1. Who we are
MB Digital Design (“MB Digital Design,” “we,” “us,” or “our”) is a Philippine product studio that builds consumer software applications, including AralBuddy, an AI-powered study companion (collectively, the “Services”). Our studio address is U10 RGA Funda-Dalipe, San Jose, Antique, Philippines 5700. You can reach us at (036) 540 6566.
For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173, the “DPA”) and its Implementing Rules and Regulations, MB Digital Design acts as a Personal Information Controller (PIC) for the personal data we collect through our website and apps.
2. Scope of this policy
This Privacy Policy applies to personal data we collect when you:
- visit or interact with our website at mbdigitaldesign.com;
- use our apps, including AralBuddy (aralbuddy.com and its mobile or web apps);
- contact us by email, phone, contact form, or social media; or
- otherwise interact with us in connection with our Services, including any purchases or payments made through our Services.
Individual apps may have their own supplemental privacy notices. Where a supplemental notice exists, it applies together with this policy, and the more specific notice prevails in case of conflict.
3. Personal data we collect
Data you give us
- Contact and inquiry data — name, email address, phone number, and the contents of your message when you use our contact form, call us, or email us.
- Account data — when you create an account in one of our apps: name or nickname, email address, password (stored in hashed form), and, for AralBuddy, grade level or learning preferences you choose to share.
- Content data — questions, study inputs, and other content you submit while using our apps.
- Payment-related data — if you purchase a paid feature or subscription, our payment processor collects your payment details directly. We do not collect or store full card numbers, CVV codes, or e-wallet credentials ourselves; we receive only limited transaction information (such as amount, status, and a reference number) needed to confirm and fulfill your order. See Section 7 for how payment processors handle your data.
Data collected automatically
- Usage and device data — device type, operating system, app version, IP address, general location (city level), pages or screens viewed, and interaction events, collected to keep the Services working and secure.
- Cookies and similar technologies — see our Cookie Policy.
Sensitive personal information
Under the DPA, information about a person’s education is classified as sensitive personal information. Because AralBuddy is an educational app, some data it processes (such as grade level or learning progress) may fall in this category. We process sensitive personal information only with consent (or, for minors, the consent of a parent or legal guardian) or as otherwise permitted by law, and we apply enhanced security measures to it.
We do not ask for, and you should not submit, government-issued ID numbers, full financial account details, or health information through our contact forms or apps unless a specific feature clearly requests it with a separate notice, or unless required for identity verification by a payment processor as described in Section 7.
4. Why we process personal data
- To provide, operate, maintain, and improve the Services;
- To create and manage user accounts and authenticate users;
- To personalize learning experiences in AralBuddy (for example, adjusting practice difficulty);
- To process payments, subscriptions, and refunds for paid features;
- To respond to inquiries, requests, and support tickets;
- To monitor usage, prevent fraud, diagnose problems, and keep the Services secure;
- To comply with legal obligations under Philippine law, including tax, anti-fraud, and anti–money laundering rules applicable to our payment processors; and
- With your separate, opt-in consent, to send product updates or announcements (you may withdraw at any time).
We collect only the personal data that is necessary and proportionate to these declared, specified, and legitimate purposes, consistent with the DPA’s principles of transparency, legitimate purpose, and proportionality. We do not sell personal data, and we do not use it for automated decisions that produce legal or similarly significant effects on you.
5. Legal bases for processing
- Consent — for example, when you tick the consent box on our contact form, opt in to communications, or (for minors) when a parent or guardian consents to a child’s use of AralBuddy;
- Contract — processing necessary to provide a Service you signed up for or purchased, including processing your order and payment;
- Legal obligation — processing required by Philippine law, tax regulations, or lawful orders of competent authorities; and
- Legitimate interests — limited processing such as security monitoring, fraud prevention, and service analytics, balanced against your rights and freedoms.
6. Children’s privacy (AralBuddy)
AralBuddy is designed for students, including children under 18. We follow the DPA and the National Privacy Commission’s guidance on processing children’s personal data, including the NPC Guidelines on Child-Oriented Transparency. In particular:
- Parental or guardian consent. Children below 18 need the consent of a parent or legal guardian to create an AralBuddy account. We use reasonable age-assurance measures appropriate to the risk involved.
- Data minimization by default. We collect the minimum data needed for a child to learn with the app, apply privacy-protective settings by default, and do not show children targeted advertising.
- No profiling for marketing. We do not use children’s data for behavioral advertising or sell it to anyone.
- No payment data from children. Any paid features are purchased and managed by the parent or guardian’s account, not the child’s.
- Best interests of the child. Where this policy or our practices are open to interpretation, we interpret them in the way most protective of the child.
- Parent and guardian rights. Parents and guardians may review, correct, or request deletion of their child’s data, and may withdraw consent at any time, by contacting our Data Protection Officer (Section 15).
