Privacy Policy
This policy explains exactly what Purple Logo PH collects when you use our website, our Build-a-Brand ordering tool, or our mobile app, why we collect it, who we share it with, how long we keep it, and how you can get it deleted.
Not to anyone, for any price, ever.
No advertising cookies, no cross-site tracking, no data brokers.
Request deletion in Account. Access closes immediately and cleanup retries if interrupted.
Our database runs in the ap-southeast-1 region.
Who we are
Purple Logo PH ("Purple Logo", "we", "us", "our") is a creative design studio based in the City of San Fernando, Pampanga, Philippines. We have operated since 2014 and provide logo design, brand identity, print collateral, packaging, signage and website design services, primarily to businesses in the Philippines.
For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) we are the personal information controller for the data described in this policy. Where the EU or UK General Data Protection Regulation applies to a visitor, we act as the data controller.
You can reach us any time about privacy at purplelogophmain@gmail.com, by phone on +63 919 348 6372, or by post at City of San Fernando, Pampanga, Philippines.
If you are submitting our app to a workplace or agency review, the contact above is the one to use for privacy correspondence and for data deletion requests.
What this policy covers
This policy applies to everything we operate under the Purple Logo PH name, specifically:
- The website at www.purplelogo.ph, including every page, form and article on it.
- The Build-a-Brand ordering tool, which collects your brand preferences and order details.
- Our mobile application, currently focused on iOS, where you browse services, place orders and follow the progress of design work.
- Email, phone and messaging conversations you have with our studio about a project.
It does not cover third-party websites we link to, such as our Facebook or Instagram pages, which are governed by those platforms' own privacy policies. It also does not cover the internal handling of your data by a client of ours if you interact with a brand we designed.
Information we collect
We collect three kinds of information: what you give us directly, what is gathered automatically when you browse, and the small amount we receive from service providers.
Information you give us directly:
- Contact details. Your name, email address, phone number, and optionally your city or town, when you request a quote or place a Build-a-Brand order.
- Business details. Your business name, industry, and whether your brand is new, being refreshed or growing.
- Brand preferences. The style words you pick, the colour palette you choose or build, and any of our past work you mark as something you like.
- Images you upload. If you upload pictures of designs you like, we store a compressed copy of those images with your order so our designers can see them.
- Voice notes. If you record a voice note on a design, we store the recording so your designer can hear your feedback in your own words. You choose whether to record; typing is always available instead.
- Order contents. The kit and individual design pieces you select, the resulting price, and any discount you win on the bonus spin.
- Free-text notes. Anything you type into a message or notes field, including links you share with us.
- Account credentials. If you create an account in our mobile app, we store your email address and a securely hashed password. We never store your password in readable form.
- Correspondence. The content of emails and messages you send us, and our replies, kept with your order so our team has the history.
Information collected automatically. Website analytics and account-linked app activity are different:
- Website pages viewed. The page and referring website, a browser visitor identifier and device type help us understand site usage. These website records are separate from your signed-in app profile.
- A visitor identifier. A random string stored in your browser's local storage so repeat visits are not counted as new people. It contains no name, email or account link and is not shared with anyone.
- Device type. Whether you are on a phone, tablet or computer.
- IP address and approximate location. Your IP address is used to look up an approximate city, region and country. We store that approximate location with the page view, and we cache the IP address itself so we do not repeat the lookup for the same visitor.
- Local preferences. Your progress through Build-a-Brand and which portfolio pieces you have liked are stored in your own browser so you do not lose them. That data stays on your device unless you place an order.
- App activity. Account-linked last-seen time, the project or conversation currently open, read status and notification preferences support presence, unread indicators and relevant notifications. We have stopped collecting new service-page views for sales profiling; older records are removed with account deletion.
- Device tokens. If you allow notifications, we link an Expo push token to your account to send project updates and team replies. Expo and Apple's push service deliver them. Notification text may include a message preview. You can turn categories off in Account or disable notifications in iOS Settings.
- App reliability. Expo delivers app updates and receives update requests and crash/diagnostic information, including app version and installation identifiers, to help updates load reliably.
We do not use advertising cookies, retargeting pixels, session recording, heatmaps, or any cross-site tracking. We do not build advertising profiles and we do not participate in data broker networks.
Information from service providers includes approximate website location from an IP lookup, email delivery information, and payment status, method, amount and reference from HitPay. We do not buy or rent personal data from data brokers.
