Privacy Policy

1. Who we are

DocketPH is a product ofJeva Technologies OPC, a One Person Corporation registered in the Philippines ("we", "us", "our"). We operate the DocketPH platform, including the website at docket.ph and the workspace at app.docket.ph. We provide case-management software for Philippine law firms and legal practitioners.

We are a Philippine-based service. Personal data we collect is stored and processed on cloud infrastructure operated by our service providers.

Jeva Technologies OPC is a corporation registered with the Philippine Securities and Exchange Commission (SEC) under SEC Registration No. 2025070211232-01. We comply with applicable data protection requirements under Republic Act No. 10173 and its implementing rules.

For account and billing data about users of the Service, we act as a personal information controller. For client, matter, document, and comment data that a firm stores in its workspace, the firm is the personal information controller and we process that data as a personal information processor on the firm's instructions, to provide the Service.

2. Our Data Protection Officer

We have designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. You may reach our DPO at:

• Email: [email protected]

3. Information we collect

Account information

When you create an account, we collect:

• Email address
• Password (stored as a one-way cryptographic hash — we never store your plaintext password)
• Account creation date and activity timestamps

You may also add a first name, last name, phone number, and profile photo. If you sign in with Google, we receive your email address, name, and profile photo from Google to create or update your account.

Workspace information

When you open or join a workspace, we store the workspace name, slug, logo if you upload one, member roles, and invitation records (invitee email, role, status, and expiry).

Client, matter, and file data

To run the docket, authorized members may enter and we then store:

• Client records — name or organization, email, phone, and address
• Matter records — titles, practice type, court and docket details, parties and counsel, notes, hearings, deadlines, outcomes, and assignments
• Documents and attachments uploaded to a matter or comment
• Comments, mentions, and a history of changes to the matter
• In-app notifications about activity in workspaces you belong to

This workspace data may include personal information about clients, opposing parties, and other individuals. The firm that owns the workspace decides what to store and who may see it. Users are responsible for ensuring they have the legal right to submit that data. We do not verify the accuracy, legality, or ownership of Workspace Content.

Usage and technical data

We automatically collect limited technical data to operate and secure the Service:

• Request timestamps and response latencies
• HTTP status codes and error types (we avoid putting document contents in error logs)
• IP addresses — processed for security, fraud prevention, and abuse detection, and not retained longer than necessary for those purposes
• Sign-in tokens stored in your browser so you stay signed in to the workspace

4. How we use your information

We use the information we collect to:

• Authenticate you and secure your account
• Provide the workspace — boards, clients, cases, files, comments, and history
• Send transactional email (email confirmation, password reset, workspace invitations, notification digests, reminders, and billing notices) — no marketing email without your explicit opt-in
• Show in-app notifications and let teammates collaborate on the file
• Investigate abuse, enforce our Terms of Service, and comply with legal obligations
• Improve reliability and performance using aggregated, anonymized usage patterns

5. Legal basis for processing

Under the Data Privacy Act of 2012 (RA 10173), we process personal data on the following bases:

• Contractual necessity — processing required to provide the Service you signed up for (accounts, workspaces, files)
• Legitimate interests — security monitoring, abuse prevention, and service improvement
• Consent — for any optional communications you opt into
• Legal obligation — when required by Philippine law or a lawful order

When we process Workspace Content as a processor, we do so on the firm's instructions as reflected in your use of the product and our Terms of Service.

6. Data storage and location

Personal data is stored and processed on cloud infrastructure operated by our service providers. File uploads are stored with Microsoft Azure. Account and workspace records are stored in our application database. Data may be transferred to and processed outside the Philippines where a provider operates. We ensure that such transfers are subject to appropriate safeguards, including data processing agreements and contractual protections consistent with applicable data protection laws.

If you sign in with Google, Google processes your sign-in under Google's own terms and privacy policy.

7. Data retention

• Account data — retained for the lifetime of your account. Deleted within 30 days of account closure.
• Workspace content (clients, matters, files, comments, history) — retained while the workspace is active. Deleted within 30 days of workspace or account closure, except where we must keep records to comply with law.
• Invitations — retained while pending or as needed for audit after they are accepted, revoked, or expire.
• Notification records — retained while useful to show activity in the workspace, then purged with the workspace.
• Technical logs — automatically purged after 90 days unless needed longer for security investigations.

