Privacy Policy & Cookie Notice

1. Who we are

React Web Development Services ("React Web Development Services", "we", "us") is a web application development and digital marketing studio based in Pulong Santol, Porac, Pampanga, Philippines. For the purposes of Republic Act No. 10173 (the Data Privacy Act of 2012, "DPA") we act as Personal Information Controller for data collected through this website, and as Personal Information Processor for data we handle on behalf of clients under a services agreement.

Registered name: React Web Development Services
Registered address: Pulong Santol, Porac, Pampanga, Philippines 2008
Data Protection Officer: Kristian Bansil — dpo@reactdigital.ph
General contact: info@reactdigital.ph · +63 949 605 3048

2. What we collect, and when

We do not collect anything simply because you read a page. Data reaches us only through a specific action you take.

When	What	Why (lawful basis, DPA §12)
You submit the contact form	Name, company, email, mobile, area of interest, budget range, your message, and your consent tick	Your consent (§12[a]), and the necessity of responding to your enquiry (§12[b] — steps preparatory to a contract)
You use the Advisor	The guided answers stay in your browser. If you type a free-text question, that text is sent to our server and to our AI provider to generate a reply	Your consent, by choosing to type a question (§12[a]); legitimate interests in operating the tool (§12[f])
You complete checkout	Name, company, email, mobile, notes, the scope and amount, and a reference code. We never receive your card details	Performance of a contract (§12[b]); compliance with tax and bookkeeping obligations (§12[c])
Any request to our server	IP address, timestamp, and the request itself, in short-lived operational logs and for rate limiting	Legitimate interests in security and abuse prevention (§12[f])
You save a cookie preference	Your choice per category, and the date you made it	Necessary to honour and evidence your own choice

We do not knowingly collect data from children under 18. We do not collect sensitive personal information as defined in DPA §3(l) — race, health, religion, political affiliation, government identifiers and the like — and we ask that you do not send it to us. If you do, we will delete it.

3. Cookies and browser storage

This website sets no advertising or profiling cookies, and no analytics cookie unless you allow one. Google Analytics 4 is the single third-party tag here. It loads only after you allow the analytics category, and it runs with Google Signals and ad personalisation disabled, so it measures pages read and never builds an advertising audience. There is no Meta Pixel and no other third-party tag. Typefaces are self-hosted, so your browser requests no font from Google whatever you choose.

Allowing analytics lets Google set _ga and _ga_<id> on your device to tell repeat visits apart. Withdrawing consent expires both and stops further measurement in the same click — Google Ireland Limited acts as our processor for this, and data may be processed outside the Philippines under their standard contractual terms.

What we do store on your device:

Name	Type	Purpose	Lifetime
`reactph-cart`	localStorage	The quote the Advisor built, so checkout can show it	Until you clear it
`reactph-consent`	localStorage + first-party cookie	Your cookie choices, so we can honour them	6 months

All three are strictly necessary: they exist to deliver a feature you asked for, they are first-party, and none of them profile you or leave your device. Under the DPA and prevailing NPC guidance, strictly necessary storage does not require prior consent — but we disclose it anyway, because you should be able to know.

Analytics is switched off until you allow it, per category, and advertising measurement is not used at all. You can review or change your choices at any time: . Withdrawing analytics consent expires the Google cookies immediately as well as stopping collection. Clearing your browser storage removes what we store and we will ask again.

We honour Global Privacy Control and Do Not Track. If your browser sends either signal we treat all non-essential categories as declined and do not show you a banner.

