Version 1.1 · Effective 2026-09-22 · Last reviewed 2026-09-23

This Privacy Policy explains how the operator of batas.org (“BATAS”, “we”, “us”) collects, uses, stores, shares, and disposes of personal data, and what you can do about it. We are a personal information controller under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission.

Summary — the essentials in one screen

We do not sell personal data, we do not trade it, we do not use it to serve third-party advertising, and the Service contains no advertising or third-party analytics trackers. The full detail follows.

1. Who we are, and how to reach our Data Protection Officer

• Personal information controller: BATAS · batas.org
• Office address: ASG Law, 282 P. Ocampo Sr. Extension, San Antonio Village, Makati City, Philippines
• Data Protection Officer: our Data Protection Officer, reachable at batas.org@gmail.com (mark the subject “For the attention of the Data Protection Officer”)

Our Data Protection Officer is responsible for compliance with the Data Privacy Act of 2012 and with this Policy, and is the person to write to about anything in it — including any request to exercise your rights as a data subject.

2. What this Policy covers

This Policy covers the batas.org website, the Batas desktop application, our hosted courses and audio, the law library, mock examinations and the Exam Day proctored-examination service, the AI study and essay-grading tools, partner and institution features, and any communication you have with us.

It does not cover a third-party website or service you reach through a link, nor the separate processing carried out by an institution that runs its own programme — that institution is its own controller for what it does with data it holds, although we describe in §6 what an institution can see about you.

3. The personal data we collect, and where it comes from

3.1 Data you give us.

• Registration: your full name, email address, mobile number, school (or “not in law school yet”), your chosen plan, and any invite, discount, or partner code you use. Your password is stored only as a one-way hash; nobody at BATAS can read it.
• Profile and settings: your display name, contact details, theme preference, and the notification settings you choose.
• Your work: quiz and mock-examination answers, essays you submit for automated grading, notes, questions you ask the AI tools, playlists you create, and documents you mark for later.
• Identity verification (only if you apply for it): your legal name as it appears on your identification document, the type of document and its number, optionally your institution and position, the front image of the document (and the back where you provide it), and a selfie holding it.
• Purchase information: the plan you bought, the amount, the reference number our payment processor returns, your billing name and any business name and TIN you ask us to put on a receipt. Card and e-wallet details are entered on the payment processor’s own pages; we do not receive or store the full number of your card.
• Correspondence: messages you send to support, complaints, and data-subject requests, and our replies.
• Institution and partner information: if you are a contact, payee, or partner of a law school, review centre, or student organisation, your name, position, contact details, and the authority you hold for that organisation.

3.2 Data we create or record as you use the Service. Lessons and audio you have played, your position in a course, the time you spend, quizzes and mock examinations you take, scores, model-answer comparisons, streak and progress data, certificates issued, and the dates of your sessions.

3.3 Data we collect automatically. Your IP address, the browser and device you use, the pages and API requests you make, the times of those requests, error and security logs, and the approximate location that can be inferred from an IP address. We use this to run the Service, to keep it secure and available, to diagnose faults, to enforce rate limits, and to detect abuse such as credential sharing, scraping, and attacks. We do not use it to build advertising profiles, and we do not combine it with data from advertising networks.

3.4 Data from third parties. If you sign in with Google, we receive your Google account identifier, your email address, your name, and your profile picture from Google, and nothing else. Our payment processor tells us whether a payment succeeded and gives us a reference number. Our artificial-intelligence, text-to-speech, hosting, content-delivery, and email providers process data on our instructions and return the result to us.

3.5 Cookies and local storage. We use no advertising cookies and no third-party analytics trackers. We do store a small amount of data in your browser’s local storage — your sign-in token and your theme choice — and those are described in the Cookie & Local Storage Notice.

3.6 Data you should not give us. Do not submit privileged or confidential client information, the personal data of other people who have not consented, or any sensitive personal information we have not asked for. The AI features transmit what you send them; keep real client material out of them.

4. Sensitive personal information

Some of what we process is sensitive personal information under Section 3(l) of the Data Privacy Act: the school and educational information you give us, your mobile number where it can be linked to you, and — for verified users — your government-issued identification and the images of it, which are government-issued identifiers.

We process sensitive personal information only where we have a basis in Section 13 of the Act, in practice almost always your explicit consent, given separately and for a stated purpose. That is why registration asks you to accept the Data Privacy Consent, and why identity verification has its own separate consent that you must give before you may upload any document.

