Privacy notice.

Leap Studios (the creative business space at 2235 Chino Roces Avenue, Makati City, Metro Manila, Philippines) is the Personal Information Controller for this notice. The Data Protection Officer is Michael (michael@vortexventuresgroup.com), reachable for any privacy question or request.

Identity & contact: your name, email, phone, photo, and (if you choose) bio and interests. We need these to identify you at the door, contact you about your membership, and let other members find you in the directory if you opt in.

Membership & billing: your plan, contract, payments, invoices, and credit wallet balance. We need these to charge you correctly and produce BIR-compliant receipts.

Use of the space: every desk and meeting room you book, every visitor you bring, every event you attend, every print job, every door entry. We need these to deliver the service and reconcile shared-resource conflicts.

Communication preferences: which emails and push notifications you accept. We respect these strictly.

Device & connection: when you load the app we collect IP address and user-agent for security and abuse detection.

Payment processors (HitPay or Xendit) when you transact, so they can settle the payment. They are the merchant of record for F&B and event ticket orders that we facilitate.

Hosting & infrastructure providers: Supabase (Singapore, ap-southeast-1) for our database and authentication, Vercel for hosting, Resend for email, Cloudinary for images. Each is contractually bound to process data only on our instructions.

Anthropic, when an AI agent in the app helps you (e.g. support chat). We only send what the agent needs to answer your question; we don't sell your data to anyone.

Door, Wi-Fi, and print system providers (Kisi, UniFi, PaperCut) so they can let you in and meter your usage.

Bento and food partners, when you place an order through the app, so they know who is buying what. They are independent merchants — we don't process their payments, we just relay your order.

Meta (Facebook and Instagram), through the Meta Pixel on our public website only — not inside the member or staff app. It tells Meta which public pages were visited and when someone books a tour or sends an enquiry, so we can measure and show our ads. We don't send your name, email or phone number with it. You can limit this with your browser's tracking settings or your Facebook ad preferences.

Our database is hosted in Singapore (ap-southeast-1). Some service providers are in the United States and the European Union. We rely on Standard Contractual Clauses and APEC-CBPR adequacy to move data across borders, in line with Section 21 of the Data Privacy Act.

Active accounts: for as long as your membership is active, plus 30 days after cancellation so we can answer billing or compliance questions.

Financial records (invoices, payments): 10 years per BIR record-retention rules. We minimize these to what the law actually requires.

Audit log entries: 3 years for security and operations review.

When the retention period ends we delete or anonymise the data — automatically where we can, manually otherwise.

You can ask us to: show you what we hold about you (export), correct anything wrong, restrict how we use it, withdraw a consent you previously gave, or delete your account. All of those are self-serve in the app under Settings → Your privacy. We answer within 30 days at the outside.

If we mishandle your data you can file a complaint with the National Privacy Commission at privacy.gov.ph.

We follow the basics that actually matter: TLS in transit, encryption at rest, least-privilege database access via Row Level Security, audit trail on every sensitive action, and a documented breach-notification runbook that triggers within the 72-hour DPA window if anything ever goes wrong.

This is version v1, effective 2026-05-26. If we change it materially, we'll ask you to re-accept the next time you sign in.