1. Who is responsible for your data
getsplain is operated by Abelardo Marco S. Victoria Jr., Metro Manila, Philippines. The operator is the personal information controller under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC). Data protection contact: Abelardo Marco S. Victoria Jr., hello@getsplain.com (also reachable at getsplain@gmail.com).
2. Accounts are for adults
getsplain accounts are for parents, guardians, teachers and school staff aged 18+. We do not knowingly create accounts for minors. You are responsible for what you enter about the splainees you teach. Please don't enter your splainee's full name or other identifying details in lesson fields; getsplain doesn't need them. If you believe a minor has created an account, contact us and we will delete it.
3. What we collect
- Account details: name, email, role (parent, homeschool parent, teacher, school admin), country, your consent to these policies and your 18+ confirmation (with dates), marketing preference, and any invite code or coupon used.
- One-time log-in codes: stored only in hashed form, valid for 10 minutes, and deleted shortly after they expire.
- Lessons and lesson history: age group, topics and interests you type, and the lessons we generate. Lessons are saved in your account so you can reopen, copy and share them in "My lessons". We also use your history (topic, interests, age group, date) to apply plan limits.
- Guest lessons (no account): a random browser ID (stored in a cookie and in your browser), a one-way hash of your IP address, the lesson request and the generated lesson. We use these to limit free guest lessons and prevent abuse, and to move the lesson into your account if you sign up from the same browser. Guest records are deleted after 30 days.
- Payments for Plus: the screenshot you upload as proof of payment, the payment method, the reference number (if given), the amount, any coupon, and the date. Screenshots are stored privately on our server (never in a public folder), seen only by the getsplain admin who verifies payments, and emailed to our own payment inbox for verification. We keep payment records as long as needed for accounting and tax records.
- Safety events: if our checks detect a possible crisis, we record that it happened (date, which check, country) but not what was typed.
- Emails we send: a record of which getsplain emails were sent to you (for example the welcome email), so we don't send them twice.
- Technical data: IP address (for security, rate limits and to suggest your country's support hotlines, using an offline lookup on our own server), browser type, and log-in session records.
- Early-access list: if you joined our waitlist, your name, email, role and optional answers.
4. Why we use it (and legal basis)
- To provide getsplain: create your account, log you in with email codes, generate and save lessons, apply plan limits, and verify payments and activate Plus (contract / your request).
- To keep splainees and the service safe: crisis detection, gentle safety emails to the account holder, guest-lesson limits, abuse prevention and security (legitimate interest; protecting life and health).
- To keep accounting and tax records of payments (legal obligation).
- To improve getsplain using aggregated usage numbers (legitimate interest).
- To send tips and news, only if you opted in (consent; every such email has a one-click unsubscribe).
5. AI providers and other service providers
- AI lesson generation: your lesson details (age group, topics, interests) are sent to Anthropic (primary) and OpenAI (backup).
- Content-safety moderation: lesson requests and AI outputs are checked with OpenAI's moderation service.
- Email delivery: Resend sends our log-in codes, welcome and account emails, and payment notifications.
- Hosting: getsplain and its database run on a virtual private server from Amazon Web Services (Amazon Lightsail, Singapore region).
- Fonts: pages load fonts from Google Fonts, which receives your IP address when fonts load.
These providers process data on our behalf under their business/API terms; Anthropic and OpenAI state that API data is not used to train their models by default. Some of them process data outside the Philippines (for example in the United States and Singapore); we use contractual and organisational safeguards as required by the Data Privacy Act.
6. What we never do
- We never sell or rent your personal data or your splainee's information.
- No advertising, no ad trackers, and no profiling of splainees.
- We don't use lesson inputs to train our own AI models.
7. Cookies and browser storage
We use two essential cookies: a secure, HttpOnly session cookie that keeps you logged in (it expires after 30 days or when you log out), and a guest cookie with a random browser ID used for the free guest lesson limit. The app also stores a few settings in your browser: your country choice for support hotlines, the guest browser ID, whether you've used your guest lesson, a tester access code if you entered one, and whether you dismissed the "add to home screen" prompt. No advertising or analytics cookies.
8. How long we keep data
- Account, saved lessons and lesson history: while your account is active, and deleted within 30 days after you ask us to delete it.
- Log-in codes: valid for 10 minutes, deleted within a day after they expire. Sessions: up to 30 days.
- Guest lesson records (browser ID, hashed IP, lesson): deleted after 30 days.
- Payment records and proof screenshots: as long as required for accounting and tax purposes.
- Safety event records: deleted after 12 months.
- Early-access list entries that never become accounts: deleted after 12 months or on request.
9. Your rights
Under the Data Privacy Act (RA 10173) you have the right to be informed, to access, to correct, to object, to erasure or blocking, to data portability, and to damages, and to file a complaint with the National Privacy Commission (privacy.gov.ph). To access, correct, download or delete your data, email hello@getsplain.com from your account email. We will reply within 15 working days. Deleting your account removes your profile and saved lessons; we may keep minimal records where required by law (such as payment records) or to protect safety.
10. Security
We use encrypted connections (HTTPS), passwordless log-in with short-lived codes, hashed session tokens and codes, a hashed IP for guest limits, private storage for payment screenshots, access controls, and data stored on a server we control. No system is perfect; if a personal data breach affecting you occurs, we will notify you and the NPC as required by law (within 72 hours of knowledge, where applicable).
11. Changes
We'll post updates here and tell you by email or in the app if changes are significant.
12. Contact
hello@getsplain.com (also reachable at getsplain@gmail.com). getsplain is operated by Abelardo Marco S. Victoria Jr., Metro Manila, Philippines.