8. Sharing of information

We do not sell, rent, or trade your personal data. We may share information only in the following limited circumstances:

• Service providers — Cloudflare R2 (file storage), Supabase (database), DigitalOcean (application hosting), Mailtrap (email delivery), PayMongo (payment processing), Google (sign-in, if you choose it, and Analytics on the landing page and the workspace), Meta (the Pixel and Conversions API on the landing page and the workspace), Cloudflare Web Analytics (the Insights beacon on the landing page) and Cloudflare Turnstile (a bot check on signup and login), and Slack (receives new users' names and emails for internal notifications). Turnstile is not used for advertising. Google Analytics and the Meta Pixel count page visits and record a confirmed sign-up, a visit to the billing page, and a completed purchase. If we run Google Ads or Meta ads, those events can be imported as conversions. Cloudflare Web Analytics counts page views without personal identifiers. These providers process data only as directed by us or, for Google sign-in, as you authorize, and under applicable agreements.
• Workspace members — content you put in a workspace is visible to other authorized members of that workspace.
• Legal requirements — in response to a valid court order, subpoena, or lawful request from Philippine government authorities. Where we are a processor of Workspace Content, we will, unless legally prohibited, notify the workspace owner so the firm can respond.
• Business transfer — if Jeva Technologies OPC is acquired or merges with another entity, we will notify affected users prior to any transfer of personal data and obtain consent where required by RA 10173.

9. Your rights under RA 10173

As a data subject under the Data Privacy Act of 2012, you have the right to:

• Be informed — know what personal data we hold about you and how it is processed
• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your personal data, subject to legal retention requirements
• Data portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests
• Lodge a complaint — file a complaint with the National Privacy Commission (NPC) at privacy.gov.ph

To exercise any of these rights for your DocketPH account, contact us at [email protected]. We will respond within 15 business days in accordance with applicable law.

If your request concerns client or matter data stored by a firm in its workspace, we may direct you to that firm as the personal information controller. We may request reasonable verification of your identity before fulfilling a request. Requests may be limited or denied where permitted by law.

10. Personal data breach notification

In the event of a personal data breach that poses a real risk to your rights and freedoms, Jeva Technologies OPC will:

• Notify the National Privacy Commission (NPC) within 72 hours of discovery of the breach
• Notify affected data subjects without undue delay, including the nature of the breach, the data involved, and remedial measures taken — and, for Workspace Content, notify the workspace owner so the firm can meet its own duties
• Document all breaches in our internal breach register regardless of whether notification is required

If you discover or suspect a security vulnerability, please disclose it responsibly to [email protected].

11. Security

We implement appropriate technical and organizational measures to protect personal data, including:

• Passwords stored as one-way hashes — never in plaintext
• All data transmitted over HTTPS/TLS
• File access scoped to authorized members of the workspace
• Database and storage access restricted to application servers
• Access controls and least-privilege principles applied to internal systems

No system is perfectly secure. If you discover a security vulnerability, please contact [email protected].

12. Cookies and sessions

The landing page (docket.ph) and the workspace (app.docket.ph) load Google Analytics, the Meta Pixel, and the Cloudflare Web Analytics beacon. Google may set cookies such as _ga, and Meta may set cookies such as _fbp and _fbc, to distinguish browsers and to connect a visit on docket.ph with a later visit on app.docket.ph. We use this to count page views and to record a confirmed sign-up, a visit to the billing page, and a completed purchase. A completed purchase is also sent from our server to Google Analytics and to Meta so the payment can be matched after checkout. Cloudflare Web Analytics counts page views without personal identifiers or cookies. We do not send your password, workspace documents, or client and matter content to Google or Meta.

If you arrive from a Google or Facebook ad, we store that ad's click identifier (such as gclid or fbclid) and the campaign parameters from the link in a first-party cookie on docket.ph. The workspace can read that cookie, so the same click is still there when you create an account. We then save it on your user record, including the Analytics client id and the Meta browser id for that browser, so a later sign-up or purchase can be matched to the same visit. We keep the first ad click we see. The cookie lasts 90 days. We do not use it to follow you on other websites.

When you sign in to the workspace, we issue a signed token that your browser stores locally and sends with each request. The token expires automatically and is removed when you sign out. If you use Google sign-in, a short-lived cookie is set only to complete that sign-in.

Signup and login with email and password also load Cloudflare Turnstile, which checks that the request comes from a person. Turnstile is not used for advertising or cross-site tracking.

The workspace may also store a first-party cookie to remember whether the sidebar is expanded.

13. Sensitive personal information

DocketPH is built so firms can keep a professional docket, which may include sensitive personal information about clients and cases. You should store in the Service only what the matter requires, limit access to authorized teammates, and follow your professional duties of confidentiality.

We process that information solely to provide the Service to your workspace. We do not use it for advertising or to train AI models.

14. Children's privacy

DocketPH is not directed at children under 18. We do not knowingly collect personal data from minors as users of the Service. If you believe we have inadvertently collected such account data, please contact us at [email protected] and we will delete it promptly.

A firm may store information about a minor as part of a matter (for example, a family case). That processing is the firm's responsibility as personal information controller.

15. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users at least 15 days before taking effect, and by updating the "Last updated" date above. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

16. Contact us

For privacy-related inquiries, requests, or complaints:

• Email: [email protected]
• Privacy requests: [email protected]
• Company: Jeva Technologies OPC (SEC Reg. No. 2025070211232-01), Philippines

You also have the right to lodge a complaint with the National Privacy Commission (NPC) at privacy.gov.ph if you believe your rights under RA 10173 have been violated.