Privacy Policy

This policy explains how Wyvern Innovations, also known as Wyvern Corp., handles personal information on the corporate website at wyvern.com.ph. It is written for clients, applicants, and other people who visit the site or send an inquiry. It is not a claim that the company holds a certification from the National Privacy Commission or any other body.

1. What we collect on this website

The public pages can be read without an account. The contact form collects the name, email address, phone number, company name, and message that a person chooses to type, together with a timestamp and a technical token used to stop duplicate sends. The inquiry record does not store the sender’s IP address.

The site keeps a short security log of the IP address used to submit the form, so that one address cannot send an unlimited number of messages. Those log entries are deleted after two days. Failed sign-in attempts to the staff area are also recorded with an IP address and username so the company can slow repeated guesses. That area is not part of the public site.

Staff who sign in receive two cookies, each kept for eight hours: a session cookie that the browser does not expose to scripts, and a matching token used to block forged requests. Public visitors do not receive those cookies. The site does not use an analytics or advertising cookie.

Delivering a page can create an ordinary host log: the address requested, the time, the browser type, and the IP address. Loading the typeface contacts Google Fonts. The contact page’s map contacts Google Maps. A journal article may include a video from youtube-nocookie.com, and playing it contacts Google. If a bot check is switched on, the form also contacts Cloudflare. That check is not switched on unless its key is configured. None of these contacts is an advertising profile built by Wyvern.

The website does not scrape personal information from other sites. Publicly available information is not treated as consent to collect it. NPC Advisory No. 2026-01, issued on 13 April 2026, applies if a future project scrapes personal data. That activity is not part of this website, and it would need its own purpose, lawful basis, notice, and privacy impact assessment before it starts.

2. Why the information is used

• To answer the inquiry a person submitted. The form is accepted only after the person ticks the agreement box. That tick is consent for this purpose. The person can withhold it and use the telephone or email instead.
• To protect the site from repeated or automated submissions, based on the company’s legitimate interest in keeping the form available.
• To operate the staff journal and administration area for people the company has authorized.
• To meet a legal duty, including a duty under the Data Privacy Act of 2012, if one applies to a specific request.

The company does not sell personal information and does not use the contact form for advertising. The form is not sent to an artificial intelligence model.

3. How information is stored and who receives it

An inquiry is stored in the website’s database and emailed to hello@wyvern.com.ph so the team can reply. The email is sent through Resend when that service is configured. The site is hosted on Vercel. Production hosting has used servers in the United States, and the email service may process the message outside the Philippines. A cross-border transfer contract for those providers was not found in the website records. That gap is disclosed here rather than described as a completed safeguard.

Google receives the technical data needed to load fonts and, on the contact page, the map. Staff with an administrator or editor role can open inquiry records. Other roles cannot.

4. How long information is kept

Rate-limit records are removed after two days. Sign-in attempt records are removed after one day. Inquiry records have no automatic deletion date in the system. They are kept so the company can answer and follow up, and they are deleted when the person asks or when the company no longer needs them for that conversation. A fixed retention schedule has not been approved for publication. Host logs follow the host’s own period, which this website does not set.

5. Security

Public pages are served over HTTPS. Secure requests also send HTTP Strict Transport Security. The site uses a content security policy, stores staff passwords with a one-way hash, and limits how often the form and the sign-in can be tried. These are the controls built into this website. They are not an ISO certification, a National Privacy Commission seal, or a promise that a breach cannot occur.

If a breach involves personal information the company holds, Wyvern will assess it and notify the National Privacy Commission and affected people when the Data Privacy Act and its rules require notice.

6. Your rights

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you may ask to be informed, to access your personal information, to correct it, to object to processing, to have it erased or blocked, and to receive it in a portable form where that right applies. You may also complain to the National Privacy Commission. You may withdraw the consent given on the contact form. Withdrawal does not undo a reply already sent, and the company may keep a record if a law or an unresolved inquiry requires it.

Write to hello@wyvern.com.ph. Include enough detail to find the record, and expect the company to confirm that the requester is the person concerned before it releases or deletes information. Do not send medical records or passwords in that email. A published response deadline was not found; the company will answer a complete request without undue delay.

7. Automated processing and artificial intelligence

This website does not make an automated decision about a person and does not send form contents to an AI system. Wyvern’s separate commitments for AI work are in the AI Policy. NPC Advisory No. 2024-04, dated 19 December 2024, applies the Data Privacy Act to AI systems that process personal data. It is relevant to those systems, not to the reading of these public pages.

8. Changes

If the website starts collecting a new category of personal information, using an analytics tool, or sending information to an AI provider, this page will be updated first. Continued reading of the public pages is not consent to a new use of personal information. A new use that depends on consent will ask for that consent at the time.