Privacy Policy

eXtraLife is an AI-native systems development studio. For the personal data described here, we are the personal information controller.

To reach us about privacy, use the contact form on our homepage and choose “Something else”.

This policy covers this website only. When we build or run a system for a client, the client decides how that system handles its users' data, and we process it on the client's behalf under our written agreement with them.

Information you send us. When you use the contact form, we collect your name, email address, company name (optional), the type of project, and your message. Please don't include sensitive personal information (for example health, government ID or financial account details) in your message.

Abuse-prevention data. To stop spam and automated abuse of the contact form, our server turns your IP address into a keyed one-way hash before counting how many messages it has sent. We store only that hash and a counter, never the IP address itself, and delete them after 2 days. Hashed email addresses are counted the same way.

Server logs. Our hosting provider automatically processes standard request data (such as IP address, browser type, the page requested and the time) to deliver the site and protect it against attacks. These logs are kept for a short period under the provider's own retention settings.

What we don't collect. This website sets no cookies and uses no analytics, advertising or social-media trackers. Our fonts are served from our own domain, so loading a page doesn't send your data to a font provider. If this ever changes, we will update this policy first.

We use personal data only for these purposes, each with a lawful basis under Section 12 of the Act:

• Replying to your inquiry and discussing a possible project. This is processing you requested before entering into a contract with us.
• Keeping the website and form secure, including rate limiting and spam filtering, based on our legitimate interest in protecting our systems and the people who use them.
• Meeting legal obligations, for example responding to a lawful order from a competent authority.

We don't sell or rent personal data, we don't use it for marketing without your separate consent, and we don't make automated decisions about you.

We share personal data only with service providers that process it for us under contract and only as needed to run this website:

• Vercel Inc., which hosts the website and processes server logs.
• Supabase Inc., which hosts the database where contact-form messages are stored.
• Google LLC (Gmail), which delivers a copy of each contact-form message to our studio inbox so we can reply quickly.

These providers may process data on servers outside the Philippines, including in Singapore and the United States. We choose providers that commit to appropriate security safeguards, and we stay responsible for your data when it is processed on our behalf.

We may also disclose data when required by law or to protect our rights, our users or the public.

• Contact-form messages: deleted automatically 24 months after the last activity on the conversation, unless you ask us to delete them sooner. We remove the copies in our email inbox on the same schedule. If your inquiry becomes a project, related correspondence is kept for as long as our agreement with you requires.
• Rate-limit hashes and counters: deleted automatically after 2 days.
• Server logs: kept for the hosting provider's standard retention period.

We use organizational, physical and technical measures appropriate to the data we hold, including:

• Encryption in transit (HTTPS with HSTS) for every page and form submission.
• Database row-level security. Contact-form messages can't be read through the public interface at all; only staff accounts on an explicit allow-list can view them.
• A studio inbox protected by two-step verification, which receives a copy of each message.
• Server-only access keys that are never sent to your browser.
• Rate limiting, spam filtering and strict input validation on every submission.

If a personal data breach occurs that is likely to put you at real risk of serious harm, we will notify the National Privacy Commission and the affected individuals within 72 hours of becoming aware of it, as the Commission's rules require.

Under the Data Privacy Act, you have the right to:

• be informed about whether and how we process your personal data;
• access the personal data we hold about you;
• object to processing, including processing based on our legitimate interests;
• have inaccurate data corrected (rectification);
• have your data erased or blocked when it is no longer needed or was processed unlawfully;
• obtain your data in a portable electronic format;
• be compensated for damages caused by inaccurate, unlawfully obtained or misused data; and
• file a complaint with the National Privacy Commission.

To exercise any of these rights, use the contact form on our homepage and choose “Something else”. We may ask you to confirm your identity first, for example by replying from the email address you used. We will respond as soon as practicable and in any case within 30 days.

If you're not satisfied with our response, you may contact the National Privacy Commission.

This website is meant for businesses and isn't directed at children. We don't knowingly collect personal data from anyone under 18. If you believe a minor has sent us personal data, please contact us and we will delete it.

We may update this policy as the website or the law changes. The date at the top shows the latest version. If a change materially affects how we use data you have already given us, we will tell you before it takes effect. See also our Terms of Service.