7. Sharing and transfers of data
We share personal data only with:
- Service providers (Personal Information Processors) — such as cloud hosting, analytics, email delivery, AI model providers, and payment processing partners that help us operate the Services and accept payments. They may process data only on our documented instructions, under contracts that require DPA-consistent safeguards.
- Payment processors. When you make a payment, your payment details are collected and processed directly by our licensed third-party payment processing partners, which are separately regulated by the Bangko Sentral ng Pilipinas as payment system operators and maintain their own privacy and security standards, including PCI-DSS compliance for card data. We do not control and are not responsible for their independent processing of your payment data beyond the transaction information they share back with us.
- Legal and safety recipients — competent Philippine authorities where disclosure is required by law, or where necessary to protect the life, health, or safety of a person.
- Business transfers — if MB Digital Design is involved in a merger, acquisition, or asset sale, personal data may be transferred subject to this policy’s protections.
Some of our service providers store or process data on servers outside the Philippines. Where personal data is transferred abroad, we remain responsible for it under the DPA’s accountability principle and require contractual safeguards providing a comparable level of protection.
8. Data retention
- Contact-form and phone inquiries — retained for up to 24 months after our last exchange, then deleted, unless a longer period is required for a legal claim.
- Account data — retained while your account is active, and deleted or irreversibly anonymized within 90 days after account deletion, except where retention is required by law.
- Transaction records — retained for the period required by Philippine tax and accounting rules (generally at least 10 years for BIR bookkeeping purposes), even if you delete your account.
- Children’s data — subject to the same limits, and deleted promptly upon a verified request by a parent or guardian, except transaction records the parent’s account is subject to.
- Server logs and analytics — retained in identifiable form for no longer than 12 months.
When retention periods end, we securely delete or anonymize the data in accordance with NPC guidance on secure disposal.
9. Security measures
We implement reasonable and appropriate organizational, physical, and technical security measures as required by the DPA and its IRR, including encryption of data in transit, hashed password storage, access controls on a need-to-know basis, and periodic review of our security practices. Enhanced measures apply to sensitive personal information and children’s data. Payment card data is never stored on our own servers — it is handled exclusively by our BSP-regulated payment processing partners under industry-standard security certifications. No system is perfectly secure, but we work continuously to protect your data against accidental or unlawful destruction, alteration, disclosure, and other unlawful processing.
10. Data breach notification
If a personal data breach occurs that involves sensitive personal information or information that may enable identity fraud, and is likely to give rise to a real risk of serious harm to affected data subjects, we will notify the National Privacy Commission and the affected individuals within seventy-two (72) hours of knowledge of, or reasonable belief in, the breach, in accordance with the DPA, its IRR, and NPC rules on breach management. Our notification will describe the nature of the breach, the data involved, and the measures we have taken to address it.
11. Your rights as a data subject
For a plain-language summary of this section, see our dedicated Your Data Rights page.
Under the DPA, you have the right to:
- Be informed — know whether and how your personal data is processed;
- Access — obtain a copy of your personal data and details about its processing;
- Rectification — have inaccurate or incomplete data corrected;
- Erasure or blocking — request suspension, withdrawal, or destruction of your data where permitted by law;
- Object — object to processing, including for direct marketing;
- Data portability — obtain your data in a commonly used electronic format;
- Damages — be indemnified for damages sustained due to unlawful or unauthorized processing; and
- Lodge a complaint — file a complaint with the National Privacy Commission.
To exercise any of these rights, contact our Data Protection Officer (Section 15). We will verify your identity and respond promptly. Exercising your rights is free of charge, except where the law allows a reasonable fee for repetitive or manifestly unfounded requests.
12. Cookies
Our website uses cookies and similar technologies. Details on what we use, why, and how to manage your preferences are in our separate Cookie Policy.
13. AI features and your data
Our apps use artificial intelligence to generate responses, such as AralBuddy’s study explanations. Inputs you submit to AI features may be processed by third-party AI model providers acting as our processors, under contracts restricting their use of the data. We do not permit our providers to use AralBuddy users’ personal data to train their general-purpose models, and we do not include children’s personal data in any model training. AI outputs are generated automatically and may contain errors; see our Terms of Service and Disclaimer for the corresponding notices.
14. Changes to this policy
We may update this policy from time to time. The “Last updated” date above shows the latest revision. For material changes — especially changes affecting children’s data or payment processing — we will provide prominent notice in the Services and, where required by law, seek fresh consent before the changes take effect.
15. Contact us / Data Protection Officer
Our Data Protection Officer oversees our compliance with the DPA and handles data subject requests:
- Data Protection Officer, MB Digital Design
- Email: dpo@mbdigitaldesign.com
- Phone: (036) 540 6566
- Address: U10 RGA Funda-Dalipe, San Jose, Antique, Philippines 5700
General inquiries: hello@mbdigitaldesign.com.