Privacy Policy

Upskwela is the personal information controller for the platform data described in this policy. Creators may separately act as controllers for information they collect to deliver their own events, coaching, products, or communities.

Privacy requests may be sent to hello@upskwela.com. Please use the subject “Privacy Request.”

This policy applies to the Upskwela website, accounts, communities, creator tools, purchases, payouts, support channels, and related platform services.

• Account data, including name, email, username, password hash, and login methods.
• Profile, community, course, event, message, review, and uploaded content.
• Creator and merchant verification data, including verified legal name, government-ID details, liveness or face-match results, verification status, and provider session references. Didit processes the submitted document images and biometric checks.
• Billing, purchase, payout, refund, chargeback, shipping, tax, and access-entitlement records processed with payment providers such as Xendit.
• Security and usage data, such as request logs, hashed network identifiers, browser or device information, analytics identifiers, and fraud or moderation signals.
• Creator assessment and demo-request data, such as where you found Upskwela, readiness responses and scores, role, goals, obstacles, preferred support, intended offers, business stage, audience and sales ranges, expected learners, launch timeline, current tools, organization, and public creator profile.
• Support requests, reports, complaints, appeals, counter-responses, investigation material, and communications. For copycat, impersonation, or intellectual-property reports, this may include source URLs, screenshots, ownership or license evidence, declarations, and relevant correspondence.

• Perform our contract by operating accounts, purchases, access, and payouts.
• Verify creators and merchants after a completed sale or when they have an available payout balance, require verification before payout, and prevent one verified identity from operating multiple accounts without review.
• Detect scams, account takeovers, payment abuse, and policy violations.
• Investigate complaints, preserve evidence, resolve disputes, and defend legal claims.
• Review suspected deceptive copying, impersonation, confusing branding, or unauthorized content and give affected parties an opportunity to provide relevant evidence.
• Meet tax, accounting, consumer-protection, and lawful government requests.
• Maintain, measure, troubleshoot, and improve the platform.
• Assess creator readiness, recommend the appropriate onboarding path, route demo requests, and personalize creator follow-up.

Our legal bases under the Data Privacy Act include contract performance, consent where required, compliance with law, protection of lawful rights and interests, and legitimate business purposes that are compatible with your rights. Government identifiers and biometric verification data receive additional safeguards as sensitive personal data.

Identity verification becomes available after a creator or merchant's first completed sale or when they have an available payout balance, and must be completed before payout. Didit hosts the verification flow and may process government-ID images, document details, a selfie or liveness capture, face-match results, device and network signals, and duplicate or blocklist matches.

Upskwela stores the verification status, legal name, provider session reference, and a keyed, non-reversible document fingerprint used to detect another account presenting the same verified document. We do not store the raw document number in that fingerprint. Potential face, device, or network matches may be sent to manual review and are not treated as conclusive proof by themselves.

Before redirecting you, Upskwela shows the verification disclosure and records the notice version and time when you affirmatively choose to continue.

After Upskwela records a terminal verification result, our API asks Didit to delete the verification session and its associated feature records. Didit may still retain limited audit or deleted-session records for its configured retention window or where law requires. We also request session deletion when an account is closed.

We disclose only the data reasonably needed for the service or lawful purpose. Current categories include:

• Xendit for payments, payment methods, customers, and payouts.
• Didit for identity, document, liveness, duplicate, and fraud checks.
• Cloudflare and AWS-compatible infrastructure for delivery, storage, and security.
• Convex for realtime profiles, conversations, and notifications.
• PostHog for product analytics and error or usage measurement.
• Resend for service email; Google and Apple for optional sign-in; reCAPTCHA for abuse prevention.
• Creators or learners where necessary to complete a purchase or deliver an offering.
• Authorities, courts, advisers, or counterparties when required by law or needed for a legal claim.
• A person whose account or content is the subject of a complaint, but only to the extent reasonably necessary to explain the allegation, request a response, or resolve the dispute. We may withhold reporter contact details when disclosure is unnecessary or could create a safety risk.

Some providers process data outside the Philippines. We use provider terms, access controls, and other reasonable safeguards for cross-border processing.

A documented legal hold may pause deletion for specific records when a complaint, chargeback, investigation, subpoena, or reasonably anticipated claim exists. When the hold and applicable retention period end, scheduled cleanup removes or de-identifies the retained identity and security records.

You can delete your account from Settings. We immediately disable sign-in, revoke sessions, anonymize the ordinary profile, hide or archive creator surfaces, remove the stored avatar object where applicable, and replace the realtime display profile with a deleted-user label.

Deletion does not erase records that must remain for completed purchases, taxes, fraud prevention, disputes, or legal claims. Before anonymization, the limited identity evidence needed for those purposes is encrypted in a restricted retention record. A keyed email fingerprint and any verified-document fingerprint prevent silent creation of another account during the retention period. Contact support if you need a closed account reviewed.

We use controls appropriate to the data, including encryption in transit, encryption of closed-account identity evidence, keyed fingerprints instead of raw matching identifiers, restricted access, session revocation, logging, and data-minimization jobs. No system can guarantee absolute security.

• Be informed about processing and request access to your personal data.
• Request correction, blocking, deletion, or limits where the law permits.
• Object to processing and withdraw consent when consent is the legal basis.
• Request data portability where applicable.
• Complain to the Philippine National Privacy Commission or seek lawful damages.

We may deny or limit deletion only for records still necessary for law, legal claims, fraud prevention, legitimate business purposes, or existing purchaser rights. We will explain the applicable reason when responding to a verified request.

Upskwela is not intended for children who cannot lawfully consent or enter the relevant agreement without a parent or guardian. Contact us if you believe a child submitted data without the authorization required by law.

We will update the effective date and request renewed acceptance when a material change requires it. For access, correction, deletion, objection, portability, or other privacy concerns, email hello@upskwela.com.