DropRegion (“DropRegion,” “we,” “us,” or “our”) is owned and operated by DVFZ Training Consultancy Services, based in the Philippines. This Privacy Policy explains what information we collect when you use dropregion.com (the “Service”), how we use it, and the choices you have. It is written to comply with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). By using the Service, you agree to the practices described here. If you don’t agree, please don’t use the Service.
1. Information we collect
Account information
Publishing requires an account. When you sign up, we collect your email address and the handle you choose. Authentication is handled by our infrastructure provider, Supabase — we never see or store your password in plain text.
Content you publish
Any HTML file you drop, along with associated metadata (title, category, visibility setting, and slug), is stored so it can be served at your public link. We also generate a screenshot preview of each published page for use in the gallery and your channel.
Usage and technical information
We collect information generated by using the Service: likes, follows, bookmarks, site views/bandwidth, API key usage timestamps, and abuse reports filed against a site. We do not run third-party advertising or analytics trackers on the Service.
Cookies and local storage
We use a session cookie (set by Supabase Auth) to keep you signed in, and a small local-storage value to remember your light/dark theme preference. Neither is used for advertising or cross-site tracking.
Collaborator invitations
If you invite someone to view a private site, we store the email address you provide so we can grant that person access once they sign in with a matching account.
2. How we use information
- To create and maintain your account and published sites
- To serve your published pages and their screenshot previews
- To scan submitted content for malware and phishing before it goes live
- To operate gallery ranking, follows, likes, and bookmarks
- To respond to abuse reports and enforce these policies
- To communicate with you about your account, when necessary
3. How we share information
We do not sell your personal information. We share information only with:
- Service providers — Supabase (database, authentication, and file storage) and Vercel (application hosting) process data on our behalf to operate the Service.
- Content-safety providers — when malware/phishing scanning is enabled, submitted content or the URLs it contains may be checked against Google Safe Browsing.
- Other users — content you publish as Public or Unlisted, your handle, and your channel page are visible to anyone with the link, by design.
- Legal reasons — if required to comply with law, enforce our Terms of Use, or protect the rights, property, or safety of DropRegion, our users, or the public.
4. Content moderation and scanning
Every file you publish is automatically scanned before it goes live. Sites that fail this check, or that are later found to violate our Terms of Use, are blocked or removed. Reports filed against a site are reviewed by us and retained to maintain a record of moderation decisions.
5. Data retention
We keep your account and published content for as long as your account is active. When you move a site to trash, it is permanently deleted 30 days later unless you restore it first. You can delete your account at any time from account settings; this removes your published sites and personal information from active systems, subject to any copies we’re required to retain for legal or security purposes.
6. Legal basis for processing
We process your personal information on these legal bases, as required by the Data Privacy Act: your consent (given when you create an account and agree to this Policy); the necessity of processing to fulfill our contract with you (operating the account and sites you publish); and our legitimate interests in securing the Service, preventing abuse, and enforcing our Terms of Use.
7. Your rights under the Data Privacy Act
As a data subject, you have the right to:
- Be informed that your personal information will be, is being, or was processed, including the extent and purpose of that processing.
- Access your personal information that we hold.
- Object to processing of your personal information, including processing for direct marketing, automated processing, or profiling.
- Correct any inaccurate or outdated personal information we hold about you.
- Erase or block your personal information from our systems, including by deleting your account.
- Data portability — request a copy of your personal information in an electronic format, where technically feasible.
- Damages for any harm sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal information.
- Lodge a complaint with the National Privacy Commission (privacy.gov.ph) if you believe your rights under the Data Privacy Act have been violated.
To exercise any of these rights, set a site’s visibility to Public, Unlisted, or Private at any time, revoke an API key from account settings whenever you like, or contact us using the details below — we will respond within a reasonable time and, in any case, within the period required by the Data Privacy Act and NPC rules.
8. Security measures
We apply reasonable organizational, physical, and technical security measures to protect your personal information, including relying on our infrastructure provider’s encryption in transit and at rest, access controls, and hashed (not plaintext) storage of API keys and passwords. No system is perfectly secure, and we cannot guarantee absolute security.
9. Data breach notification
If a personal data breach occurs that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and affected users without unnecessary delay, consistent with the timelines and procedures set by the Data Privacy Act and NPC circulars.
10. Children’s privacy
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.
11. Cross-border data transfers
DropRegion is operated from the Philippines by DVFZ Training Consultancy Services. Our infrastructure providers — Supabase, Vercel, and, where scanning is enabled, Google — may process and store data outside the Philippines. Where this occurs, we require that these providers maintain a comparable level of protection for your personal information as required under the Data Privacy Act. By using the Service, you consent to this transfer and processing.
12. Changes to this policy
We may update this Privacy Policy from time to time. We’ll update the “last updated” date above when we do, and material changes will be reflected prominently on this page.
13. Contact us / Data Protection Officer
Questions about this Privacy Policy, requests to exercise your rights, or privacy concerns can be directed to our Data Protection Officer at contact@digitalventuresfz.com.