent UK addendum, those clauses form part of that agreement and are the mechanism for transfers out of the EEA or the UK.
• An adequacy or certification framework where the provider holds one — for example the EU–US Data Privacy Framework.

Ask us which of these applies to a named provider and we will tell you, and point you at the document. Email build@repomanta.com.

• Enquiries that do not become work — 24 months, then deleted
• Client records, contracts, invoices and purchase records — Ten years, which is the retention period the Bureau of Internal Revenue applies to books of accounts and their supporting documents, then deleted
• Server logs — As retained by our host for security and diagnostics

Under the Philippine Data Privacy Act — and under other laws where they apply to you — you may ask us to:

• tell you what personal data we hold about you
• give you a copy of it
• correct anything inaccurate
• delete or block it
• stop processing it, or object to processing
• transfer it to another provider
• withdraw consent you previously gave

Email build@repomanta.com and we will respond within 15 days. We may need to verify your identity first — that is a protection for you, not an obstacle.

You can also complain to the National Privacy Commission of the Philippines, our supervisory authority, at privacy.gov.ph, or to your own supervisory authority if you are elsewhere — your national data protection authority in the EEA, or the Information Commissioner's Office in the UK. We would rather you came to us first, but that is your right either way and you do not need our permission to use it.

• Access limited to what a task requires, revoked when it ends
• Credentials held only in a platform's own credential store or an encrypted password manager — never in plain text, chat or email
• Multi-factor authentication on accounts that support it
• Encryption in transit (HTTPS) and device encryption at rest
• Client personal data is never used to train or fine-tune any AI model

No service can promise absolute security. If a breach affects your personal data, and it involves sensitive information or information that could be used against you, we will notify the National Privacy Commission and you within 72 hours of learning of it — the deadline set by the implementing rules of the Data Privacy Act, and by the GDPR where that applies. The notice will say what happened, what data was involved and what to do about it. We will not wait until we have every answer before telling you.

We build with machine assistance, so you are entitled to know exactly what that touches. There are two different things here and conflating them would be misleading, so they are set out separately.

AI tooling we use to build. Scaffolding workflows, writing transformation code and drafting documentation are done with machine assistance working against our written build standards. That tooling operates on workflow structure, code and documentation. We do not put your live records, your customers' personal data or the contents of your systems into it. Automations are built and tested against sample or synthetic data until the logic is correct, and only then pointed at real records. Nothing you give us is used to train or fine-tune any AI model, by us or through us.

AI systems we build for you. Where the thing we deliver is itself an AI system — an agent that classifies your email, extracts fields from your documents or drafts replies — that system does process your data, because that is what you asked it to do. It runs in your own platform and provider accounts, under your contracts with those providers, and the model provider's terms govern that processing. We tell you which providers a build depends on before it is built, so the choice is yours; where personal data is involved, a Data Processing Agreement covers it and the transfer safeguards described above apply.

In both cases a named person reviews what was produced and is accountable for it. Machine assistance is not a decision-maker here, and there is no point in our process where nobody is answerable for what shipped.

This is a business-to-business site and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe we have, tell us and we will delete it.

We may update this policy. The version and effective date at the top of this page always reflect the current one, and material changes will be flagged on the site. Continuing to use the site after a change means the updated policy applies to you.