Privacy Policy

98Labs is a software engineering studio based in the Philippines and is the data controller under the Data Privacy Act — meaning we decide why and how your personal data is processed. This policy is governed by the laws of the Republic of the Philippines. To ask anything about your data, or to exercise any right in this policy, email our privacy contact at email us.

• Contact form: the name, email address, and message you choose to send us.
• Analytics (opt-in): if you accept in the consent banner, privacy-friendly analytics record page views and rough usage — never form field contents, and no cross-site advertising profiles.
• Security/abuse prevention: bot-protection and rate-limiting services may process your IP address and a browser token transiently, to protect the service from automated abuse.
• Server logs: our hosting provider keeps short-lived technical logs (timestamps, request status) for reliability and security. Our application audit logs intentionally exclude your name, email, and message.

We do not collect sensitive personal information (e.g. health, race, religion, government IDs), biometrics, or data about children.

• To respond to your inquiry (contact form) — based on your consent and our legitimate interest in doing business with you.
• To improve the site (opt-in analytics) — based on your consent, which you can withdraw anytime.
• To keep the service secure (bot protection, rate limiting, logs) — based on our legitimate interest in preventing fraud and abuse.

Analytics loads only after you choose Accept in the consent banner. If you Decline, no analytics runs. You can change your choice anytime by clearing this site’s storage in your browser. We use first-party cookies/local storage only; we do not use third-party advertising trackers.

We don’t sell or rent your data. We share data only with the following categories of service providers, each bound to protect the data they handle on our behalf:

• Email delivery — delivers the message you send through the contact form.
• Analytics — provides opt-in, privacy-friendly analytics (only after you accept).
• Bot protection — screens the contact form for automated abuse.
• Rate limiting — caps abusive request volume (sees only an IP-derived counter, never your message).
• Cloud infrastructure & hosting — hosts this website and the service that handles form submissions.
• Code hosting & deployment — stores our source code and runs automated deployments.

This list is representative, not exhaustive — we may add or change providers over time, always under the same protections.

Some of the service providers above process data outside the Philippines (for example, our cloud-hosting and analytics providers). Under the Data Privacy Act, we don’t transfer your personal data abroad without ensuring there are sufficient safeguards — such as binding contractual obligations or a comparable level of protection — and we keep transfers limited to what each service needs.

• Contact submissions are kept only as long as needed to respond and for a reasonable follow-up window, then deleted.
• Analytics data is retained per our analytics provider’s settings and your consent.
• Security logs are short-lived and rotated for operational use.

When data is no longer needed, we delete or anonymize it.

We apply industry-standard measures: TLS/HTTPS encryption in transit, secrets stored securely and never committed to our code, least-privilege access controls, rate limiting and bot protection on the public form, security scanning of our software dependencies, and structured audit logging that intentionally excludes the contents of your submissions. No method is perfectly secure, but we work to keep risk low. If a personal data breach occurs that the law requires us to report, we’ll notify the National Privacy Commission within 72 hours — and affected individuals where there’s a risk to them.

Under Section 16 of the Data Privacy Act (Rights of the data subject), you have the right to:

• be informed whether we hold data about you;
• access a copy of your personal data;
• object to its processing;
• have inaccurate data corrected (rectification);
• have data erased or blocked when no longer needed, or if consent is withdrawn;
• data portability;
• damages for any harm caused by unlawful processing; and
• file a complaint with the National Privacy Commission.

To exercise any of these (free of charge), email email us. We’ll respond within a reasonable period and may verify your identity before acting. If you’re not satisfied, you can complain to the National Privacy Commission.

This site may link to third-party sites we don’t control. Their privacy practices are their own — please review them.

We may update this policy. Material changes will be reflected by the “Last updated” date above. Continuing to use the site after a change means you accept the updated policy.

Questions about this policy or your data? Email email us — that’s also how to reach our privacy contact for data subject requests.