How we use your information
We use what we collect only for the purposes below, and we do not use it for anything materially different without telling you first.
Replying to quote requests and questions, preparing an estimate, and following up about a project you asked about.
Confirming your Build-a-Brand order, sending you a payment link, briefing our designers, producing your artwork, and delivering the finished files.
Emailing you about the status of your work, sending proofs for review, and answering your feedback.
Keeping records of orders and invoices, and meeting our tax and accounting obligations.
Understanding website page views and repeat visits. App presence and read state are linked to your account and used for functionality, not AI sales profiling.
Detecting and preventing abuse, spam submissions, fraud and security incidents.
Our lawful bases for processing
Where the Philippine Data Privacy Act, the GDPR or the UK GDPR applies, we rely on the following grounds:
- Performance of a contract. Processing your order, communicating about the work, and delivering your design files.
- Legitimate interests. Understanding site usage in aggregate, securing our systems, preventing abuse, and keeping business records. We have weighed these interests against your rights and use the minimum data needed.
- Consent. Where you upload optional inspiration images or choose to share extra information. You can withdraw consent at any time by contacting us.
- Legal obligation. Retaining transaction records where tax or accounting law requires it.
Under the Philippine Data Privacy Act, we also process personal information on the basis that it is necessary to fulfil a contract with you and to pursue our legitimate interests as a business, in accordance with Section 12 of that Act.
Where your information is held
Our database and server functions run in Singapore. Our hosting and email providers operate globally and may process data in the United States and other countries. This means your information may be transferred outside the Philippines, or outside the European Economic Area and the United Kingdom.
Where such transfers happen, we rely on our providers' contractual safeguards, including the European Commission's Standard Contractual Clauses where applicable, and we choose established providers that publish their security and privacy commitments.
How long we keep information
We keep information only as long as it is useful for the purpose it was collected for, or as long as the law requires.
Up to 24 months from your last contact with us, so we have context if you come back.
Necessary transaction amounts, dates, service/package details, payment references and refund status are retained for applicable tax, accounting, reconciliation and dispute requirements. Deletion removes the account link, personal project content, website-order contact details, payment screenshots and free-text payment notes. A pending checkout reference may be needed to reconcile a late payment; it does not preserve your project or restore your account.
Your finished artwork stays in your brand vault for as long as you keep your account open, so you can download it again years later. It is deleted when you delete your account.
Kept with the order and deleted with it, or sooner on request.
Up to 24 months in our studio mailbox unless it relates to an order, in which case it follows the order.
Page view records for up to 24 months. Cached IP-to-location lookups for up to 12 months.
Kept while your account is open to provide the service. An in-app deletion request closes access immediately. Personal records and files are removed through a retryable cleanup process, normally within minutes; allow up to 24 hours. An opaque deletion receipt is retained for 30 days so the app can confirm completion. Verified email requests are handled within 30 days.
When a retention period ends, we delete the record or irreversibly anonymise it so it can no longer be linked to you.
How we protect your information
- All traffic between your device and our site is encrypted in transit using HTTPS.
- Data at rest in our database is encrypted by our hosting provider.
- Access to customer records is restricted at the database level, so only authenticated members of our studio team can read them. Public visitors can submit a form but cannot read anyone's submissions, including their own.
- Administrative access requires an individual account with a password, and accounts are removed promptly when someone leaves the team.
- Passwords are stored only as salted hashes and are never visible to us.
- Secret keys used by our servers are stored as encrypted environment secrets and never included in the code that runs in your browser.
No system is perfectly secure. If a breach ever affects your personal information in a way that is likely to put you at risk, we will notify you and the National Privacy Commission within the timeframes required by Philippine law, and any other regulator that applies to you.
Your rights over your information
Wherever you are, you can ask us to do the following, free of charge, and we will respond within 30 days:
Ask what personal information we hold about you and why.
Request a copy of your information in a readable format.
Have anything inaccurate or incomplete fixed.
Ask us to delete your information where we have no overriding legal reason to keep it.
Object to processing based on our legitimate interests, or ask us to pause processing while a dispute is resolved.
Receive your information in a structured, commonly used format, or have it sent to another provider.
Withdraw consent you previously gave, without affecting processing already carried out.
Lodge a complaint with a supervisory authority.
Under the Philippine Data Privacy Act you also have the right to damages for inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of personal information, and your rights may be exercised by your legal heirs and assigns.
