Tuplok Privacy Policy

Version 1.1 · Effective August 4, 2026

Tuplok ("we," "us," "our") is committed to protecting your personal data in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).

This Privacy Policy explains what data we collect, why we collect it, how we protect it, and your rights as a data subject.

1. Who we are

Tuplok (tuplok.app) is a web application that helps Filipino teachers generate DepEd school forms such as the Summary of Grades, SF2, SF9, SF10, and certificates.

For your own account data, Tuplok acts as a Personal Information Controller. For student data that you upload, Tuplok acts as a Personal Information Processor — you, the teacher (and your school), remain the Personal Information Controller of your learners' records, and we process that data solely on your instructions to generate your forms.

2. Data we collect

a. Account data (from you, the teacher). When you sign in with Google, we receive your name, email address, and profile photo. During setup, you may also provide your school name, division, position, and the sections you handle.

b. Learner data (uploaded by you). To generate school forms, you upload learner information such as names, Learner Reference Numbers (LRN), sex, birthdate, grades, and attendance records. Learner education records are treated as sensitive personal information and are handled with heightened protection.

c. Payment data. Pro subscriptions are currently paid via GCash. To activate your subscription, you send a payment receipt to Tuplok's Facebook Page via Messenger. We do not store your payment reference number, GCash PIN, wallet balance, or any financial account details — payment confirmation is done manually by visually reviewing the receipt you send.

d. Technical data. Like most web services, we automatically collect limited technical information (IP address, browser type, timestamps) needed to operate and secure the service.

3. Why we process your data

We process personal data only for the following purposes:

1. To create and manage your Tuplok account;
2. To generate the school forms you request (the sole purpose for which learner data is processed);
3. To process your subscription payments;
4. To provide customer support when you contact us;
5. To secure the service, prevent abuse, and comply with legal obligations.

We do not sell personal data. We do not use learner data for advertising, profiling, analytics products, or any purpose other than generating your forms.

4. Legal basis

We rely on the following lawful bases under the Data Privacy Act: your consent (given when you create an account and upload data), the necessity of processing to fulfill our contract with you (generating your forms), and our legitimate interests in securing and operating the service. For sensitive personal information of learners, processing is carried out on your instruction as the controller, consistent with Sections 12 and 13 of RA 10173.

By uploading learner data, you confirm that you are the learners' teacher or authorized school personnel, and that the processing falls within your school's lawful educational purposes.

5. How we access and store your data

Tuplok stores your account and student data using Supabase, a secure cloud database provider. Your data — including student records, grades, and attendance — is hosted there and protected by access controls built into the platform.

Who can access your data:

• You — through your own logged-in account, for your own school's records only.
• Tuplok's founder — may access data directly through the database when responding to a support request, performing account setup (such as granting Founding Teacher access), or maintaining the system. This access is manual and not automated; Tuplok does not currently maintain an automated log of when this occurs.
• Service providers we use to operate Tuplok (listed below) — each has access only to what's needed to perform their specific function.

Third-party services that process your data:

• Supabase — database and account hosting; sees all data you enter into Tuplok.
• Google — sign-in (OAuth); sees your name, email address, and profile photo; governed by Google's own privacy policy.
• Vercel — runs the Tuplok web application; sees data passing through the app as you use it.
• Our document-generation infrastructure — generates your downloadable forms (SF9, Grade Slips, etc.); sees student names, grades, and related data needed to produce the document you requested.
• Resend — sends account-related emails (e.g. access notifications); sees your name and email address only.
• Sentry — helps us detect and fix technical errors; sees technical error details only, configured not to collect your personal data or the content of your submissions.
• Facebook Messenger — used to receive your GCash payment receipt for manual subscription activation; Meta may process the receipt image and any message content you send, subject to Meta's own privacy policy.

We do not sell your data. We do not share it with advertisers. These providers are used solely to operate Tuplok's core functionality.

Some of these providers store data on servers located outside the Philippines. Where data is transferred abroad, we take reasonable steps to ensure a comparable level of protection as required by the Data Privacy Act.

6. How long we keep your data

We keep your account and uploaded data for as long as your account is active. If you delete your account, or ask us to delete specific records, we remove them from our active systems within thirty (30) days, except where a longer retention period is required by law. Rendered documents are generated on demand and are not retained on the rendering server after conversion.

7. How we protect your data

We implement reasonable organizational, physical, and technical security measures, including encrypted connections (HTTPS/TLS), access controls limiting who can view data, authentication via Google OAuth rather than stored passwords, and isolation of each teacher's data from other accounts.

No system is perfectly secure. In the event of a personal data breach affecting your data, we will notify the NPC and affected data subjects in accordance with NPC Circular requirements.

8. Your rights as a data subject

Under Republic Act No. 10173, you have the right to:

1. Be informed about how your data is processed;
2. Access the personal data we hold about you;
3. Object to processing, including for direct marketing;
4. Rectify inaccurate or incomplete data;
5. Erasure or blocking of data that is unlawfully processed or no longer necessary;
6. Data portability — obtain a copy of your data in a usable electronic format;
7. Damages for violations of your rights;
8. Lodge a complaint with the National Privacy Commission (privacy.gov.ph).

To exercise any of these rights, email us at tuploksupport@gmail.com. We will respond within a reasonable period and in accordance with the timelines set by the NPC.

If you are a parent or learner and have concerns about learner data uploaded by a teacher, you may contact us, and we will coordinate with the teacher or school concerned, who remains the controller of that data.

9. Children's data

Tuplok accounts are for teachers and school personnel only. Learner data, including data of minors, is uploaded and controlled by teachers as part of their official educational functions. We process it strictly for form generation and apply heightened safeguards appropriate to sensitive personal information.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced on tuplok.app, and the "Effective" date above will be updated. Continued use of the service after changes take effect constitutes acceptance of the revised policy.

11. Contact us

For privacy questions, requests, or complaints:

Tuplok
Email: tuploksupport@gmail.com

You may also contact the National Privacy Commission: privacy.gov.ph