1 Overview
Ginto ("Ginto," "we," "our," or "us") is an AI-powered platform providing conversational intelligence, code generation, sandbox environments, multimedia tools, and related services (collectively, the "Services"). This Privacy Policy describes how we collect, use, disclose, and safeguard personal information when you access or use the Services through our website (https://silverqueen.pro), mobile applications, or any other interface we provide.
By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the Services.
2 Who We Are
Ginto is operated and maintained as a technology platform accessible globally, with primary operations serving users in the Philippines and beyond. For the purposes of the Philippine Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations, Ginto acts as the Personal Information Controller (PIC) for personal data collected through the Services.
For inquiries regarding this policy or your personal data, please contact our Data Protection Officer (DPO) at the address provided in Section 16.
3 Data We Collect
3.1 Information You Provide
- Account registration: Name, email address, username, and password (stored as a one-way hash).
- Profile information: Optional profile photo, bio, country, and contact details you voluntarily add.
- Payment information: Billing name, country, and transaction identifiers. Full card numbers are processed by our third-party payment processor and are never stored on our servers.
- Communications: Messages, feedback, or support requests you send us.
- User-generated content: Prompts, code, files, and other content you create or upload while using the Services.
- Referral data: Referral codes used during registration to attribute network relationships.
- GPS / Location data: When using the ePower Mall delivery features, we collect your precise GPS coordinates to auto-detect your barangay, verify delivery proof locations, and optimize the delivery experience. Location access is requested with your permission and is used solely for delivery and commerce purposes.
- Delivery proof photographs: Buyers and sellers may upload photographs as proof of delivery, including product arrival photos, selfies with the customer, and condition documentation. These images may include embedded GPS metadata (EXIF data) and are stored securely on our servers or third-party storage providers.
3.2 Information Collected Automatically
- Device & browser data: IP address, browser type and version, operating system, device type, and screen resolution.
- Usage data: Pages visited, features used, session duration, click paths, and interaction logs.
- Log data: Server access logs including timestamps, requested URLs, HTTP status codes, and referring URLs.
- Session identifiers: Secure cookies and session tokens used to maintain your authenticated state.
- Location data (automatic): When you grant location permissions on the Ginto mobile app, we may collect your device's GPS coordinates in the background to support location-based barangay detection and delivery features. You may revoke this permission at any time through your device settings.
3.3 Information from Third Parties
- OAuth providers: If you log in via a third-party provider (e.g., Google), we receive basic profile information permitted by your authorization.
- Payment processors: Confirmation of successful or failed transactions and associated reference numbers.
4 How We Use Your Data
We use your personal information for the following purposes:
| Purpose | Details |
|---|---|
| Service delivery | Operate features, process AI queries, manage sandbox sessions, and fulfil paid subscriptions. |
| Account management | Create and maintain your account, authenticate your identity, and manage preferences and settings. |
| Billing & payments | Process subscription payments, issue receipts, and handle refund or dispute requests. |
| Communication | Send transactional emails (account confirmations, receipts, security alerts) and, with your consent, service announcements. |
| Security & fraud prevention | Monitor for abuse, detect unauthorized access, enforce rate limits, and investigate security incidents. |
| Service improvement | Analyze aggregated and de-identified usage data to improve the platform's performance and features. |
| Legal compliance | Fulfill obligations under applicable laws, respond to lawful government requests, and enforce our Terms of Service. |
5 Legal Basis for Processing
We process personal information only when a valid legal basis exists under applicable law. Our processing activities rely on the following bases:
-
Consent (RA 10173 §13(a); GDPR Art. 6(1)(a)): Where required by law, we obtain your explicit consent prior to processing — for example, for marketing communications or optional features.
-
Contractual necessity (RA 10173 §13(b); GDPR Art. 6(1)(b)): Processing is necessary to provide the Services you have subscribed to, including account creation, AI query execution, and billing.
-
Legitimate interests (RA 10173 §13(f); GDPR Art. 6(1)(f)): We process data to maintain platform security, prevent fraud, and improve service quality, having balanced these interests against your rights.
-
Legal obligation (RA 10173 §13(e); GDPR Art. 6(1)(c)): We retain and disclose data as required by Philippine law, including the Cybercrime Prevention Act of 2012 (RA 10175), the Electronic Commerce Act (RA 8792), and applicable tax regulations.
7 Data Retention
We retain personal information for as long as necessary to provide the Services and fulfil the purposes described in this policy, or as required by applicable law. Our general retention schedule is:
- Active account data: Retained for the duration of your account. You may request deletion at any time (see Section 9).