Residents of California may request disclosure of the categories of personal information collected and ask us to delete it. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We will never discriminate against you for exercising any privacy right.
To exercise any of these rights, email purplelogophmain@gmail.com with the request and the email address or order code you used. We may ask a question or two to confirm it is really you before we act, which protects you from someone else requesting your data.
Deleting your account and your data
You can have your account and the personal information attached to it deleted at any time. We offer two routes, and both are free:
- In the app, open Account and choose Delete account. Download anything you want to keep first, then confirm. Account access closes immediately while personal records and uploaded files are removed.
- Or email purplelogophmain@gmail.com from the address on the account, with the subject "Delete my account". No form, no phone call, no retention offer.
Cleanup removes your profile, projects, chat messages, proof feedback, brand-vault entries, uploads and associated staff-side project copies. It normally completes within minutes. If a storage or network service is unavailable, it retries automatically even after you close the app; allow up to 24 hours. Current app versions show completion only after the server confirms cleanup. An older app may sign you out first while that same server cleanup continues. Contact us if you still need confirmation after 24 hours. Copies in infrastructure backups expire under our providers' backup-retention schedules and are not used as an active customer archive.
What we may keep, and why: the minimum accounting record of paid/refunded orders and payment references required for reconciliation, tax obligations or a dispute. These records are separated from your deleted account and are not used for marketing or to rebuild your profile. Downloaded copies already held by you or recipients cannot be remotely erased. Studio email correspondence and a separate website guest-chat conversation are handled through the privacy contact when they cannot be reliably tied to the account.
If you only want your uploaded images or a specific message removed rather than your whole account, say so and we will remove just that.
Children's privacy
Our services are intended for business owners and are not directed at children. We do not knowingly collect personal information from anyone under 13 years of age, or under 16 where local law sets that higher threshold. Our mobile app is not designed or marketed for children and does not participate in any children's or families programme on the App Store or Google Play.
If you believe a child has given us personal information, contact us and we will delete it promptly.
Human app support and the website assistant
All signed-in app and portal conversations and project-feedback handling are human-operated. The app does not trigger AI replies or AI summaries, and staff cannot hand these shared conversations back to AI. The public website guest assistant is separate: it uses guest-chat history and context to suggest responses and classify enquiries for the team. You can ask for a person or contact us by email or phone instead. Do not send sensitive information to that public assistant. We do not use AI to make decisions with legal or similarly significant effects.
Links to other sites
Our site and app link to places we do not control, including our own social media pages, our printing partner, and articles we reference. Following those links takes you into someone else's privacy policy, and we are not responsible for their practices. We encourage you to read the policy of any site you share information with.
App store data disclosures
The following summary is provided so it can be checked against our App Store privacy details and our Google Play Data Safety declaration. It restates what is described above.
Contact and business information, optional city/province, messages and customer support, photos, audio, briefs and files, purchase/payment records, account and push identifiers, and presence/read-state activity. These are used to operate the app and provide design services. Optional offer notifications use your notification preferences and token.
Expo processes app-update and crash information, which may carry installation identifiers. Website visitor/page-view analytics are separate from app-account activity. We do not describe all usage or technical data as anonymous.
Precise GPS location, contacts, photos library beyond what you deliberately upload, health data, financial account numbers, browsing history on other sites, and advertising identifiers.
None. We do not track you across apps or websites owned by other companies, and we do not share data with data brokers.
All data is encrypted in transit and at rest.
Request deletion from Account. Account access closes immediately; personal data and file cleanup retries if interrupted, with a narrow accounting exception. See the deletion section for timing and confirmation.
Changes to this policy
We update this policy when our practices change or when the law requires it. The date at the top always reflects the current version. If a change materially affects how we handle your personal information, we will tell you by email where we have your address, or with a clear notice on the site before the change takes effect.
We keep prior versions and can provide an earlier version on request.
Contact us and how to complain
For any privacy question, request or complaint, contact us first and we will try to put it right:
- Email: purplelogophmain@gmail.com
- Phone: +63 919 348 6372
- Post: Purple Logo PH, City of San Fernando, Pampanga, Philippines
If you are not satisfied with our response, you may complain to the National Privacy Commission of the Philippines at privacy.gov.ph. If you are in the European Economic Area or the United Kingdom, you may complain to your local data protection authority. If you are in another country, your national privacy regulator can help.
A real person at the studio will answer. Email us and we will come back to you, usually the same day.