1. Scope
This Privacy Policy describes how Servbase ("Servbase", "we", "us", "our") processes personal data when you use our website, authentication pages, dashboard, billing, support, and related platform services.
This policy is intended for users of Servbase services and should be read together with our Terms, Acceptable Use Policy, Fair Use Policy, and Cookie Policy.
2. Information We Collect
2.1 Account and Profile Data
- Name, email address, username (if set), avatar URL, and account UID.
- Password hashes and remember-token/session-related account fields.
- User settings such as full name, company, timezone, two-factor preference flag, and login-alert preference flag.
2.2 Authentication and Security Data
- Authentication identifiers and temporary auth codes used for token exchange.
- Password-reset request records (email, token hash, expiry, used status).
- Session and cookie security data such as session identifiers, IP address, user-agent, derived device/browser labels, and activity timestamps.
- Security verification records for OTP-based actions (challenge ID, purpose, attempt counts, expiry, and consumption status).
- Security/audit event records (event type, origin, status, details, metadata, and timestamps).
2.3 OAuth and Integration Data
- OAuth provider identifiers (for example provider user ID) when you sign in through supported providers.
- OAuth token data required to maintain linked account functionality where implemented.
- Connected integration metadata (for example installation IDs and linked account usernames for supported integrations).
2.4 Support and Communication Data
- Support ticket information such as subject, category, affected service, ticket status, assigned agent references, and timestamps.
- Support messages and attachment metadata (file name, MIME type, size, attachment type) and uploaded attachment content.
- Operational support events and internal activity records related to ticket lifecycle.
2.5 Service Usage and Technical Data
- Usage actions and system interactions required to operate features in dashboard, billing, account, and support modules.
- Technical diagnostics and logs, including request metadata, timestamps, and service state data used for reliability and abuse detection.
- Application and workspace metadata necessary to provide platform features (for example app identifiers, plan assignment, deployment references, and workspace member scopes).
2.6 Billing and Payment Metadata
- Subscription and add-on records (plan slug, add-on slug, quantity, status, start/end times, metadata).
- Billing records such as invoice ID, line type, plan slug, amount, currency, provider references, status, and billing metadata.
- Webhook and payment-event logs required for reconciliation, dispute handling, fraud prevention, and audit trails.
- Discount redemption records (discount code usage metadata, invoice linkage, and computed amounts).
Servbase does not represent that it stores full payment card credentials. Payment method credential handling is performed by payment processors in supported checkout flows unless explicitly implemented otherwise.
3. How We Use Information
- To create, authenticate, maintain, and secure user accounts.
- To deliver and operate platform functionality, including deployments, account settings, billing, and support services.
- To process subscriptions, invoices, checkout verification, payment reconciliation, and financial records.
- To detect fraud, abuse, suspicious behavior, unauthorized access attempts, and policy violations.
- To provide customer support, triage incidents, and maintain support history continuity.
- To enforce our Terms, Acceptable Use Policy, and Fair Use Policy.
- To comply with legal, regulatory, tax, accounting, and law-enforcement obligations.
- To improve service performance, reliability, security posture, and user experience.
4. Lawful Basis (Philippines Data Privacy Act, RA 10173)
Where applicable, Servbase processes personal data based on one or more lawful grounds, including:
- Consent: where consent is required for specific processing activities.
- Contract Performance: where processing is necessary to provide services requested by you.
- Legitimate Interests: including service security, fraud prevention, platform integrity, and operational improvement, balanced against your rights.
- Legal Obligation: where processing is required to comply with law, regulation, lawful orders, or government requests.
6. Data Retention
We retain personal data only for as long as needed for legitimate and lawful purposes, including service delivery, billing, compliance, audits, security operations, abuse prevention, backup integrity, and dispute resolution.
- Account and profile records are retained while accounts remain active and for a reasonable post-closure period as required.
- Billing and tax-related records may be retained for statutory accounting and tax periods.
- Security and audit logs may be retained to investigate incidents and enforce platform protections.
- Support ticket histories and attachments may be retained for support continuity, legal defense, and abuse handling.
You may request account deletion or data removal review via [email protected] or through the support ticket system. Certain records may be retained where required by law or legitimate business necessity.
7. Data Subject Rights
Subject to applicable law and verification requirements, including the Data Privacy Act of 2012 (RA 10173), you may exercise rights such as:
- Right to be informed.
- Right to access.
- Right to object.
- Right to rectification/correction.
- Right to erasure or blocking, where applicable.
- Right to data portability, where applicable.
- Right to damages, where applicable under law.
- Right to lodge a complaint with the National Privacy Commission (NPC), where applicable.
To exercise rights, contact [email protected] or open a support ticket. We may request information needed to verify identity and authority.
8. Security
Servbase implements reasonable administrative, technical, and organizational safeguards to protect personal data, including access controls, encryption in transit where applicable, logging, monitoring, and security review procedures.
No method of transmission, storage, or processing can be guaranteed 100% secure. You are responsible for maintaining credential confidentiality, device hygiene, and account security practices.
9. International Processing
Servbase and its service providers may process or store data in jurisdictions outside the Philippines when necessary for service operations. Where cross-border processing occurs, we apply reasonable contractual and organizational safeguards appropriate to the nature of processing.
10. Children's Privacy
Servbase is not intended for children below the age of legal digital consent or contractual capacity. You represent that you have the legal capacity and authority to use our services.
11. Policy Updates
Servbase reserves the right to revise, amend, or update this Privacy Policy at any time to reflect service, security, legal, or operational changes. We will post the updated version and update the "Last updated" date. Where legally permitted, continued use of Servbase after changes take effect constitutes acceptance of the updated policy.
12. Legal Notice
This Privacy Policy forms part of the legal terms governing use of Servbase services and should be read together with our Terms of Service and related policies.
Contact and Notices
For legal, privacy, account, and data rights requests, contact [email protected] or open a support ticket through your Servbase account.
These policies apply to Servbase platform users and govern your use of Servbase services together with any referenced supplemental policies and notices.