Privacy Policy
This policy explains how JCY WOOD WORKS, operating the ARC storefront, collects and protects your personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules. We collect only what running your order requires — nothing is sold or rented to anyone.
1. What we collect
- Order details — your name, email address, phone number and shipping address, provided at checkout or reservation.
- Payment proofs — for bank-transfer orders, the deposit slip or transfer screenshot you upload. Stored in a private bucket readable only by our staff; never public.
- Account data — email and a password, if you create an account. Passwords are hashed by our authentication provider; we never see them.
- Technical data — standard server logs (IP address, browser type) kept briefly by our hosting provider for security and rate limiting.
What we never hold:card numbers, GCash or bank credentials. Online payments happen entirely on PayMongo’s and PayPal’s secure pages; we receive only a confirmation that the order was paid.
2. Why we collect it
- To fulfil your order (contractual necessity) — processing payment, shipping via LBC, sending order emails.
- To verify payments (contractual necessity and legitimate interest) — reviewing uploaded bank-transfer proofs.
- To serve reservations and subscriptions you asked for (consent) — restock alerts and refill payment links. Every such email traces back to an action you took, and you can stop them at any time.
- To keep records the law requires (legal obligation) — sales and tax records.
- To protect the store (legitimate interest) — fraud prevention and abuse limiting.
We do not use your data for advertising or profiling.
3. Who processes it for us
Your data is handled by a small set of service providers acting under contract as our processors:
- Supabase — database, authentication and file storage (payment proofs).
- Vercel — website hosting.
- PayMongo and PayPal — payment processing, under their own privacy policies.
- Resend — transactional email delivery.
- LBC — receives your name, address and phone number to deliver your parcel.
Some of these providers store data on servers outside the Philippines. Where they do, the transfer is protected by contractual safeguards consistent with RA 10173.
4. How long we keep it
- Order records and payment proofs — kept as sales records for as long as tax and accounting law requires.
- Reservations — until the product launches and the reservation is served or expires.
- Accounts — until you ask us to delete yours. Deleting an account removes your profile; order records required by law are retained.
- Server logs — retained briefly, then discarded.
5. How we protect it
The site runs over HTTPS end to end. Database access is guarded by row-level security policies — customers can read only their own rows, and this is audited with an automated probe suite. Payment proofs live in a private storage bucket accessible only through signed, staff-gated requests. Admin functions are restricted server-side to authorized staff accounts.
6. Your rights under RA 10173
As a data subject you have the right to:
- be informed of how your data is processed (this page);
- access a copy of the personal data we hold about you;
- correct data that is inaccurate or outdated;
- object to processing, and withdraw consent for the emails you no longer want;
- request erasure or blocking of data no longer necessary for the purposes above, subject to legal retention;
- data portability; and
- be indemnified for damages from unlawful processing.
To exercise any of these, email juliusyang93@gmail.com from the address on your order or account and tell us what you need. We respond within the periods set by the National Privacy Commission. If you believe your data privacy rights have been violated, you may lodge a complaint with the National Privacy Commission.
7. Cookies and local storage
We use no advertising or analytics cookies. Your cart is kept in your own browser’s local storage until you check out, and a session cookie keeps you signed in to your account. That is the full list.
8. Children
The store is intended for adults. We do not knowingly collect personal data from minors; a parent or guardian who believes a minor has submitted data may contact us to have it removed.
9. Contact
JCY WOOD WORKS — a registered sole proprietorship of Julius Christian Lamson Yang
TIN 438-148-829-00000
Bitas, Cabanatuan City 3100, Nueva Ecija, Philippines
juliusyang93@gmail.com
We will update this policy if our practices change; the date below always reflects the current version.