Legal
Privacy Policy
Version 1.1 · last updated 2026-10-21. This is how we handle personal information under the Data Privacy Act of 2012 (Republic Act No. 10173) and its rules. Please read it with our Terms and Conditions.
1. Who is responsible
"Love Of My Life", "Mandaluyong City, Philippines", runs "Love of My Life" and is the “personal information controller” for the information described here. Write to hello@loveofmylife.love for anything about your information.
2. What we collect, and why
| What | Where it comes from | What we use it for |
|---|---|---|
| Your name, e-mail address and password (stored only as a one-way Argon2id hash) | You, when you sign up | Your account, signing you in, contacting you about your account and orders, security |
| Your Google or Facebook name, e-mail address and account ID | Google or Facebook, when you choose to sign in with them | Creating and signing in to your account. We do not receive your password with them or post to your account. |
| Your content: photos, letters, names of the people you write to, the song you choose (a YouTube link), the lock question and a hash of its answer, the template and colours you pick | You | Building and showing your pages to the people you share them with. This can include information about other people (see section 9). |
| Orders and payments: plan, amount, date, method (GCash, Maya, card), status and the payment provider’s reference. Not your full card number or e-wallet login. | You and our payment providers | Taking payment, renewals, receipts, refunds, fraud checks, accounting and tax. Payment references are stored encrypted. |
| Technical data: IP address, browser and device type, pages requested, times, errors, and the number of recent attempts (for example wrong lock answers) used to apply rate limits | Your browser | Running and securing the service, limiting abuse (for example repeated sign-in or unlock attempts), fixing faults |
| Cookies and similar data (section 6) | Your browser | Keeping you signed in, protecting forms, understanding how the website is used |
| Messages and reports you send us, and what we need to answer them | You | Support, requests about your information, takedown reports |
We do not ask for sensitive personal information (such as health, religion, or government IDs). If you choose to put it in a letter or photo, it is held like the rest of your content, and you are responsible for having the right to share it. We do not sell personal information, do not show advertising, and do not use your content to train AI models.
3. Why we may process it (our legal grounds)
- To carry out our contract with you (your account, your pages, your orders).
- Your consent, for example for analytics cookies and optional sign-in with Google or Facebook, which you can withdraw at any time (section 8).
- A legal obligation, such as keeping records of payments, or answering lawful orders.
- Our legitimate interests in keeping the service secure, preventing fraud and abuse, and improving it, which we weigh against your rights.
4. Who we share it with
Only as needed, and never for their own advertising:
- Hosting and file storage (currently DigitalOcean) holds our servers, database and your uploaded photos.
- Payment providers (currently PayMongo and, where offered, Xendit, and the e-wallets and banks behind them) process payments. Card details go from your browser straight to them.
- Google provides sign-in, analytics (Google Analytics) and fonts; Meta provides Facebook sign-in; YouTube plays the song on a page, so a visitor’s browser contacts YouTube when the song loads.
- People you share a page with see what you put on that page. Anyone with the link (and the answer, if you set one) can see it.
- Authorities and advisers when the law requires it, to protect someone from serious harm, or to establish or defend a legal claim, and professional advisers bound by confidentiality.
- A successor if the service is transferred to another operator, who will be bound by this policy.
5. Where it goes
Our providers run data centres in and outside the Philippines, so your information may be processed in other countries. We use providers that protect it by contract and security measures, and we stay accountable for it under the Data Privacy Act.
6. Cookies and analytics
- Needed to work: a session cookie (
naluz_session, lasts up to two hours of inactivity) that keeps you signed in, and a security token on forms. These cannot be switched off if you want to sign in. - Analytics: on the landing page, sign-in, sign-up and dashboard we use Google Analytics 4, which sets cookies (
_ga,_ga_*) and tells us in aggregate how the website is used. It is not on the pages people make for each other, nor on the admin area. - Where visitors come from: on the landing page, demo, sign-in and sign-up we note which link or website brought you (for example an advertisement) with two first-party cookies: a random visitor id (
lom_v, up to 13 months) and the first campaign that brought you (lom_a, 30 days). If you create an account, that campaign is saved with it. We keep no IP address or device details for this, and it is not on the pages people make for each other. - YouTube: if a page has a song, YouTube may set its own cookies when the player loads.
- Fonts: text fonts are loaded from Google Fonts, which sees your IP address.
You can block or delete cookies in your browser, or opt out of Google Analytics with Google’s browser add-on (tools.google.com/dlpage/gaoptout). Blocking analytics does not affect the service.
7. How long we keep it
- Your account and content: until you delete them or ask us to, or until we close an inactive free account after reasonable notice.
- Deleted photos and pages: removed from the service straight away; the files are deleted from storage shortly after, and may remain in backups until those expire in the ordinary course.
- Expired plans: your content stays so you can renew; it is not shown to visitors.
- Payment and order records: as long as Philippine tax, accounting and anti-fraud rules require. If you have paid, we deactivate rather than erase your account and remove everything else.
- Technical logs: short-lived (days to a few weeks), except what we need to investigate abuse or a security incident.
- Reports and requests: as long as needed to handle them and show we did.
8. Your rights
Under the Data Privacy Act you have the right to: be informed; access your personal information; object to its processing or withdraw consent; have it corrected; have it erased or blocked in the cases the law allows; receive a copy in a common format (data portability); claim compensation for damage from unlawful processing; and complain to the National Privacy Commission.
To use any of them, write to hello@loveofmylife.love from the e-mail address on your account, say what you want, and, for a page, give its link. We may ask for proof it is you. We aim to reply within 30 days. We may refuse or limit a request where the law allows (for example to protect another person’s privacy, or because we must keep payment records), and we will tell you why.
You can also correct your own content in the dashboard, delete a page or photo yourself at any time, cancel a subscription, and sign out of Google or Facebook access in those services’ settings.
9. Other people in your content
A page often shows another person: their name, face, voice-like details in a letter. By putting it there you promise you have their permission, and you take responsibility for it (Terms, section 5). If a photo of you is on a page without your agreement, or someone shared something private about you, tell us at hello@loveofmylife.love with the page link and we will act on it (Terms, section 7). People who only open a page do not need an account; we process their IP address and the fact that they opened or tried to unlock a page, to keep it private and prevent abuse, and nothing about them is shared with the sender.
10. Children
The service is for people 16 and over. If you are under 18 you need the permission of a parent or guardian to use it and they must make any purchase. We do not knowingly collect information from anyone under 16. If you think a child has given us information, or that a photo of a child was shared without a parent’s permission, write to us and we will remove it. We never allow sexual content involving anyone under 18 and report it to the authorities.
11. How we protect it
Pages are hidden from search engines unless the owner turns on search. A lock answer is stored as a hash and checked on our server; the photos and letter of a locked page are not sent to the browser until it is right. Traffic uses HTTPS. Passwords are hashed with Argon2id; payment references are encrypted. Sign-in, unlock and form attempts are rate-limited. Access to our systems is limited to people who need it. No system is perfectly secure, so please use a strong, unique password and keep the link and answer of a private page to yourself.
If a breach seriously affects your information, we will tell the National Privacy Commission and the people affected within the time the law requires (72 hours from knowing of it for breaches that need notice), and say what happened and what to do.
12. Changes
When we change this policy we will post the new version here with a new date, and tell you in the service or by e-mail if the change matters. Changes to how we use your information in ways you have not agreed to will need your consent.
13. Complaints
Please tell us first: we want to put it right. You may also complain to the National Privacy Commission of the Philippines (privacy.gov.ph).