Privacy Policy

John Christian Natividad, operating as Rootscratch, is responsible for personal information collected through https://rootscratch.com. We are based in Koronadal City, South Cotabato, Philippines. For privacy questions or requests, email john@rootscratch.com. This notice covers our public website and inquiries; a client project may have additional written privacy or data-processing terms.

When you send an inquiry, we collect:

• Your name, email address, selected service and message.
• For project requests: your mobile number, optional budget and timeline, and preferred callback time and time zone.
• A submission identifier and a record of your consent, including the notice version that applied.

We use these details to assess your request, contact you and prepare a response or proposal.

Please do not submit passwords, financial account details, health information, or other sensitive personal information.

Hosting and security systems process technical information such as IP addresses, browser and device details, request times and security events. They use this information to deliver the website, prevent abuse and investigate faults.

Our form uses Cloudflare Turnstile and keyed hashes of email and network identifiers to limit repeated requests. We also keep authentication and access records for authorized administrators.

Google Analytics measures basic page use through advanced consent mode. Before you choose, and when you decline optional cookies, it sends measurement signals and technical information to Google. It does this without storing analytics cookies. This is still data processing.

If you accept optional cookies, browser and session identifiers can also be stored. We use measurement to understand and improve the website. Advertising features are disabled.

Our page events leave out URL query strings and fragments. For a visit from another website, we keep only that website’s origin, without its path or search terms.

When you move between public pages without a full reload, the event includes the previous public page’s canonical path. This helps us understand the page journey. It leaves out query strings, fragments and private or excluded routes.

After a successful inquiry, an event records which form you used. It does not include your name, email, message, budget or other inquiry contents.

We request your consent to handle a form inquiry and separately ask permission for optional analytics cookies. Basic cookieless page measurement supports our interest in understanding site use and improving performance, subject to applicable law, a balance with your rights, and your right to object.

Cookie permission and the lawful basis for processing are separate matters. We may also process information needed to take steps you request before a contract, perform an agreed contract, meet legal obligations, or pursue legitimate interests in running and securing our business, subject to applicable law and your rights.

Inquiry consent is not marketing consent. Submitting the form does not add you to a mailing list. You may decline optional cookies and still browse or contact us. To object to basic measurement or ask about its processing, contact our privacy email. If you prefer not to use the form, you can email us; information in that conversation is still handled under this notice.

We use Google Cloud for hosting, Supabase for the private database and administrator authentication, Cloudflare for delivery, bot protection and media, and Google Analytics for page measurement, with optional analytics cookies.

Our location map loads CARTO map resources using OpenStreetMap data; requesting these resources can disclose your IP address and browser information to their providers.

Inquiry notifications are sent through Google Gmail to our business inbox. Email correspondence is handled through email service providers. Authorized personnel and providers receive only the access needed for their work.

Providers may process information outside the Philippines, including in countries where their infrastructure or support teams operate. Applicable processing agreements, access restrictions and security measures govern these services. Third-party services have their own privacy notices: Google, Supabase, Cloudflare and CARTO.

We do not sell your personal information. We may disclose information when legally required, to protect legal rights, or to professional advisers where necessary and subject to appropriate confidentiality.

We keep inquiry and correspondence records while handling your request. We also keep them for as long as needed for related follow-up, agreed services, legal duties or disputes.

How long we keep a record depends on whether you become a client and what the law or a contract requires. Records should be deleted or de-identified when those purposes end. Contact us to request deletion or ask how long we keep your record.

The Cookie Policy explains how long cookie preferences last and the limits on analytics cookies. Provider logs, analytics reports and backups have their own retention settings. Deleting browser cookies does not delete information a provider already holds. We review deletion requests in light of applicable rights, duties and backup limits.

We use access controls, encrypted connections and restricted administration to protect information. No internet transmission or storage method can be guaranteed completely secure. We assess and respond to incidents and make notifications where required by law.

Under the Philippine Data Privacy Act, and subject to its applicable exceptions, you may:

• Ask how we process your information.
• Request access, correction, erasure or blocking.
• Object to processing or withdraw consent.
• Exercise applicable data portability rights and other rights provided by law.

Send your request to john@rootscratch.com. Describe what you need and give the email address you used to contact us. We may reasonably check your identity before sharing or changing records. Please do not send an identity document unless we request one through an appropriate channel.

Withdrawing consent does not make earlier lawful processing invalid. It may prevent us from continuing an inquiry. We may still need some records on another lawful basis.

You can withdraw optional-cookie permission in Cookie settings. Basic cookieless measurement continues. Contact us to object to that processing.

If we have not resolved your concern, you may contact or file a complaint with the National Privacy Commission. Other rights under applicable law remain available.

This website is intended for people seeking professional business services, and we do not intentionally collect children’s personal information. If a child has provided information, a parent or guardian can contact us to request appropriate action.

We may update this notice as our services or practices change. The date and version on this page identify the current notice. We will request fresh consent where a change requires it.