Privacy policy

Draft for legal review. This policy describes how the platform is built. It must be reviewed and approved by qualified Philippine legal and data-privacy counsel before public launch.

Who we are

SuholTracker is an independent platform. For data-protection questions, contact our Data Protection Officer through the contact page.

What we collect

When you submit a report

• The information you choose to give: incident details, the agency and location, amounts, your description and any files.
• Contact details, only if you choose a confidential report and enter them.
• A hashed version of your tracking code.

What we deliberately do not collect

• We do not store your IP address, device fingerprint or browser details with your report.
• We do not use advertising or third-party analytics trackers.
• We do not require an account, email address or phone number to report.

Security and abuse prevention

To stop spam and attacks, our systems temporarily process network information. IP addresses are converted into keyed hashes before being stored in security logs, and rate-limiting counters expire automatically within 24 hours. If our security provider (for example Cloudflare) shows a human-verification check, that provider processes data under its own privacy policy.

Why we process it

• To review, verify and, with your permission, publish a redacted version of your report.
• To produce aggregated, anonymised statistics in the public interest.
• To keep the platform secure.

Sensitive information

Reports may contain information about alleged offences. We treat all report contents as sensitive personal information: they are encrypted at rest, only authorised reviewers can read them, and every access to evidence is logged.

Sharing

We do not sell or rent data. A moderator may refer a report to an appropriate oversight body; we do not automatically forward reports to the agency involved. We respond to government requests only where legally required, after review by counsel, and we publish the number of such requests in our transparency reports where the law allows.

Retention

• Rejected spam: deleted within 90 days.
• Closed reports: kept for up to five years, then deleted or irreversibly anonymised.
• Security logs: 12 months. Audit logs: as long as the reports they describe, plus one year.

Your rights

Under RA 10173 you have the right to be informed, to access, to object, to erasure or blocking, to rectification, to data portability, and to file a complaint with the National Privacy Commission. Because anonymous reports aren't linked to an identity, we verify requests using the report reference and tracking code.

No absolute anonymity

We work hard to protect you, but no online service can guarantee complete anonymity. Read how to report safely.