Identity-verification documents are encrypted, are accessible only to authorised BATAS administrators, are used only to confirm that you are who you say you are and to support the integrity of proctored examinations, are never used for advertising or profiling, and are deleted when the verification is withdrawn or no longer needed. They are never shown to other learners, and are never shared with an institution without your consent.

5. Why we process your data, and our lawful bases

Where we rely on consent, you may withdraw it at any time (§11) — but withdrawing consent for something the Service needs in order to work (your account, for instance) means we can no longer provide that part of the Service to you. Where we rely on our legitimate interests, those interests are the operation, security, and improvement of an educational service, and we have balanced them against your rights and freedoms; you may object, and we will stop unless we have an overriding ground or a legal duty.

6. Who sees your data

6.1 Our people. Members of the BATAS team see personal data only where their role requires it, under confidentiality obligations, and only the minimum necessary. Identity-verification documents are restricted further, to the administrators who review verification requests.

6.2 Service providers (personal information processors). We use carefully selected providers to run the Service. They process personal data only on our documented instructions, under written agreements that include confidentiality and security obligations, and they may not use it for their own purposes or to train their own models. Our current providers are, in substance:

• Cloud hosting and infrastructure — the servers that run the Service and store your account, learning record, and uploaded files.
• Payment processing — PayMongo (and the payment networks and e-wallets it routes to), which receive your payment details and tell us the result.
• Sign-in — Google, if you choose Sign in with Google.
• Artificial intelligence — DeepSeek (API) for study answers, explanations, and essay grading; and Google’s Gemini service where a feature uses it. The text of your question or essay, together with the relevant excerpt, question, and rubric, is sent to the provider to produce the answer or the grading.
• Speech synthesis (narration) — Google Cloud Text-to-Speech, ElevenLabs, and Google’s Gemini speech service, which convert our lesson text into audio. We send them our course text, not your personal data.
• Content delivery — Bunny CDN, which delivers audio and library assets from edge servers using signed, expiring links.
• Email delivery — our transactional email provider and the mail servers that deliver receipts, verification emails, and notices to you.
• Application updates — the service that delivers updates to the desktop application.

We update this list when the providers change; the list above describes the categories and the providers we use at the date of the version you are reading.

6.3 Institutions and partner programmes. If you enrol using a code belonging to a law school, review centre, or student organisation, or if your typed school is a BATAS partner, we link your account to that institution so its programme and its covered learners can be administered. An institution sees aggregate information about its linked learners — how many learners, how many redemptions, and revenue figures — and, where it must confirm who is covered by its programme, whether a particular account is linked to it. We do not show an institution your individual answers, essays, transcripts, grades, or study history. If you are the partner or payee of an institution, we process your name and contact details and the commission records of that institution’s account.

6.4 Legal disclosures. We may disclose personal data where the law requires it, where a court or a competent authority orders it, to respond to a lawful request from the National Privacy Commission, the Department of Trade and Industry, the Department of Justice, the National Bureau of Investigation, the Philippine National Police, or another authorised agency, to protect a person’s life or health, to investigate fraud or an attack on the Service, or to establish, exercise, or defend a legal claim. Where the law allows us to tell you, we will.

6.5 Business changes. If BATAS is reorganised, merged, or its assets are transferred, personal data may be transferred as part of the operation of the Service. A receiving entity would be bound by this Policy, and we would tell you before your data became subject to a materially different policy.

6.6 No sale, no advertising. We do not sell, rent, trade, or barter personal data. We do not share it with advertising networks or data brokers, and we do not allow third parties to set advertising cookies on the Service.

7. Automated processing and artificial intelligence

• What is automated: essay grading against a rubric; the difficulty and readiness estimates shown to you; study scheduling and spaced-repetition ordering; search ranking in the law library; abuse, rate-limit and fraud detection; and the answers the study assistant drafts for you.
• No automated decisions with legal or similarly significant effect. We do not decide your access, your enrolment, your certificates, or your money automatically on the basis of profiling. Where an automated system flags an account for review, a person decides what to do.
• Grading is advisory. An automated score is an estimate. It is not an official mark, and it is not a prediction of your Bar result. If you think a score is wrong, ask us for a human review (§11).
• Your right to object and to an explanation. Where a decision that matters to you has been made by automated means, you may ask for information about it and for a person to review it.
• Model training. We do not use your essays, answers, or personal data to train an artificial-intelligence model of ours, and we require our providers not to train their models on the data we send them.
• Where your conversations live. The AI study assistant keeps your conversation in your browser, so it is still there when you return; we do not keep a copy of the conversation in our database, and we hold only the counters for the tokens your account has used. If you clear your browser data, the conversation is gone. Essay and examination answers submitted for grading are stored, as part of your examination record (§10), because they are the record of your attempt.

