METACRAFTS PH respects your privacy and follows the Data Privacy Act of 2012 (Republic Act No. 10173) and the regulations of the National Privacy Commission (NPC).

This Privacy Policy explains what personal data we collect through metacrafts.ph, why, who we share it with, how long we keep it, and what choices you have.

1. Who we are

METACRAFTS PH is a custom printing and crafts shop in Caloocan City, Metro Manila, Philippines. We decide why and how your personal data is used, so we are the personal information controller.

For privacy questions or requests, email sales@metacrafts.ph.

2. What we collect

Depending on how you use the site, we collect:

Your account: name, email address, and your date of birth if you give it. Signing in uses a one-time code sent to your email, which expires shortly after it is sent. If you choose Google or Facebook sign-in, we receive your name, email and profile picture from them. We keep a private copy of the picture to show on your account, and replace it each time you sign in.
Orders: name, email, mobile number, delivery address, and any notes you write. We also keep the order and payment record: items, amounts, payment method and payment reference. With a website order we also note how you reached us for that visit, such as a TikTok or Facebook link (the link's tags and the site that sent you), so we know which of our posts lead to orders.
Proof of payment: if you pay by manual transfer, the screenshot of your receipt that you send us.
Digital purchases: which files you bought, the licence you accepted and when, and a record of each download (date, time and IP address).
Enquiries and design requests: your name, email, message, the design you created, and any photos or files you upload.
Saved designs: designs you save in the Design Studio stay in your own browser until you choose to send them to us. Nothing reaches our servers before then.
Monito Monita draws: if you use our free draw tool, the name of your group, the names you type in, the budget and date if you give them, and any wishlist a person writes. No email address or account is needed. Each person's result is shown only through their own private link.
Photo tools: our free ID photo maker, background remover, photo booth prints, photobook maker, photo collage maker, photo frame preview and sticker maker work inside your own browser, and the photos you choose are not uploaded. The photobook maker keeps the book you are making in your own browser so you can come back to it; “Start over” clears it. The Free Tools page also remembers, in your browser, the last few tools you used so it can show them first; “Clear” on that page removes the list. The one exception is when you ask us to print an ID photo, your photo prints, your photobook, your collage, a framed photo or your stickers: then the finished photos or pages, your name, email and mobile number (if given) are sent to us with your request.
Gift tag maker: the tags are made inside your own browser, and the names you type are not sent to us. The one exception is when you ask us to print them: then your design, the names on the tags, and your name, email and mobile number (if given) are sent to us with your request.
QR counter sign maker: the sign is made inside your own browser, and your QR code, Wi-Fi password and logo are not sent to us. The one exception is when you ask us to print it: then the finished sign (with its QR code, and the Wi-Fi password if it carries one), your name, email and mobile number (if given) are sent to us with your request.
Technical data: IP address, browser type and device information, collected automatically for security and to keep the site running.
Messages on Facebook Messenger: if you message our page, Facebook handles that conversation under its own policy.

We do not collect or store your card or wallet credentials. Those go directly to our payment provider.

3. Why we use your data

To create and run your account, and to let you sign in and find your orders and purchased files
To process orders and payments, produce your items, and arrange delivery or pickup
To deliver the digital files you buy and let you download them again
To email you order confirmations, payment confirmations and updates about your order
To answer enquiries and prepare quotes for custom work
To keep the site secure, prevent fraud and spam, and fix problems
To keep the records that tax and accounting laws require

We do not use your data for advertising and we do not sell it.

4. Lawful basis

We process personal data based on:

Consent, when you give us information or accept this policy, for example when you sign up
Contract, to deliver what you ordered
Legal obligation, for example tax and accounting records
Legitimate interest, to keep the site secure and prevent abuse

5. Cookies and browser storage

We use only the cookies the site needs to work:

Session cookie: keeps you signed in, remembers your cart and, for that visit only, which link brought you to the site
Security token (CSRF): protects forms from forgery
"Keep me signed in" cookie: only if you tick that box at sign-in

Your browser's local storage keeps your saved designs in the Design Studio. You can clear it in your browser settings.

To see which pages are visited and where visitors come from, we use Umami, a visitor statistics tool that runs on our own server. It sets no cookies and does not follow you to other websites. It records the pages you open and what you do on them (such as searching the shop, adding to the cart or saving a design), the site that referred you, your browser, device type and language, and an approximate location (country and city) worked out from your IP address. The IP address itself is not saved, and these visit records are not linked to your account or your orders.

We do not use advertising or analytics cookies, so we do not show a cookie banner. If that ever changes, we will update this policy and ask for your consent first.

6. Who we share data with

We share data only with service providers that help us run the shop, and only what they need:

PayMongo, which processes online payments (GCash, QR Ph)
Couriers, which receive your name, address and mobile number to deliver your order
Resend, which sends our emails (codes, confirmations, receipts)
Amazon Web Services, which hosts the site, database and stored files
Cloudflare Turnstile, which checks that forms are filled in by people, not bots
Google Fonts, which serves the site's font and so receives your IP address when the page loads
Google and Facebook, only if you choose to sign in with them
Facebook Messenger, if you message our page
Google (Gemini), which powers our chat assistant Crafty and helps us see what customers ask for, with email addresses and phone numbers removed first
Facebook and TikTok, where we post our work. The posts and videos of ours shown on this site, with their pictures and counts, are copies kept on our own servers, so no Facebook or TikTok code runs on our pages. You reach them only if you choose to open a post or video there.

These providers handle data under their own privacy policies. We may also disclose data when the law requires it.

7. Uploaded photos and designs

Photos and design files you upload:

Are used only to make your order or answer your enquiry
Are not used for marketing and are not shown publicly without your permission
Are stored privately and can be deleted when you ask us to

8. How long we keep data

Your account and purchases stay for as long as your account exists, so you can sign in, see your orders and download your files again. You can ask us to delete your account.
Order and payment records are kept for as long as Philippine tax and accounting rules require, even if you close your account.
Sign-in codes expire shortly after they are sent.
Monito Monita draws are deleted automatically 90 days after they are made. The organiser can delete a draw sooner from its page.
Enquiries, uploads and technical logs are kept only as long as we need them to handle the request, support you, and keep the site secure.

9. Your rights

Under the Data Privacy Act, you may:

Ask what personal data we hold about you and get a copy
Ask us to correct data that is wrong
Ask us to delete your data, or to stop using it, where the law allows
Withdraw your consent at any time
Object to how your data is used
Complain to the National Privacy Commission (privacy.gov.ph)

To use any of these rights, email sales@metacrafts.ph from the address on your account, so we can confirm it is you. If we must keep some records by law, we will tell you which and why.

10. Security

We protect your data with reasonable technical and organizational measures, including:

HTTPS encryption for all traffic
Passwordless sign-in for customers, and emailed verification codes (and optional passkeys) for staff
Uploaded files and purchased downloads kept in private storage, available only through signed-in access
Access to customer information limited to staff who need it

No system is perfectly secure. If a breach affects your personal data, we will notify you and the NPC as the law requires.

11. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top shows when it last changed, and updates are posted on this page.