1. Who we are
Ermais Hex Engine (“Ermais”, “we”, “us”) operates ermais.com and portal.ermais.com, a satirical “Kulam as a Service” that sends harmless novelty emails. We are the personal information controller for the data described here. This policy explains what we collect, why, and the choices you have, in line with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.
It applies to people who create an account (“users”), people who receive an email through the Service (“recipients”), and visitors to our websites. Our Terms of Service also apply.
2. What we collect
Information you give us
- Account details: first name, last name, email address, and password (stored only as a salted scrypt hash — we can’t see it).
- Sends: the recipient’s email address, an optional nickname you type for them, the short reason you give (shown to them), the service you chose, and whether to sign with your name.
- Support: the content of tickets and replies you send us.
- Choices: terms acceptance (time and version), Pro waitlist sign-up, account deletion requests (and the optional reason you give), and settings you change.
Information collected automatically
When you register, log in, or use the portal, we record:
- Network: IP address, and the internet provider (ISP) and network (ASN) associated with it.
- Approximate location derived from your IP: country, region, city, postal area, approximate coordinates, and time zone. We never use GPS or ask for your device location.
- Device: browser, operating system, device type, user-agent string, browser language, browser time zone, and screen size.
- How you found us: referring website, first page visited, campaign tags in the link (UTM parameters), a random visitor ID, and — if you signed up from a kulam you received — which certificate and user referred you.
- Security signals: how long the sign-up form took to complete, login times, failed login attempts, active sessions (device, IP, country), and lockouts.
- Usage: pages viewed in the portal, sends made and their delivery status, and support activity.
Visitors who aren’t logged in may have page views recorded with the same network, location, device, and referral details. Known bots are filtered out.
3. If someone sent you a kulam
A user typed your email address into our portal. For each send we store:
- your email address, any nickname and the reason the sender entered, the kulam or maluk chosen, and the sender’s account (anonymous sends are anonymous to you, not to us);
- delivery information from our email provider, such as whether the email was delivered, opened, clicked, bounced, or reported as spam (opens and clicks are detected through standard email tracking pixels and links); and
- visits to your certificate page: time, view count, IP address, approximate location, and device.
The sender can see whether their email was delivered, opened, and whether the certificate page was viewed. If the sender chose to sign it, you’ll see their first name and last initial.
We use your address only to deliver that message, show the certificate, prevent abuse, and honor unsubscribes. We do not add you to any mailing list or send you marketing. Click “unsubscribe” in any email (always free) to block every future send to your address; we keep your address on a suppression list so the block keeps working.
If you ask to be notified about the upcoming Anting-anting Kulam Shield, we store your email, the certificate you came from, the time, and your approximate country, and email you once when it launches. You can ask us to remove you from that list at any time. To ask about your data or report misuse, email [email protected].
4. How we use it
- Provide the Service: create and secure your account, send kulams and certificates, show your history, and answer support requests.
- Send service emails: account activation, password resets, support replies, and important changes. We don’t send promotional email without your consent.
- Keep it harmless: captcha, rate limits, sending caps, duplicate checks, unsubscribe and bounce suppression, detecting bots, multiple accounts, and harassment, and acting on reports.
- Understand and improve: aggregate metrics such as sign-ups, activation, delivery and open rates, popular services, referral sources, and which campaigns work.
- Comply with law and protect the rights, safety, and property of users, recipients, and Ermais.
Some protections are automated (for example, a rate limit may block a sign-up or send). These don’t produce legal effects, and you can contact us to have a decision reviewed by a person.
5. Legal bases
Under the Data Privacy Act we process personal information because it is:
- necessary to provide the Service you signed up for (your account, sends, and support);
- in our legitimate interests, balanced against your rights — security, abuse prevention, delivering a message a user asked us to send to a recipient, honoring unsubscribes, and improving the Service;
- based on your consent, where we ask for it, which you can withdraw at any time; or
- needed to comply with legal obligations or respond to lawful requests.
We do not intentionally collect sensitive personal information (such as health, religion, or government ID numbers). Please don’t put it in nicknames, reasons, or support tickets.
7. International transfers
Some of our providers store or process data outside the Philippines, including in the European Union, the United States, and other countries where they operate. When data leaves the Philippines, we rely on providers that maintain appropriate contractual and security safeguards, and we remain accountable for it as required by the Data Privacy Act.
9. How long we keep it
We keep personal information only as long as needed for the purposes above, then delete or de-identify it. An automated job enforces these limits daily:
| Data | Retention |
|---|---|
| Account profile | While your account is open. When an admin approves your deletion request (usually within 7 days), we immediately remove your name, email, password, IP addresses, detailed location, and device details, keeping only de-identified records for aggregate statistics and abuse history. |
| Login sessions | Deleted when they expire (at most 30 days) |
| Activity and security logs | IP address, city, device, and referrer removed after 12 months; records deleted after 24 months |
| Sends | Sender IP and device removed after 12 months; recipient email, nickname, and reason removed after 24 months |
| Email delivery records | Any stored email content after 30 days; records after 12 months |
| Unsubscribe / suppression list | Kept for as long as the Service runs so the block keeps working (the IP address of the request is removed after 12 months) |
| Feature waitlists (e.g. Anting-anting) | Until we send the launch email, and at most 24 months |
| Account deletion requests | The optional reason and request IP are removed when the account is deleted, or 12 months after a request is cancelled or declined |
| Support tickets | Up to 3 years after the ticket is closed |
| Server logs and backups | Web server logs about 14 days; database backups on a rolling 14-day cycle |
We may keep specific information longer if needed to resolve a dispute, investigate abuse, or comply with law.
10. Security
We use organizational, physical, and technical measures appropriate to the risk, including HTTPS everywhere, salted password hashing, encryption of stored provider credentials, hashed session tokens, protection against cross-site request forgery, rate limiting and lockouts, captcha, and access restricted to authorized administrators. No system is perfectly secure. If a personal data breach is likely to put you at risk, we will notify you and the National Privacy Commission as required by law.
11. Your rights
Under the Data Privacy Act, you have the right to:
- be informed about how your personal information is processed;
- access your personal information and obtain a copy;
- object to processing, including withdrawing consent;
- correct inaccurate or incomplete information;
- have your information erased or blocked when it is no longer necessary or was processed unlawfully;
- data portability — receive your data in a commonly used electronic format;
- be indemnified for damages caused by inaccurate, unlawfully obtained, or unauthorized use of your data; and
- file a complaint with the National Privacy Commission (privacy.gov.ph).
Users can edit their name and request account deletion in Account settings. Recipients can block all future sends with the free unsubscribe link in any email. For everything else, email [email protected] with the subject “Privacy request”. We may need to verify that the request comes from you, and we aim to respond within 15 business days.
12. Children
The Service isn’t meant for children under 13, and users aged 13–17 need a parent or guardian’s permission. If you believe a child under 13 has given us personal information, contact us and we will delete it.
13. Changes to this policy
We’ll update this policy as the Service changes. For material changes we will notify users by email or in the portal before they take effect. The version and “Last updated” date at the top always show the current policy.
14. Contact & Data Protection Officer
For privacy questions, requests, or concerns, contact our Data Protection Officer at [email protected].