- Deleted account data: Purged within 30 days of account deletion, except where retention is required by law.
- Transaction records: Retained for a minimum of 5 years to comply with Philippine BIR and anti-money laundering regulations.
- Server access logs: Retained for up to 90 days, then permanently deleted.
- Backup data: Purged within 30 days of the scheduled backup rotation cycle.
After the applicable retention period, data is securely deleted or anonymized so that it can no longer be linked to an identifiable individual.
8 Security
We implement industry-standard technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including:
Encryption in Transit
All data transmitted between your device and our servers is protected by TLS 1.2 or higher.
Password Hashing
Passwords are stored using strong one-way cryptographic hashing algorithms (bcrypt/Argon2).
Access Controls
Access to production systems and personal data is restricted to authorized personnel on a need-to-know basis.
Sandboxed Environments
User-generated code runs in isolated sandbox environments with strict resource and capability restrictions.
Despite our efforts, no security measure is infallible. In the event of a personal data breach that is likely to harm your rights, we will notify affected users and the National Privacy Commission (NPC) of the Philippines within 72 hours of becoming aware of the breach, as required by NPC Circular 16-03.
9 Your Rights
Under the Philippine Data Privacy Act of 2012 and, where applicable, the EU General Data Protection Regulation (GDPR) and other international frameworks, you have the following rights with respect to your personal information:
Right to Access (RA 10173 §16(c))
Request a copy of the personal information we hold about you, including the purposes for which it is processed.
Right to Rectification (RA 10173 §16(d))
Request correction of inaccurate or incomplete personal information. You may update most profile data directly from your account settings.
Right to Erasure / Right to be Forgotten (RA 10173 §16(f))
Request deletion of your personal information. We will comply unless retention is required by law (e.g., financial records) or necessary to resolve disputes.
Right to Object (RA 10173 §16(e))
Object to the processing of your personal data on grounds relating to your particular situation, including processing for direct marketing purposes.
Right to Data Portability (RA 10173 §18(b); GDPR Art. 20)
Request a copy of your personal data in a structured, commonly used, machine-readable format, where technically feasible.
Right to Withdraw Consent
Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal.
Right to Lodge a Complaint
File a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your rights under RA 10173 have been violated. Visit privacy.gov.ph for more information.
To exercise any of the above rights, please contact us at privacy@silverqueen.pro. We will respond within 15 business days of receiving a verified request, consistent with NPC guidelines.
11 Minors
The Services are intended for users who are at least 18 years of age, or the age of majority in their jurisdiction. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@silverqueen.pro and we will delete such information promptly.
Where consent of a parent or legal guardian is required for minors under applicable law (e.g., the Philippine Child Safety Act), we will take appropriate steps to verify and obtain such consent before processing.
12 Cross-Border Data Transfers
As a globally accessible platform, your personal information may be transferred to and processed in countries other than the Philippines, including countries with different data protection laws. Where we transfer personal data internationally, we ensure adequate safeguards are in place as required under RA 10173 §21 and applicable international regulations, including:
- Binding contractual clauses with third-party processors that meet NPC-approved standards;
- Standard Contractual Clauses (SCCs) approved by the European Commission for transfers subject to GDPR;
- Transfer of data only to countries or organizations with an adequate level of data protection as recognized by the NPC.
13 Third-Party Services & Links
The Services may integrate with or contain links to third-party websites, APIs, and services that are not owned or controlled by Ginto. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you access through the platform.
AI model responses are processed through third-party AI providers under data processing agreements. Prompts you submit may be processed on external AI infrastructure; please do not include sensitive personal information, financial data, or credentials in AI prompts.
14 AI-Generated Content & User Prompts
Ginto's core feature is AI-powered conversation and code generation. When you submit prompts or interact with AI features:
- Your prompts are transmitted to third-party AI model providers for inference. We do not train models on your personal data without your explicit consent.
- Conversation history may be stored on our servers to provide continuity of service and allow you to review past interactions.
- You retain ownership of the content you create. AI-generated outputs are provided as-is and Ginto makes no warranty as to their accuracy.
- You are responsible for ensuring that any personal data included in your prompts complies with applicable data protection laws.
15 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, applicable laws, or the Services. When we make material changes, we will:
- Update the "Last updated" date at the top of this page;
- Send a notification email to your registered email address; and/or
- Display a prominent notice within the platform.
Your continued use of the Services after the effective date of the revised policy constitutes your acceptance of the updated terms.
16 Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact our Data Protection Officer:
We are committed to resolving privacy concerns promptly. If you are unsatisfied with our response, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines at privacy.gov.ph.