Privacy Notice

1. Who holds your data

The ME2028 Cohort Brain admins, as a group, acting personally.

Privacy contact: Vanessa Sampang · vsampang.me2028@aim.edu · 0917 806 8287

AIM is not the controller and receives no data from this app.

2. What we collect

To let you in: your name, sign-in email, and either a hashed password or the name, email and photo your Google or Microsoft account releases.

Your profile, as you fill it: headline, intro, photo, region and city, businesses, expertise, what you can help with, what you need, links, and contact details — each with the visibility you chose.

What you post: posts, comments, photos, files, links, RSVPs, saves and likes.

Your private messages with classmates, with any photos and files you send in them, and when each of you last read the conversation.

To run the app: your sign-in session, which sections you've opened (for the menu counts), and your notifications.

To keep accounts safe: a security log of sign-ins, sign-ups, failed sign-in attempts, account changes and the days you visited, each with the IP address and the type of device and browser.

No tracking across other websites, no advertising, no analytics service, and no cookie banner — the only cookie is the one that keeps you signed in.

3. Why, and on what basis

We process this to run the directory and show you to your cohort — with your consent, given when you accept these documents and again each time you choose to make a field visible. Some processing rests on our legitimate interest in keeping the app secure and working.

You can withdraw consent at any time by editing, hiding or deleting the data, or by deactivating.

4. Who sees it

Approved cohort members only. The app is not public and asks search engines to stay out.

Your email, phone and messenger stay hidden until you choose otherwise, and “on request” reveals nothing — a classmate asks, you decide.

Admins see what any member sees, plus access requests, reports and the security log.

Private messages are seen only by the two people in the conversation. There is no admin screen for them, and files sent in a message open only for those two.

5. How long we keep it

Your profile and posts, for as long as your account is active. After deactivation everything is deleted 30 days later. Sign-in sessions expire and are cleared, and backups are overwritten on their normal cycle.

The security log is kept for 90 days, then deleted.

Private messages are kept while both accounts are active. When either person's account is deleted, the whole conversation is deleted with it.

Chats with MIA are kept only while the conversation is open, in your browser. Close it and the whole conversation is gone — the questions and the answers are never stored. We count only what kind of thing was asked for, with nothing of the question and no link to you.

6. How it's protected

Access is limited to approved members; sign-in tokens and sensitive fields are encrypted; the database is not publicly reachable; admin actions are logged.

If a breach puts you at real risk, we will notify you and the National Privacy Commission within 72 hours of knowing.

7. Your rights

Under the Data Privacy Act you may: be informed; object to processing; access your data; correct it; have it erased or blocked; obtain a copy in a portable format; and claim damages for a violation.

Edit or delete most of it yourself, or write to vsampang.me2028@aim.edu and we will act within 15 working days.

You may also complain to the National Privacy Commission (privacy.gov.ph).

8. Other

The app is for adults; it is not intended for anyone under 18. MIA makes no automated decision that legally affects you.

If this Notice changes materially, we'll ask you to read it again.