Privacy Notice

Contact

Controller: [FILL exact SEC registered name]. Principal office: [FILL SEC-registered principal office]. Privacy inquiries: vaelryn@axonenjin.com

Who may use Vaelryn

[LEGAL REVIEW] You can join Vaelryn if you are under 18, but only with permission from your parent or legal guardian. We ask for your date of birth and your guardian's email. We email your guardian, and nothing is set up until they agree to the account. Your guardian chooses, one by one, whether we can score your skills, show tiers or rankings, let others contact you, and send you emails. Members under 18 are not listed in Discover or on search engines. [LEGAL REVIEW] We do not collect education records from members under 18. [OWNER DECISION] Until they say yes, your profile is private, you are hidden from Discover and search engines, and no adult or organisation can message you. Tiers are never used to decide what a member under 18 can access. You or your guardian can change these choices, withdraw, or ask us to delete everything at any time at vaelryn@axonenjin.com. When you turn 18, we ask you to agree in your own name within 30 days [OWNER DECISION]. If you do not, the account is frozen, then deleted after a further 60 days [OWNER DECISION]. [LEGAL REVIEW] If you are under 13, you cannot make an account. [OWNER DECISION] A guardian request that is not finished is deleted after 7 days [OWNER DECISION]. The guardian's link lasts 72 hours [OWNER DECISION]. Withdrawal stops processing right away, inside 48 hours [OWNER DECISION]. Deletion runs when asked, inside 15 days [OWNER DECISION]. Backups roll off within 30 days [OWNER DECISION]. The consent log is kept after deletion for 3 years [OWNER DECISION]. An unused minor account is deleted after 12 months of inactivity [OWNER DECISION], with 30 days' notice. Controller: [FILL exact SEC registered name]. Principal office: [FILL SEC-registered principal office].

What we collect

• Account information: display name, email address, Google account identifier, and profile image from Google sign-in. Adults: birth year. Members under 18: date of birth, encrypted, reduced to the birth year at 18, plus the guardian's name, email, relationship, and consent choices.
• Profile fields you enter, such as username, tagline, biography, contact details, and card appearance choices.
• Work and evidence records you add, including education and academic records you choose to submit.
• GitHub access token stored encrypted on our servers when you connect GitHub, plus repository metadata we fetch with your permission.
• Linked-account identifiers held through Composio when you link other platforms.
• Validation decisions about your records, including reviewer notes stored with those decisions.
• Security and audit logs of important account and profile actions.

Why we use it

• To create and secure your account and profile.
• To store, display, and verify the work records you choose to publish.
• To operate linked sources you connect and to send sign-in email when email delivery is enabled.
• To protect the service, investigate abuse, and maintain an audit trail.

Legal basis

We rely on your consent, including separate consent to process education records adults add. Sensitive personal information under RA 10173 includes education records. Members under 18 are not asked for education records. [OWNER DECISION] [LEGAL REVIEW]

Who processes data for us

• Vercel hosts the application.
• Neon stores the database in Singapore.
• Google provides sign-in.
• GitHub provides repository access when you connect it.
• Composio holds linked-account connections.
• Resend delivers magic-link email when configured.

These providers may process data outside the Philippines.

Retention

• We keep your account data until you delete your account.
• Unconfirmed profile-build drafts are deleted seven days after a build finishes, or sooner if you discard them.
• Audit logs are append-only during normal operation. When you export and delete your account, we remove your profile, evidence, score snapshots, consents, connections, sessions, and audit events tied to you, after best-effort revocation of external tokens. The guardian consent log keeps the email hash, the time, the notice version, and the items ticked. The key to the rest is destroyed. [LEGAL REVIEW]

What is public

Nothing is public until you publish your profile. Biography, contact details, and your S-E band are separate choices. The band is private by default and only appears to others when you turn on public band visibility in Settings.

Automated decisions

We do not use AI to decide whether a record is verified. Verification is handled by organizers through the validation workflow.

Sales and ranking

We do not sell personal data. Nobody can pay to change rank or placement.

Your rights under RA 10173

You may request to be informed, access, object, erase or block, rectify, and receive a copy of your data. Settings includes export and account deletion, which also removes a waitlist entry and feedback stored for that email. A waitlist or feedback entry can also be deleted at /privacy/delete. You may lodge a complaint with the National Privacy Commission at privacy.gov.ph.

Changes

We may update this notice. The effective version is 2026-10-20. We will ask you to accept updated terms when required.