1. Introduction and Scope
Diwalex is committed to protecting your personal information in accordance with Republic Act No. 10173, the Data Privacy Act of 2012, and its implementing rules and regulations. This Privacy Policy explains how we collect, use, store, and share personal information when you interact with:
- The marketing website at www.diwalex.com — a static public site; no account required, minimal data processed.
- The application at app.diwalex.com — the authenticated research tool; requires sign-in and involves broader data processing as described below.
By using either surface you acknowledge that you have read and understood this Policy. If you do not agree, please stop using Diwalex. This Policy should be read alongside our Terms of Service.
2. Personal Information Controller
Diwalex and its operators are the personal information controller for the personal data described in this Policy. To exercise any of your rights or to raise a privacy concern, contact us at info@diwalex.com.
3. Information We Collect
We collect the following categories of personal and non-personal information:
- Google account profile. When you sign in with Google, we receive your name, email address, Google account identifier, and profile photo from Google's OAuth service. We use this to create and maintain your Diwalex account.
- Session data. We maintain a server-side session and
a session cookie on the app domain (
app.diwalex.com). The session identifies your authenticated state for the duration of your login. - Chat messages and threads. Your questions and the AI-generated answers are stored in our database, organised by conversation thread. This allows you to review your chat history within the application.
- Uploaded reference files. Documents you upload (DOCX and PDF) are stored on our servers. Their text is extracted and indexed to enable the AI to retrieve relevant passages when you ask questions. The original file and embeddings are retained until you delete them or close your account.
- Answer-mode preference and generation metadata. We record which answer mode you prefer (Standard or Swift), and per-generation metadata such as the mode used for each answer and whether an automatic fallback occurred. This is used to apply usage quotas and to improve reliability.
- Technical logs. Our servers log request metadata (IP address, browser user-agent, timestamps, endpoint accessed) and error traces for security monitoring and reliability. Logs are retained for up to 30 days by default.
We do not collect payment card information. We do not build advertising profiles.
4. How We Use Your Information
We use the information we collect to:
- Authenticate you and maintain your session;
- Provide the research and chat features, including searching the legal corpus and processing your uploaded files to generate contextual answers;
- Apply rate limits and usage quotas for the Swift answer mode;
- Detect abuse, investigate security incidents, and maintain the integrity of the Service;
- Improve service reliability and diagnose errors;
- Comply with applicable legal obligations.
5. Legal Bases for Processing
We rely on the following legal bases under the Data Privacy Act of 2012 and its implementing rules:
- Performance of a contract. Processing your Google profile, session, and chat data is necessary to provide the Service you have signed up for — without it we cannot authenticate you or answer your questions.
- Consent. When you upload a reference file, you consent to its processing for the purpose of augmenting your research session.
- Legitimate interests. We retain technical logs and generation metadata based on our legitimate interests in securing and improving the Service, provided these interests are not overridden by your privacy rights.
- Legal obligation. Where applicable law requires us to process or retain data, we do so.
6. Sharing and Processors
We do not sell your personal data to third parties. We share data only with the following categories of service providers (data processors) who help us operate the Service:
- Cloudflare. Provides infrastructure for our marketing website (Cloudflare Pages) and secure connectivity for the application (Cloudflare Tunnel). Cloudflare may process metadata such as IP addresses as part of its network and security services. Cloudflare is subject to its own Privacy Policy.
- Google (OAuth). Google authenticates your identity via OAuth 2.0 and provides us with your basic profile. Google's use of information received from Diwalex is governed by Google's Privacy Policy.
- Cloud generation provider (Swift mode). When you use the Swift answer mode, your question text is sent to an external cloud AI service to generate a response. This provider processes your question but does not receive your account profile, uploaded files, or chat history beyond the immediate query context. This processing occurs only when you actively use Swift mode.
All processors are engaged under contractual obligations that require them to handle your data only as directed and in accordance with applicable data protection law.
7. International Data Transfers
Some of our processors, including Cloudflare, Google, and the cloud generation provider used for Swift mode, may process data in jurisdictions outside the Philippines. By using Diwalex you acknowledge that your data may be transferred to and processed in other countries. We rely on contractual safeguards and our processors' own compliance with applicable data protection frameworks to protect your data during such transfers.
8. Retention
We retain your personal information for as long as your account is active and for a reasonable period thereafter to comply with legal obligations or resolve disputes. Specifically:
- Account profile data: retained while your account is active.
- Chat threads and messages: retained until you delete them within the app or close your account.
- Uploaded files and their indexed content: retained until you delete them within the app or close your account.
- Technical logs: up to 30 days.
- Generation metadata (answer mode, fallback flags): retained with your account for quota and analytics purposes.
To request deletion of your account and associated data, email info@diwalex.com.
9. Cookies and Similar Technologies
Application (app.diwalex.com). We set one essential, HttpOnly session cookie that maintains your authenticated state. This cookie is strictly necessary for the Service to function; it is not used for advertising or cross-site tracking, and you cannot opt out while remaining signed in.
Marketing site (www.diwalex.com). We do not currently use analytics, advertising, or tracking cookies on the marketing site. If this changes, we will update this Policy and add any required consent mechanism.
10. Security
We implement reasonable technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction, including encrypted data transmission (HTTPS), server-side session management, and access controls. No security measure is completely infallible. If you believe your account has been compromised, contact us immediately at info@diwalex.com.
11. Your Rights Under the Data Privacy Act
As a data subject under Republic Act No. 10173, you have the following rights:
- Right to be informed — to know what personal data we collect and how it is used (this Policy fulfils that obligation).
- Right to access — to obtain a copy of the personal data we hold about you.
- Right to rectification — to have inaccurate or incomplete data corrected.
- Right to erasure (right to be forgotten) — to have your personal data deleted, subject to any legal grounds we have for continued processing.
- Right to object — to object to processing based on legitimate interests, including profiling for direct marketing.
- Right to data portability — to receive your personal data in a structured, commonly used, and machine-readable format where technically feasible.
- Right to lodge a complaint — to file a complaint with the National Privacy Commission (NPC) at privacy.gov.ph if you believe your rights have been violated.
To exercise any of these rights, email us at info@diwalex.com. We will respond within the timeframe required by applicable law.
12. Children's Privacy
Diwalex is not directed to children under the age of thirteen (13). We do not knowingly collect personal information from children. If we learn that we have collected personal data from a child under 13 without verifiable parental consent, we will delete it promptly. If you believe we have such information, contact us at info@diwalex.com.
13. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page is authoritative. Material changes will be communicated via an in-app notice or email where practicable. Your continued use of Diwalex after the effective date of the revised Policy constitutes your acceptance of the changes.
14. Contact
For privacy inquiries, requests to exercise your data subject rights, or to report a security concern, contact us at info@diwalex.com.