8. Where your data is stored and transferred

Our servers are hosted on cloud infrastructure located outside the Philippines, and content is delivered from edge locations used by our content-delivery provider. Some of our processors are located outside the Philippines, so processing may involve a transfer of personal data out of the country. When we transfer personal data outside the Philippines we rely on the transfer rules of the Data Privacy Act and its IRR — including your consent, or contractual safeguards with the recipient that provide a comparable level of protection — and we require the recipient to protect the data, to use it only for the purpose we specify, and not to transfer it onward without our authority.

9. How we protect your data

We use reasonable and appropriate organisational, physical, and technical measures, as required by the Data Privacy Act and NPC Circular No. 16-01, including:

• Encryption in transit for the Service, over TLS.
• Encryption at rest for uploaded identity documents and other sensitive files, and one-way hashing of passwords — no one at BATAS can read your password.
• Access control: least-privilege administrator roles, restricted access to sensitive files, and audit-relevant logging of administrative actions.
• Signed, expiring links for protected audio and documents, so that material cannot be fetched without an authorised request.
• Rate limiting, abuse detection, and monitoring of the Service for attacks and anomalies.
• Vendor management: written agreements with processors, confidentiality undertakings, and vendor assessment before onboarding.
• Retention and disposal: deletion or anonymisation of personal data when the retention period in §10 ends, and secure destruction of media that has held personal data.
• Privacy by design: a privacy impact assessment before we introduce a new processing activity that is likely to pose a risk to the rights and freedoms of data subjects.

No system is perfectly secure, and we do not claim otherwise. Please use a strong, unique password, and tell us at once if you suspect your account has been compromised.

10. How long we keep your data

When a retention period ends we delete the data or, where deletion is not reasonably possible (for instance data already aggregated into statistics or held in an encrypted backup), we anonymise it or isolate it from further processing until it can be deleted. Backups are rotated on a fixed cycle, so a deleted record may persist in an encrypted backup until that cycle completes.

11. Your rights as a data subject, and how to exercise them

Under Sections 16 to 18 of the Data Privacy Act you have the right to:

1. Be informed whether we hold and process your personal data, and to be told, at the time you give it or at the earliest opportunity, what we collect, why, how, to whom we disclose it, how long we keep it, and that you have the rights in this section. This Policy, the Data Privacy Consent, and the notices shown as you use the Service are how we do that.
2. Reasonable access to the personal data we hold about you, and to the circumstances of its processing.
3. Object to the processing of your data, including for direct marketing or for processing based on our legitimate interests, and to request that we stop.
4. Correct anything inaccurate, and to have it corrected at once.
5. Erasure or blocking — to have your data blocked, removed, or destroyed where it is incomplete, outdated, false, unlawfully obtained, used for a purpose you did not authorise, or no longer necessary for the purpose it was collected for. Some records (receipts and accounting records, for instance) cannot be erased before their retention period ends, because the law requires us to keep them.
6. Data portability — to obtain a copy of your personal data in a commonly used electronic format, and to have us transmit it to another controller where technically feasible.
7. Damages — to be indemnified for damage sustained through the inaccurate, incomplete, outdated, false, or unlawfully obtained personal data, or through the unauthorised use of it.
8. Complain to the National Privacy Commission, and to be notified of a personal data breach affecting you as described in §12.
9. Withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

How to make a request. Email batas.org@gmail.com with the subject “Data subject request”, from the email address on your account where possible, and tell us what you want: a copy of your data, a correction, a deletion, a block, an objection, or the data in portable form. We may ask you to verify your identity before acting, because we must not hand your data to someone else — this is itself a protection for you.

How long we take. We respond to a data-subject request within thirty (30) working days of receiving it, and we may extend that by fifteen (15) working days where the request is complex or the volume is large, telling you in writing why. Providing access, correction, or portability is free. Where a request is manifestly unfounded, vexatious, or excessive — for example a repetition of a request we have just answered — we may charge a reasonable fee for the administrative cost, and we will tell you the fee and the reason before doing any work.

