Privacy notice
Emails, text messages, and authenticator apps show this portal as Reset Workflow.
About this demonstration
This is not an official T.I.P. privacy policy. The project administrator who invited you operates the demonstration account; contact them for privacy questions or requests.
Student records
Student number, name, birthday when supplied, email, program and year level identify and display your demonstration account. A birthday is not a recovery secret or sufficient proof of identity.
Security and activity data
The service stores hashed passwords, encrypted authenticator keys, hashed backup and verification codes, recovery status, policy acknowledgment and security event timestamps. Hashed request identifiers and IP addresses help limit abuse. Hosting and delivery services may also process technical connection and delivery information.
Your optional phone
Only you enter and verify a mobile number for verification and recovery SMS. Declining phone setup does not block authenticator-based recovery. Assistance requests store your submitted contact and explanation with internal review notes. Never include passwords, codes or identity documents.
Who can access information
Authorized administrators see academic details, enrollment status and audit events. The admin interface does not display your phone number, password, authenticator secret, OTPs or backup codes. Restricted server and database operators can access data needed to operate the service; interface masking is not anonymization.
Service providers
Supabase stores account data. Netlify hosts the site and server functions. Resend processes recipient emails and transactional email content. UniSMS processes phone numbers and SMS content. Cloudflare provides domain services. Data is processed as needed for each provider's role. Infrastructure may be outside the Philippines.
Your choices and requests
Phone setup is optional. You can change a number after verification. Contact the project administrator who invited you to request access, correction, phone removal, account deletion, or to raise a concern. The assistance form can request help reaching them but is not proof of identity. Privacy requests need appropriate verification.
Retention and deletion
Expired codes and links cannot be used, but their database records are not automatically deleted. There is currently no scheduled deletion of student records or audit history. Records remain until an authorized operator removes them. Ask the project administrator about retention before supplying personal information. The owner must approve a defined retention schedule before real institutional use.
What your acknowledgment means
The checkbox records that you have read this notice, with its version and timestamp. It is separate from agreeing to terms and from choosing optional phone recovery. It is not blanket consent to unrelated use, marketing or sharing. Use fictional profile details and dedicated test contacts during demonstrations. No technical measure makes data risk-free.
Reference: National Privacy Commission — transparency, legitimate purpose and proportionality. This notice does not claim legal certification or institutional approval.
Opened this from setup? Close this tab to return to your form. Nothing is accepted on this page.