Iskola Cebu

Privacy policy

Last updated: May 12, 2026

Iskola Cebu (the "site") is a chat-based directory of private schools, therapy clinics, and learning programs in Cebu, Philippines. This page explains what information we collect, why, and how it is used. Plain English, no legal jargon where we can avoid it.

Who runs this site

Iskola Cebu is operated by Allan Ninal (Cebu, Philippines). For any privacy question or data-access request, send a message via LinkedIn. LinkedIn is the canonical contact channel so we can verify you are a real person and not a bot.

What we collect from chat users

  • Your messages. When you type in the chat, your message text is sent to the AI provider (OpenRouter, currently routing to OpenAI GPT-5 mini) for processing.
  • Anonymized turn logs. We store a record of each chat turn in Amazon Web Services (AWS) S3, with personally identifying information (phone numbers, email addresses, long ID numbers, common name introductions like "ako si name") removed by a regex scrubber. We keep the scrubbed text for 90 days for product analytics + improving the chat\'s responses.
  • Session ID. We hash your IP address with a salt that changes weekly to make a short session identifier. We do not store your raw IP. The hash cannot be reversed.
  • Token + latency metrics. How many input/output tokens your turn used, the model that answered, and the latency. Used for cost monitoring.

What we collect from signed-in users

If you sign in with Cognito (Amazon\'s identity service) to use the Shortlist feature, we store:

  • Your email address (used as your account ID).
  • The list of schools you save.
  • Cognito session tokens (kept in your browser\'s localStorage only).

Your email is never sold or shared. You can delete your account by messaging us on LinkedIn (link below); we will remove the email + all saved schools from our database within 7 days.

What we collect from all visitors

  • Google Analytics 4. We use GA4 to count visits and understand which pages are most useful. GA4 sets cookies and reads your IP address, browser, and approximate location. Google\'s privacy policy: policies.google.com/privacy. If you want to opt out, install the Google Analytics opt-out browser add-on.
  • Server logs. AWS CloudFront and AWS Lambda record standard technical logs (request time, response code, region). We do not store these long-term beyond what AWS keeps automatically.
  • localStorage preferences. Your theme choice (light/dark) is stored in your browser via localStorage. It never leaves your device.

What we do NOT collect

  • We do not collect your real name or birthday unless you type them in.
  • We do not collect children\'s information directly. Parents type queries on behalf of children.
  • We do not sell, rent, or share your data with marketers.
  • We do not run third-party ad networks or retargeting pixels.

Who can see your data

How long we keep data

  • Anonymized chat-turn logs: 90 days.
  • Weekly + monthly EQ aggregates: 13 months (no raw text).
  • Signed-in account + shortlist: until you ask us to delete.
  • GA4 data: per Google\'s defaults (currently 14 months).

Your rights under the PH Data Privacy Act

Under Republic Act 10173 (Data Privacy Act of 2012), you have the right to be informed, to object to processing, to access your data, to correct it, to delete it ("right to erasure"), and to data portability. Message us on LinkedIn for any of these. We respond within 7 working days.

Cookies

We use cookies for two things:

  • Google Analytics (`_ga`, `_ga_*`) — measure traffic. Opt-out link above.
  • Cognito auth tokens — only set after you sign in, and only readable by this site.

We do not use advertising cookies, marketing cookies, or cross-site tracking.

Changes to this policy

If we update this page, we change the "Last updated" date at the top. Significant changes will be announced in the chat for at least 7 days before they take effect.