Privacy Policy

John Christian Natividad, operating as Rootscratch, is responsible for personal information collected through https://rootscratch.com. We are based in Koronadal City, South Cotabato, Philippines. For privacy questions or requests, email john@rootscratch.com. This notice covers our public website and inquiries; a client project may have additional written privacy or data-processing terms.

When you send an inquiry, we collect your name, email address, selected service, message, and, for project requests, mobile number, optional budget and timeline, preferred callback time and time zone, submission identifier, and a record of your consent and the applicable notice version. We use these details to assess your request, communicate with you and prepare a response or proposal. Please do not submit passwords, financial account details, health information, or other sensitive personal information.

Hosting and security systems process technical information such as IP addresses, browser/device information, request times and security events to deliver the website, prevent abuse and investigate faults. Our form uses Cloudflare Turnstile and keyed hashes of email and network identifiers for rate limits. Authorized administrators also have authentication and access records.

Google Analytics runs basic page measurement using advanced consent mode. Before you choose, and when you decline optional cookies, it sends cookieless measurement signals and technical information to Google without storing analytics cookies. This is still data processing. Accepting optional cookies additionally allows browser and session identifiers to be stored. We use measurement to understand and improve the website; advertising features are disabled. Our page events exclude URL query strings and fragments, and we do not include your inquiry contents in analytics events.

We request your consent to handle a form inquiry and separately ask permission for optional analytics cookies. Basic cookieless page measurement supports our interest in understanding site use and improving performance, subject to applicable law, a balance with your rights, and your right to object. Cookie permission and the lawful basis for processing are separate matters. We may also process information needed to take steps you request before a contract, perform an agreed contract, meet legal obligations, or pursue legitimate interests in running and securing our business, subject to applicable law and your rights.

Inquiry consent is not marketing consent. Submitting the form does not add you to a mailing list. You may decline optional cookies and still browse or contact us. To object to basic measurement or ask about its processing, contact our privacy email. If you prefer not to use the form, you can email us; information in that conversation is still handled under this notice.

We use Google Cloud for hosting, Supabase for the private database and administrator authentication, Cloudflare for delivery, bot protection and media, and Google Analytics for page measurement, with optional analytics cookies. Our location map loads CARTO map resources using OpenStreetMap data; requesting these resources can disclose your IP address and browser information to their providers. Inquiry notifications are sent through Google Gmail to our business inbox. Email correspondence is handled through email service providers. Authorized personnel and providers receive only the access needed for their work.

Providers may process information outside the Philippines, including in countries where their infrastructure or support teams operate. Applicable processing agreements, access restrictions and security measures govern these services. Third-party services have their own privacy notices: Google, Supabase, Cloudflare and CARTO.

We do not sell your personal information. We may disclose information when legally required, to protect legal rights, or to professional advisers where necessary and subject to appropriate confidentiality.

We retain inquiry and correspondence records while handling your request and for the period needed for relevant follow-up, agreed services, legal obligations or resolving disputes. The appropriate period depends on whether an inquiry becomes a client relationship and whether a legal or contractual retention duty applies. Records should be deleted or de-identified when those purposes end; you can contact us to request deletion or ask about the retention applicable to your record.

Cookie preference duration and analytics-cookie limits are described in the Cookie Policy. Provider logs, analytics reports and backups have separate retention settings; deleting browser cookies does not delete information already held by a provider. We assess deletion requests against applicable rights, obligations and backup limitations.

We use access controls, encrypted connections and restricted administration to protect information. No internet transmission or storage method can be guaranteed completely secure. We assess and respond to incidents and make notifications where required by law.

Subject to the Philippine Data Privacy Act and applicable exceptions, you may request information about processing, access, correction, erasure or blocking, object to processing, withdraw consent, and exercise applicable portability and other statutory rights. Send your request to john@rootscratch.com, describing the request and the email address used to contact us. We may reasonably verify your identity before disclosing or changing records; please do not send an identity document unless requested through an appropriate channel.

Withdrawing consent does not invalidate earlier lawful processing. It may prevent us from continuing an inquiry, and certain records may still be needed on another lawful basis. You can withdraw optional-cookie permission in Cookie settings. Basic cookieless measurement continues; contact us to object to that processing. For concerns unresolved with us, you may contact or file a complaint with the National Privacy Commission. Other rights under applicable law remain available.

This website is intended for people seeking professional business services, and we do not intentionally collect children’s personal information. If a child has provided information, a parent or guardian can contact us to request appropriate action.

We may update this notice as our services or practices change. The date and version on this page identify the current notice. We will request fresh consent where a change requires it.