Privacy Policy

This policy explains what personal data Ulat handles, why, and what rights you have under the Data Privacy Act of 2012 (RA 10173). Ulat is operated by Ulat Software Development Services, a business registered with the Philippine Department of Trade and Industry under Business Name No. 8502298 and with the Bureau of Internal Revenue under TIN 480-293-557-00000. It covers everyone who uses Ulat: instructors on the web app, and students and guardians on the mobile app.

1. What we collect

• Your account. Name, school email, password (stored only as a secure hash), school, department and position if you add them, plan and payment history.
• Class records you create. Student names and student numbers or LRNs from your rosters, scores, attendance marks, remarks and consultation notes. We collect no student emails or contact details from you. A student adds their own email only if they register themselves in the mobile app.
• Technical data. Server logs with IP address and browser type, kept briefly for security and troubleshooting. We use no advertising trackers.
• Payments. PayMongo processes card, Maya, GCash, GrabPay and QR Ph payments. Card numbers never reach our servers. We keep the payment records shown on your Payment documents page.

2. Why we process it

• To run the gradebook you signed up for. This is performance of our contract.
• To show each student their own records and to show guardians a linked student's records, under the sharing policy you set per class.
• To bill subscriptions and keep the payment records tax rules require.
• To keep the service secure and diagnose problems. This is legitimate interest.
• To email you about your account or important service changes. Marketing email would only ever be sent with your consent, and we currently send none.

3. Student data and your role

For roster data, you and your institution decide what goes into Ulat and remain the personal information controller. Ulat processes it on your instructions to provide the service. We never sell personal data, never use student records for advertising, and never train AI models on them. Students see only their own records. Remarks are removed on the server for anyone your sharing policy does not cover.

3a. Students and guardians on the mobile app

A student account holds the student's name, email and a link to their class records. The app then shows that student their own grades, attendance and standing. A guardian account holds the guardian's name and email, and shows only what a linked student shares. Links start from the student's or the instructor's invite. So that links cannot be changed casually, the class instructor removes them: students and guardians can ask the instructor, or email [email protected], to remove a link at any time. For minors, records enter Ulat on the instructor's instructions as part of schoolwork, and we encourage guardians of younger students to manage the account together. Students and guardians can ask about their data or request deletion at [email protected].

4. Who else touches the data

We use a small set of processors to run the service. Our servers are hosted with Contabo in Singapore. Cloudflare provides networking, security and encrypted backup storage. PayMongo processes payments in the Philippines. Each processor handles data only to provide its service to us. Because hosting is in Singapore, your data is stored outside the Philippines with safeguards required by RA 10173. We disclose personal data to authorities only when the law requires it.

5. Security

All traffic is encrypted with HTTPS. Passwords are hashed with bcrypt. Access to production systems is limited and logged. The database is backed up every 6 hours to encrypted storage separate from the main server, with backups kept for 14 days.

6. Retention

We keep your account and class records while your account exists so past school years stay available to you. If you ask us to delete your account, records are removed from the live database right away and disappear from backups within 14 days. Payment records are kept as long as tax rules require.

7. Your rights

Under RA 10173 you can ask for access to your personal data, have errors corrected, ask for deletion, object to processing, and get a copy in a portable format. The Export menu already gives you your class records any time. For anything else email [email protected] and we will respond within 15 working days. You also have the right to complain to the National Privacy Commission at privacy.gov.ph.

8. Changes and contact

If this policy changes in a way that matters, we will show a notice in the app before the change takes effect. Questions go to [email protected].