We do not sell personal data, and we do not share it for advertising. We use a small number of processors, each only for the purpose named:

PayPal Pte. Ltd. (Singapore) — payment processing. If you pay online you are redirected to PayPal's own hosted page and enter your details there. Card numbers never reach a React Web Development Services server. PayPal's own privacy policy and cookies apply on that page. Because PayPal serves the Philippines from Singapore, paying online transfers your payment data outside the Philippines; you can avoid that by paying by bank transfer instead, which is offered at checkout alongside it.
Anthropic PBC (United States) — powers the Advisor's free-text replies. Only the text of your question and the conversation so far are sent. Do not include confidential or personal information in a free-text question; the guided flow requires no personal data at all.
OpenAI, L.L.C. (United States) — powers the Quote Assistant, the chat that helps you finalise a scope and submit it. Only the text of your messages and the items in your basket are sent. As with the Advisor, do not put confidential information in a free-text message.
Laravel Cloud (hosting, running on Amazon Web Services) and Microsoft Corporation (transactional email delivery via Microsoft 365). They process data only to run and deliver the service.

Cross-border transfer. Some of these providers process data outside the Philippines — in Singapore (PayPal), the United States (Anthropic, OpenAI, Microsoft) and the European Union. Under DPA §21 we remain accountable for your data wherever it is processed, and we require contractual protections from each provider. By submitting a free-text question or a payment you consent to that transfer for the stated purpose.

Paying online is the transfer you can most easily avoid: bank transfer is offered alongside it at checkout and keeps your payment data with your bank and ours, both in the Philippines. We issue a reference code either way and neither method changes your price.

We may also disclose data where compelled by a lawful order of a Philippine court or a competent authority, or where necessary to establish or defend a legal claim.

5. How long we keep it

Enquiries that do not become projects: 24 months, then deleted.
Client and project records: for the life of the engagement and then 10 years, as required for books of account under the National Internal Revenue Code and BIR regulations.
Advisor free-text conversations: not retained beyond what is needed to generate the reply and to investigate abuse.
Server logs: short-lived, and no longer than 90 days.
Consent records: for as long as the consent is relied on, plus a reasonable period to evidence it.

6. Your rights under the Data Privacy Act

DPA §16 gives you the following rights, and we will act on any of them free of charge within 15 working days of a verified request:

To be informed — that your data is being processed, and how.
To access — a copy of what we hold and where it came from.
To object — including to processing based on consent or legitimate interests, and to any automated decision-making.
To rectification — correction of anything inaccurate.
To erasure or blocking — where the data is incomplete, outdated, unlawfully obtained, or no longer necessary.
To data portability — an electronic copy in a structured, commonly used format.
To damages — for inaccurate, incomplete, outdated, false or unlawfully obtained data.
To lodge a complaint — with us first, and with the National Privacy Commission regardless of our answer.

To exercise any of these, email dpo@reactdigital.ph with enough detail to identify your records. We may ask you to verify your identity — that is to protect you, not to delay you. If we cannot fully comply we will tell you why, and which right we are relying on.

You may also contact the National Privacy Commission: 5th Floor, Delegation Building, PICC Complex, Pasay City · info@privacy.gov.ph · privacy.gov.ph.

7. How we protect it

HTTPS on every connection; HSTS in production.
No card data on our systems — payment details go directly to PayPal. What we store against a payment is the reference, the amount, the date and the payer name and email PayPal returns to us.
Access limited to staff who need it, under confidentiality obligations.
Request size limits and rate limiting on every endpoint that accepts input.
Encrypted backups, and prompt dependency patching.

No system is perfectly secure, and we will not claim otherwise. In the event of a personal data breach likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the affected data subjects within 72 hours of knowledge of the breach, as required by NPC Circular No. 16-03.

8. Data we process for clients

When we build or run systems for a client, any personal data in those systems belongs to the client, who is the Personal Information Controller. We act as Processor under a written Data Processing Agreement covering purpose limitation, confidentiality, security measures, sub-processors, breach notification and return or deletion on termination. If your data sits in a system we operate for a client, please direct your request to that client — and tell us, and we will help them answer you.

9. Changes

If we change how we process data — in particular if we introduce analytics or advertising — we will update this page, raise the version number, and ask for consent again where the law requires it. Material changes will be announced on the site rather than made quietly.

10. Contact

Data Protection Officer: dpo@reactdigital.ph
General: info@reactdigital.ph · +63 949 605 3048
Pulong Santol, Porac, Pampanga, Philippines 2008