Privacy Policy

1. Scope and accountability

This draft applies to personal information submitted to or generated by the public MelonPixels site, including contact inquiries and site communications. It does not replace the privacy notice for a client website that MelonPixels may design or host. Each client should publish its own notice for information collected from that client's customers and visitors.

For this draft, MelonPixels is the proposed personal information controller for processing where it decides the purpose and means. The contracting entity and any controller/processor allocation for client websites must be confirmed before launch.

2. Controller and contact

Working operator name: MelonPixels. Contact for privacy questions, access requests, corrections, or complaints: jeromeley@melonpixels.com. The current service location is Nuvali, Laguna, Philippines; no street address is published in this draft. The legal entity or registration name, principal address, and any appointed data protection officer or privacy contact remain to be confirmed by the operator and Philippine counsel.

This site does not publish a street address, registration number, or named data protection officer. The operator and Philippine counsel must confirm the legal entity name, principal address, privacy contact/DPO appointment (if required), and the notice address to be used in the effective version.

3. Information we may collect

We aim to collect information that is adequate and not excessive for the stated purpose. Depending on the journey, this may include:

• Identity and contact: name, business/company, email address, phone number, and preferred location.
• Inquiry details: service interest, marketing goal, project context, and the message you choose to send.
• Booking details: selected date and time, timezone context, company, contact details, and optional call notes.
• Subscription and onboarding: selected plan, checkout status or reference, business description, audience, goals, brand/content materials, and domain information.
• Communications and preferences: correspondence with us and any consent or opt-out choices you record.
• Technical context: limited device, browser, referrer, timestamp, IP, security-log, and usage data that may be generated by hosting, fraud prevention, or an enabled analytics provider. The exact fields and providers must be inventoried before publication.

Do not submit payment-card numbers, passwords, government identification numbers, health information, or other sensitive personal information through a public form. If a project genuinely needs sensitive information, the secure channel and lawful basis must be agreed in writing first.

4. Purposes and lawful processing

We may use information to respond to a question, assess whether a MelonPixels plan fits, arrange a requested call, create and administer a subscription or onboarding record, deliver and support a website service, protect the site and accounts, send service communications, measure site performance where permitted, and meet a legal or accounting duty where one applies.

The effective notice must map each activity to the applicable criterion under Sections 12 and 13 of the Data Privacy Act and its implementing rules. This draft treats an inquiry or booking as processing needed to take steps at the person's request; a signed/accepted service as processing needed to perform a contract; required recordkeeping as processing needed for a legal obligation; and optional analytics or marketing as processing based on a clear, withdrawable consent where required. A legitimate-interest basis is not relied on here unless counsel documents necessity, balancing, and an opt-out.

Withdrawing consent does not invalidate processing already carried out lawfully. It may prevent an optional feature from working, and we may retain a minimal suppression record so that an opt-out is respected.

5. Sharing, processors, and transfers

We may give access to people who need it to answer an inquiry or deliver an agreed service, professional advisers where appropriate, and a public authority where lawfully required. Any access should be limited to the stated purpose and subject to confidentiality and security requirements.

The current repository stores inquiries in development JSON or production Postgres and can notify the operator through Resend when configured. No payment processor, calendar/meeting provider, checkout, or onboarding provider is active on this site. The final notice must list the actual providers, purposes, locations, contracts, and retention settings.

A provider may process data outside the Philippines. Before launch, the operator and counsel must document the destination, transfer instructions, safeguards, data-sharing or outsourcing terms, and any notice or consent required. No particular country or adequacy status is promised by this draft.

6. Client website data

A MelonPixels-built site may receive information for the client business (for example, a client's contact form or booking request). The client ordinarily decides why that information is collected and should be identified as the controller in the client's own notice. MelonPixels' role, instructions, permitted sub-processors, security duties, breach cooperation, deletion/return, and cross-border terms must be set in the applicable service agreement before that data is collected.

7. Retention and deletion

We propose retaining each category only for as long as needed for the stated purpose, a live client relationship, dispute handling, security, or a legal/accounting obligation. Exact periods and a deletion owner are open decisions, not a promise in this draft.

• Inquiries: until resolved, then the confirmed follow-up or suppression period.
• Bookings: until the appointment and reconciliation are complete, then the confirmed operational period.
• Subscriptions and onboarding: for the relationship, billing, handover, and any applicable limitation or tax period.
• Support and project files: for the term and the agreed handover/archive period, subject to client instructions.
• Security and consent records: for the period needed to investigate abuse, demonstrate choices, and honor withdrawals.
• Backups and provider logs: according to the approved provider schedule and deletion capability.

The local JSON store used for development must be replaced or explicitly isolated before production data is accepted. The final schedule should state what happens when a person asks for deletion but a legal hold or mandatory recordkeeping duty applies.

8. Security and incidents

MelonPixels should use reasonable organizational, physical, and technical safeguards appropriate to the risk, including least-privilege access, secure transport, secrets management, provider agreements, backups, logging, and an incident response process. This draft does not certify that any particular control, security audit, breach notification deadline, or data-protection registration is in place.

If an incident affects personal information, the operator will investigate, contain, document, and notify affected people or the National Privacy Commission when required by applicable law and NPC issuances. The responsible incident contact, escalation route, and notification template remain to be confirmed.

9. Your rights and how to ask

Subject to the Data Privacy Act, its implementing rules, and applicable exceptions, a data subject may have rights to be informed, access personal information, correct or dispute inaccurate information, object to certain processing, request erasure or blocking, obtain portability where applicable, and file a complaint. The exact scope, identity checks, fees (if any), response channel, and response periods must follow the effective procedure approved by counsel.

Email jeromeley@melonpixels.com with the subject “Privacy request” and enough context for us to locate the record. We may ask for reasonable proof of identity and clarification. We will not ask you to send passwords or payment-card details. If you are not satisfied after contacting us, you may consult the National Privacy Commission's complaint process.

10. Children and sensitive information

The site is directed to business decision-makers, not children. We do not knowingly seek information from children. If a parent, guardian, or person discovers that a child submitted information, contact us so counsel-approved verification and deletion steps can be considered.

11. Changes to this notice

We may revise this notice when the service, providers, purposes, or law changes. The effective version will show a new date and status, identify material changes in plain language, and be published before relying on a materially different purpose where notice or consent is required.

12. Open decisions before publication

• Confirm the legal entity/controller name, principal address, privacy contact, and any data protection officer.
• Inventory every live host, storage system, payment, calendar, email, analytics, advertising, and support provider.
• Approve lawful-basis mapping, consent language, cookie controls, cross-border safeguards, and client-site processor terms.
• Set category-level retention periods, deletion/return workflow, legal-hold rule, and breach response owners.
• Confirm whether registration, notification, or other NPC filings are required; this draft claims none.

Related documents

• Privacy Policy
• Cookie Policy
• Terms and Conditions
• Service Agreement
• Refund Policy

Reference sources

These working notes draw on the sources below. They are included for review and do not represent a legal opinion, registration, certification, or approval of this draft.

• National Privacy Commission — Republic Act No. 10173 (Data Privacy Act of 2012)
• National Privacy Commission — Implementing Rules and Regulations of Republic Act No. 10173
• National Privacy Commission — Data Subject Rights
• National Privacy Commission — Filing a Complaint