Withdrawing consent. Every consent we ask for can be withdrawn as easily as it was given: write to the same address, or use the settings in your account where the option exists. If you withdraw a consent the Service needs in order to work, we will tell you what will stop working, and you can decide whether to close the account instead.

Complaints to the National Privacy Commission. You may complain to the NPC at any time by lodging a complaint through the NPC, at privacy.gov.ph, or at its office: National Privacy Commission, 5th Floor, Delegation Building, Philippine International Convention Center, Roxas Boulevard, Pasay City, Metro Manila, Philippines. We ask only that you let us try to fix the problem first, which usually gets you a faster answer.

12. If there is a personal data breach

A personal data breach is an accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. We have a breach-response procedure, and we act on it.

• Containment first. We investigate and contain the incident, preserve evidence, and assess the scope and the risk to affected persons.
• Notification within 72 hours. Where the breach involves sensitive personal information or information that can be used to enable identity fraud, where the data may have been acquired by an unauthorised person, and where the acquisition is likely to give rise to a real risk of serious harm to data subjects, we notify the National Privacy Commission and the affected data subjects within seventy-two (72) hours of our knowledge or reasonable belief of the breach, in accordance with Section 20(f) of the Data Privacy Act and NPC Circular No. 16-03. Where the breach affects one hundred (100) or more data subjects, the notification is made within the 72-hour period on the basis of the information then available.
• Full report within five (5) days. We file the full breach report with the NPC, through its Data Breach Notification Management System, within five (5) days of the notification.
• What we tell you. The notice describes the nature and extent of the breach, the personal data possibly involved, the measures we have taken and that you can take, and how to reach our Data Protection Officer.
• Annual reporting. We file our Annual Security Incident Report with the NPC on or before 31 March each year, covering the preceding calendar year, including the year’s security incidents and personal data breaches.
• Records. We keep the documentation of each incident and our response for at least six (6) years.

If you suspect a breach or a vulnerability, tell us privately at batas.org@gmail.com. We will not pursue anyone who reports a vulnerability to us in good faith and does not exploit it. Do not access, copy, or publish other people’s data to prove a point.

13. Children and learners under eighteen

Accounts are for users aged eighteen (18) and above. A learner aged thirteen (13) to seventeen (17) may use the Service only with the consent and supervision of a parent or legal guardian, who accepts our Terms and this Policy on the learner’s behalf and who is the person who gives us any consent required for the processing. We do not knowingly collect personal data from children under thirteen (13). If you are a parent or guardian and believe your child under thirteen has registered, write to us and we will delete the account and the data.

14. Cookies and local storage

We do not use advertising cookies and we do not run third-party analytics. We store your sign-in token and your theme preference in your browser’s local storage so that the Service works and remembers your preference. The Cookie & Local Storage Notice lists exactly what is stored, why, how long it lasts, and how to clear it.

15. Changes to this Policy

We review this Policy when we change how we process personal data, when the law or an NPC issuance changes, and at least once a year. Every version is numbered and dated, and we tell you by email or in the Service before a material change takes effect. Where the change concerns a processing activity for which we relied on your consent — a new purpose, a new category of data, or a new class of recipient — we will ask for your consent again, and we will not apply that change to your data until you give it. The version history of this document is printed at the end of it.

Version history of this document

• 1.1 — the operator’s office address and Data Protection Officer are stated directly, and our hosting is described without naming a specific location.
• 1.0 — first version.

16. How to contact us

• Data Protection Officer: batas.org@gmail.com
• Support and complaints: batas.org@gmail.com
• Post: BATAS · batas.org, ASG Law, 282 P. Ocampo Sr. Extension, San Antonio Village, Makati City, Philippines
• National Privacy Commission: privacy.gov.ph

17. Definitions

• Personal data — any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained, or which, when put together with other information, would directly and certainly identify an individual.
• Sensitive personal information — the categories listed in Section 3(l) of the Data Privacy Act, including government-issued identifiers such as an identification document and its number, and information about a person’s education.
• Personal information controller — the entity that controls the collection, holding, processing, or use of personal data. That is us.
• Personal information processor — an entity that processes personal data on behalf of, and on the instructions of, a controller. That describes our service providers.
• Data subject — you, the individual whose personal data we process.
• Processing — any operation on personal data, including collection, recording, storage, use, sharing, and destruction.