1. About this service

Suriin AI is a scam-detection and report-review application maintained by the Suriin AI Capstone Development Team. Personal information controller: [Operator name and address — to be confirmed]. Privacy contact: [Public privacy email — to be confirmed]. These placeholders are not functioning contact details. For current development requests, contact your project administrator.

This notice describes the current application. The operator must complete its contact details, hosting locations, processing grounds, and retention schedule before public deployment.

2. Information processed

• Account: email, name, required contact number, address and gender selection, profile details, role, preferences, and account activity. Authentication is handled by Supabase Auth; passwords are not exposed to reviewers.
• Reports: submitted or extracted text, links, available image evidence, source information, scan results, and expert review decisions. Submitted content can include information about you or other people.
• Browser storage: authentication session data, cached profile information, theme settings, and extension configuration. Automatic scanning processes content on supported pages when enabled; manual and highlight modes let you choose when to scan.

Only submit content you are entitled to share. Remove passwords, one-time codes, and unrelated sensitive information before reporting.

3. Purposes and access

You may manually include the sender’s displayed name or handle in a report. Authorized case reviewers can see it and it appears in the case PDF. Leaving the field blank identifies the sender as Anonymous. Suriin AI does not use submitted case reports for model training.

Authorized experts and administrators can access records needed for their roles. Supabase supplies authentication and database services. If notification email is enabled, the configured mail provider processes recipient addresses and notification content, which can include report identifiers, verdicts, and user-facing review guidance. A report link requires sign-in and appropriate access.

Turning off email notifications does not remove in-app notifications. Email preferences are optional and separate from signup acknowledgement.

When Gemini-assisted explanations are enabled, Suriin sends Google a list of matched indicator types, such as a request for sign-in details. The explanation request excludes message text, account identifiers, and quoted evidence.

Automated assessment uses a language model, message rules, link checks, and registry matches to produce risk indicators. These can be wrong and do not establish that anyone committed an offence. Reports may receive human review; you may request clarification or correction. An automated risk score is not a binding legal decision.

Provider processing may occur outside the Philippines depending on the deployed configuration. Final hosting countries and service-provider arrangements have not yet been confirmed. The operator remains responsible for appropriate safeguards; this notice does not promise Philippines-only storage.

4. Storage, security, and retention

The application uses role and ownership checks to restrict access. No system can guarantee absolute security. The public deployment must use HTTPS; the current local development service is not a public deployment.

The current application does not apply a fixed automatic retention period to all reports. Account deletion removes the account and detaches submitted reports from its user ID and email, but preserves report evidence and review information. Text or images may still contain identifying information; detaching an account is not the same as fully anonymizing or erasing its content. Backups require separate review.

5. Your choices and requests

You can update profile details, change notification preferences, export available account data, and use the account-deletion control in Settings. You can disable automatic scanning or remove the extension; removing it does not delete server-side reports.

For access, correction, objection, withdrawal of consent, blocking or erasure, and applicable data-portability requests beyond these controls, contact the privacy contact once published or your project administrator during development. We may need to verify your identity and assess applicable legal limits. Withdrawing consent affects processing that relies on it; it does not automatically erase records lawfully retained on another ground. You may also raise a complaint with the National Privacy Commission and pursue applicable remedies.

6. Signup acknowledgement and updates

Signup presents separate Privacy Policy and Terms and Conditions checkboxes. Each text link opens its own summary and a link to the full document. Reading or closing a summary never checks a box. You must manually select both boxes. Acceptance timestamps and document versions are saved with the account. An account without recorded acceptance is asked to make these choices after its first sign-in, including Google sign-in. Returning accounts are not prompted again automatically.

The operator should communicate material changes and obtain fresh consent where required for new purposes. Accepting service terms or reading a notice is not blanket consent to all processing. See NPC Circular No. 2023-04, Guidelines on Consent.

Chrome extension data use

Extension data is used for scam assessment, reports you choose to submit, and related service security. It is not sold, used for personalized advertising, or used for credit or lending decisions. Use of information received through the extension is subject to the Chrome Web Store User Data Policy, including its Limited Use requirements. Human review is limited to reports you submit for review and permitted security or legal purposes.

Automatic monitoring is opt-in. When enabled, visible incoming messages are sent for assessment; optional contextual analysis can also include recent messages from both sides. Manual and highlight scans send the content you select for that action. Disabling monitoring stops future automatic scans; it does not erase reports already submitted.

7. Philippine legal framework

The applicable framework is Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and relevant NPC issuances. Processing must be transparent, proportionate, and for legitimate purposes. Sections 12 and 13 distinguish lawful grounds for ordinary and sensitive personal information. A user's agreement cannot authorize all processing of other people's data.

This development notice is not a certification of compliance. The operator must document the appropriate grounds for each activity, necessary security measures, and a defensible retention schedule. The NPC’s right-to-be-informed guidance calls for clear information about processing, recipients, automated decisions, controller contacts, retention, and rights. Unresolved deployment details above must be completed before public use.