Privacy Policy

1. Who we are

Obramaestra is a marketplace for original, one-of-a-kind artwork by Filipino artists, operated by DAVERIL DIGITAL TECHNOLOGIES OPC (“Obramaestra,” “we,” “us”). This policy explains what personal data we collect from you when you use obramaestra.art, why, who it's shared with, and the rights you have over it under the Philippines' Data Privacy Act of 2012 (RA 10173).

2. What we collect

We collect what's needed to run a real marketplace where money and physical goods change hands:

• Account info — email, display name, handle, avatar, bio, and location you provide when you sign up or edit your profile. Your password is handled entirely by our authentication provider (Supabase Auth) and is never visible to us in plain text.
• Artist info — if you sell, your artist statement and payout details (bank, GCash, or Maya account name/number) so we know where to send your proceeds.
• Order & transaction info — shipping address, order history, amounts, and payment status. Your card number never reaches our servers; PayMongo's hosted checkout collects it directly.
• Artwork images — photos of artwork you list, and (if you use the AI room-preview tool) the scene description you type. That image and description are sent to OpenAI's image API to generate the preview; the generated preview is returned to your browser and isn't kept on our servers, though we log that a preview was generated (and the text you typed) to enforce your plan's monthly limit.
• Communications — notifications the platform sends you, and anything you send us via Contact or support email.
• Technical data — IP address, browser/device information, and pages visited, collected automatically by our hosting and error-monitoring providers to keep the site running and to diagnose crashes.
• Cookies — only what's needed to keep you signed in (session cookies set by Supabase Auth). We don't run third-party advertising or tracking cookies.

3. How we use it

• Operate the marketplace — listings, search, checkout, order tracking, notifications.
• Process payments, hold funds in escrow, and release payouts to artists.
• Calculate and arrange shipping through Philippine couriers such as J&T Express, JRS Express, LBC Express, Ninja Van and 2GO Express.
• Respond to support requests and enforce our Terms of Service (e.g. investigating fraud or policy violations).
• Meet legal and tax obligations, including keeping financial records the law requires us to keep.

We do not sell your personal data to anyone, for any reason.

4. Who we share it with

We share data with the processors that make the platform work — never for their own marketing use:

• Supabase — our database, authentication, and file storage provider.
• PayMongo — our PH-licensed payment processor; handles your card/e-wallet details directly and is the merchant of record on your statement.
• Emailit — sends transactional email (order updates, notifications).
• OpenAI — generates AI room previews, as described above.
• Cloudflare — hosts the app and serves it over HTTPS.
• The other party to your order — a buyer's shipping details go to the artist fulfilling that specific order, and only that order; a seller's public profile is visible to anyone browsing the site.
• Law enforcement or regulators, only when legally required.

Some of these providers process data on servers outside the Philippines. Where that happens, it's under that provider's own contractual and security commitments as a data processor.

5. Escrow and financial records

When you buy something, your payment is held in escrow (tracked in our own ledger) until the order completes — either you confirm delivery, or 14 days pass after the artist marks it shipped. This means order and payment records necessarily persist even after that point, including through an account deletion (see below) — we're required to retain real financial transaction records regardless of account status.

6. Your rights

Under the Data Privacy Act, you can:

• Ask what personal data we hold about you, and get a copy of it.
• Ask us to correct inaccurate data — most of this you can already do yourself from your Account settings.
• Ask us to erase or anonymize your data, subject to the financial-record exception in Section 5 and 7.
• Object to certain processing, or withdraw consent where processing depends on it.
• File a complaint with the National Privacy Commission if you believe we've mishandled your data.

To exercise any of these, email support@obramaestra.art.

7. Deleting your account

From Account in your dashboard, you can delete your account at any time.

• No order, purchase, or payout history: your account and profile are removed outright.
• Existing order, purchase, or payout history: your profile is scrubbed of personal details (name, avatar, bio, contact info) and sign-in is permanently disabled. The underlying order and financial records stay, as required by law and described in Section 5 — but they're no longer tied to identifying information about you beyond what a transaction record legally requires.

8. Security

Data in transit is encrypted (HTTPS everywhere). Database access is governed by row-level security policies scoped to what each user is allowed to see. Payment card data never touches our servers at all. No system is perfectly secure, but we design for the principle that a bug in the app shouldn't expose data it has no reason to touch.

9. Age requirement

Obramaestra involves real payments and binding transactions, so you must be at least 18 years old (or the age of legal majority where you live, if higher) to create an account.

10. Changes to this policy

If this policy changes materially, we'll update the date at the top of this page. Continuing to use Obramaestra after a change means you accept the updated policy.

11. Contact

Questions about this policy or your data: support@obramaestra.art.