Privacy Policy for Adult Users

This Privacy Policy explains how [LEGAL BUSINESS NAME], doing business as Aralio (“Aralio,” “we,” “us,” or “our”), collects, uses, shares, and protects personal information about adult users of the Aralio tutoring marketplace and related services (the “Platform”) at araliolearning.co.

This Policy applies to Parents, Tutors, applicants, authorized personnel, and adult visitors who create or control an Aralio account. It is written in plain language to help you understand your rights under the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and relevant National Privacy Commission (NPC) issuances.

Information about Students below 18 is handled under the separate Children’s Privacy Notice, because a Parent or legal guardian manages the Student profile and authorizes the processing of the Student’s information. Where this Policy refers to “you,” it means the adult account holder.

This Policy is a notice about data processing. It works together with the Terms of Service, the Cookie Notice, and any role-specific terms or onboarding disclosures presented to you. If a specific consent is required for an optional purpose, we will ask for it separately and you may withdraw it at any time.

We collect only the categories of personal information reasonably necessary to operate, secure, and improve the Platform, and to meet our legal obligations. The main categories are described below.

Information you provide directly

• Account and identity information: full name, email address, mobile number, password, and role (Parent or Tutor).
• Profile information: profile photo, display name, location (city or region), short biography, and subjects or learning needs.
• Verification information: government-issued ID details, professional licenses, certifications, or background-check references where applicable.
• Booking and payment information: booking references, payment method references (such as GCash or Maya transaction IDs), payment amounts, and Aralio Credits activity.
• Messages and content: messages you send through the Platform, reviews, support requests, and any files you choose to upload.

Information collected automatically

• Device and usage data: device type, browser, approximate location (region or city), pages viewed, and features used.
• Logs and security data: login events, authentication tokens, IP address, and records created by automated safety or fraud-prevention tools.
• Cookies and similar technologies: described in detail in Section 10 and in the separate Cookie Notice.

Information from other sources

With your permission or as needed to operate a feature, we may receive limited information from service providers you authorize, such as an authentication provider, a payment provider, or a video-meeting tool. We do not buy personal data from data brokers.

Providing your personal information is voluntary, but some information is required to create or use an account. If you do not provide required information, we may not be able to register you, confirm a booking, or process a payment.

Under the DPA, we must have a lawful basis for processing your personal information. The table below lists the main categories of processing we carry out, the lawful basis we rely on, and the legal or contractual consequence if you choose not to provide the information.

Where we rely on consent, you may withdraw it at any time by updating your preferences or contacting us at the email in Section 13. Withdrawing consent does not affect processing that was already carried out before withdrawal, and it does not remove processing that we must continue under a different lawful basis.

We use your personal information to:

• create, verify, and manage your account and role on the Platform;
• match Parents with Tutors and help you discover, request, and manage tutoring sessions;
• process payments, administer Aralio Credits, issue refunds or adjustments, and reconcile transactions;
• provide in-Platform messaging and booking-related communication between adult account holders;
• maintain safety, moderate content, prevent fraud and abuse, and meet child-safeguarding obligations;
• respond to support requests, complaints, and disputes, and keep records required by Philippine consumer-protection and tax law;
• improve, secure, and troubleshoot the Platform, and develop new features;
• comply with legal obligations and cooperate with lawful requests from authorities; and
• send optional service updates or marketing, only where you have consented.

We do not sell your personal information to third parties. We do not use Student information, session content, or private messages to train advertising or public AI models. Any new processing purpose that is incompatible with the original purpose will be disclosed to you before it begins, and we will seek consent where the law requires it.

We share your personal information only as described in this Policy, and only with the categories of recipients listed below.

Other users on the Platform

To facilitate bookings and tutoring, limited profile information is visible to other users. For example, a Parent may see a Tutor’s public profile, subjects, and reviews, and a Tutor may see the booking details and the minimum Student information needed for an accepted or active booking.

Service providers

We use trusted service providers for hosting, authentication, payment processing, video meetings, email, and analytics. These providers process your information only on our behalf and under appropriate data-processing agreements, and only for the purpose we instruct.

