Privacy Policy

Effective date: 1 August 2026

1. Scope and Data Controller

This Policy explains how Narra DigiLabs Computer Programming Services ("Narra," "we," "us") collects, uses, and safeguards personal information through the Narra PaaS platform, client hubs, documentation portals, APIs, and customer support channels. Narra is registered in the Republic of the Philippines and operates in full compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations.

For security, physical security of server infrastructure, and fraud defense, Narra does not publish physical data center street addresses or tax identification numbers on public web pages. All official inquiries, legal notices, and compliance communications are coordinated through our designated contact channels below.

2. Information We Collect

We practice strict data minimization and collect only information required to provide, secure, and bill for our hosting services:

• Account registration details: Name, email address, password hash, account role, and country of residence.
• Billing and transaction records: Payment references, plan selections, subscription terms, invoice identifiers, and payment status. Card credentials and bank accounts are processed directly by our PCI-DSS compliant payment gateway (PayMongo) and are never stored on Narra servers.
• Service and telemetry data: IP addresses, browser user-agent strings, HTTP request logs, WireGuard tunnel connections, container CPU/RAM resource metrics, and security incident logs needed to maintain platform stability.
• Student verification metadata: For academic discount plans, verification references (such as institutional email domains or student ID review metadata) are collected solely to confirm academic eligibility.
• Identity verification escrow: Where developer identity verification is required for high-capacity networking, verification sessions are processed by our specialized identity partner (Didit). Narra maintains a zero-document storage policy: raw government ID scans, biometric photographs, and personal document numbers are held directly in Didit escrow and are never held on Narra storage drives.

3. Purpose and Legal Basis for Processing

We process personal data solely for legitimate business and technical operations:

• To provision, isolate, and operate containerized developer workloads and cloud databases.
• To authenticate user sessions, enforce multi-factor authentication, and protect accounts from unauthorized access.
• To invoice services, process renewals, and maintain statutory financial records.
• To investigate and mitigate malicious attacks, distributed denial of service (DDoS), spam bots, cryptocurrency mining abuse, and software piracy.
• To send critical transactional notifications, security warnings, and system maintenance advisories.

4. Third-Party SDKs and Sub-Processors Audit

Narra has audited all third-party code and services embedded within our public websites and customer portals. We operate with zero third-party advertising networks, zero tracking cookies, and zero social media retargeting pixels. The only external services utilized are:

• Cloudflare Turnstile (challenges.cloudflare.com): Used exclusively on authentication and contact forms to distinguish human users from automated malicious bots without intrusive captchas or cross-site user tracking.
• PayMongo (api.paymongo.com): Serves as our PCI-DSS Level 1 certified payment processing partner for credit cards, debit cards, Maya, GCash, and QR Ph payments.
• Didit: Provides encrypted identity verification sessions with zero raw identity document storage on Narra servers.
• Google Fonts (fonts.googleapis.com): Provides web typography with local fallback support.

5. Cookies and Local Storage

We use strictly necessary first-party cookies and browser local storage to maintain authenticated user sessions, store your dark/light UI theme preference, and remember cookie consent settings. For complete details on the purpose and duration of all browser storage keys, please consult our dedicated Cookie Policy.

6. Data Deletion and Right to Erasure

You have the full right to request the permanent erasure of your personal data and account records:

• In-app self-service: You can initiate account data deletion directly within the Narra Hub or Accounts portal under Settings > Privacy & Data > Request Account & Data Deletion.
• Email request: You may email our Data Protection team at privacy@narra-cloud.com from your registered account email address with the subject line "Data Erasure Request".
• Execution timeframe: Upon confirmation, your active cloud containers, databases, and network tunnels are terminated immediately. Personal profile records and system telemetry are purged from production databases within 48 hours. Immutable encrypted disaster-recovery backup archives expire and are completely overwritten within our standard 30-day retention cycle.

7. Age Consent and Protection of Minors

Narra Cloud PaaS is an infrastructure platform designed for developers, students, and businesses. Our policy regarding minors is as follows:

• Children under 13: Narra services are strictly not directed to children under 13 years of age. We do not knowingly collect or solicit personal information from anyone under 13. If we learn that we have inadvertently collected data from a child under 13, we will promptly delete that data.
• Minors aged 13 to 17: Minors between 13 and 17 years of age may register and use the services only with the express consent and guidance of a parent or legal guardian who agrees to be bound by our Terms of Service.
• Purchases: To purchase a paid hosting subscription or execute payment transactions, you must be at least 18 years of age or possess the legal capacity to enter into binding agreements.

8. Email Communications and Unsubscribe Links

We value your inbox and maintain a strict communication policy:

• Transactional notices: Essential emails regarding service provisioning, security OTP codes, invoice receipts, and critical incident advisories are required for account security and cannot be opted out of while your account is active.
• Service updates and announcements: Non-essential platform update emails contain a direct, functional one-click unsubscribe link in the footer.
• Manual opt-out: You can also update your notification preferences in your portal settings or email support@narra-cloud.com at any time to adjust your communication settings.

9. Retention and Security Safeguards

We retain personal information only for as long as necessary to provide your hosting services, resolve disputes, and satisfy statutory tax and accounting retention requirements. We employ industry-standard security safeguards, including TLS 1.3 encryption in transit, encrypted database volumes at rest, isolated Linux cgroup v2 namespaces, and restricted internal access controls.

10. Contact Our Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information under the Philippine Data Privacy Act of 2012, please contact our Data Protection Officer:

• Privacy inquiries & data requests: privacy@narra-cloud.com
• Data Protection Officer: dpo@narra-cloud.com
• General support: support@narra-cloud.com
• Entity: Narra DigiLabs Computer Programming Services, Republic of the Philippines

You also have the right to lodge a formal complaint with the National Privacy Commission of the Philippines (NPC) if you believe your privacy rights have been infringed.