Authorities and lawful requests

We may disclose personal information where required by Philippine law, court order, or a lawful request from a competent authority, and in particular where necessary to protect a child, prevent fraud, or respond to a safety incident. We aim to disclose only what is reasonably necessary.

Business transfers

If Aralio is involved in a merger, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to applicable privacy law and the protections in this Policy.

Aralio is a Philippine business serving Filipino families. However, some of our service providers (for example, hosting or video-meeting tools) may process or store data outside the Philippines.

Where personal information is transferred to a country outside the Philippines, we take reasonable steps to ensure it is protected to a standard consistent with the DPA. This includes using providers that offer appropriate safeguards, entering into data-processing agreements, and limiting the transfer to what is necessary for the service. We will inform you if a transfer is subject to materially different risks.

We keep your personal information only as long as necessary for the purposes described in this Policy, and then delete or anonymize it, unless a specific legal obligation requires longer retention. The table below sets out our general retention periods.

When retention ends, we either permanently delete the personal information or anonymize it so that it can no longer identify you. Information that must be retained for longer under a legal obligation will be kept securely and used only for that specific purpose.

We use reasonable technical, organizational, and physical measures to protect your personal information against unauthorized access, accidental loss, alteration, or disclosure. These measures include encryption in transit, access controls limited to authorized personnel, authentication for sensitive actions, and logging for security review.

No system is perfectly secure. You also play an important role by keeping your login credentials confidential, using the verification features we provide, and reporting suspected unauthorized access promptly. If a personal-data breach occurs that is likely to give rise to a serious harm or risk, we will notify affected users and the National Privacy Commission as required by the DPA.

Under the DPA, you have rights over your personal information. Subject to limited exceptions (for example, where data must be retained by law), you may exercise the following rights:

• Right to be informed: to be told what data we collect, why, and how it is used, as set out in this Policy.
• Right to object: to object to processing based on legitimate interest or carried out for direct marketing.
• Right to access: to request a copy of the personal information we hold about you.
• Right to rectification: to correct inaccurate or incomplete information.
• Right to erasure and blocking: to request deletion or blocking of data that is no longer necessary or was unlawfully processed.
• Right to damages: to claim compensation for damages sustained due to inaccurate, incomplete, outdated, false, or unlawfully obtained data, or unauthorized processing.
• Right to data portability: where applicable, to receive your data in a structured, commonly used format.
• Right to file a complaint: to lodge a complaint with the National Privacy Commission if you believe your rights have been violated.

To exercise any of these rights, contact us using the details in Section 13. We will verify your identity before acting on a request and aim to respond within a reasonable period. Where we cannot comply (for example, because retention is legally required), we will explain why.

We use cookies and similar technologies to operate the Platform, keep you signed in, remember your preferences, protect against fraud, and understand how features are used. Some cookies are strictly necessary and cannot be disabled. Others, such as optional analytics cookies, are used only with your consent.

You can manage or delete cookies through your browser settings. Disabling necessary cookies may affect your ability to sign in or use the Platform. Full details, including the categories of cookies and how to control them, are set out in our separate Cookie Notice.

Aralio does not allow children below 18 to create or control accounts. A Parent or legal guardian creates and manages any Student profile and authorizes the processing of the Student’s information.

Information about Students below 18 is governed by our separate Children’s Privacy Notice, which explains what Student information is collected, why, who may access it, how long it is retained, and how a Parent can exercise privacy rights on behalf of a Student. This Policy does not expand the purposes for which Student information may be used.

If you believe a child has provided personal information to us without a Parent’s authorization, please contact us at the email in Section 13 so we can investigate and take appropriate action.

We may update this Privacy Policy to reflect changes in our practices, the Platform, or applicable law. When we make material changes, we will update the “Last reviewed” date and, where appropriate, provide notice through the Platform or by email. We encourage you to review this page periodically.

Changes do not retroactively reduce your rights. Where the law requires your consent for a new processing purpose, we will ask for it before the processing begins. If you do not agree with a material change, you may close your account as described in Section 9.

If you have any question, request, or complaint about how we handle your personal information, please contact our Data Protection Officer or privacy team first:

If you are not satisfied with our response, you have the right to lodge a complaint with the National Privacy Commission of the Philippines:

Contacting the NPC does not prevent you from pursuing other remedies available under Philippine law.