Last updated: July 13, 2026
This page explains what information startup.ph (“we,” “us”) collects through this site, why, and what rights you have over it under the Philippines’ Data Privacy Act of 2012 (RA 10173).
Information we collect
Directory and listing submissions
When you submit a listing through one of our forms, we collect exactly the fields on that form. Some of it becomes your public listing if approved; the rest is kept internal, used only to review and correspond about your submission — it is never published or displayed publicly.
- Startup submissions: the submitter’s name, role, LinkedIn profile, and professional email (kept internal — used to verify the submission and correspond with you) plus an optional personal email; and the company’s public profile information — name, website, tagline, social links, founding year, location, industry, stage, employee count, funding status, founder story fields, logo, and an optional demo video link (published if approved).
- Investor submissions: the submitter’s name, professional email, and LinkedIn profile (kept internal) plus the public investor profile — firm name, investor type, bio, investment thesis, stage and geography preferences, check size, optional portfolio list, and your chosen contact method (published if approved). We never publish a direct email address for investors.
- Event submissions: the organizer’s name and contact email (kept internal) plus the public event listing — event name, date, time, format, venue or platform, description, registration link, cost, and expected attendance (published if approved).
- Job submissions: the submitter’s name and email (kept internal) plus the public job listing — company details, role, location, work setup, employment type, skills, description, and salary range if provided (published if approved). One exception to our “contact info stays internal” rule: the application method you provide (a URL or email) is deliberately shown to applicants, since that’s the point of a job listing — we say so directly on that form.
- Tool/deal submissions: the submitter’s name and email (kept internal) plus the tool’s name, category, description, URL, and deal terms if any (published if approved).
- School/org submissions: the submitter’s name and personal email, and an optional university email offered as a stronger verification signal (all kept internal) plus the public listing — organization name, school or university, focus area, description, an optional self-reported member-count range, and a contact link (published if approved).
Newsletter signups
If you subscribe to our newsletter, we collect your email address and send it directly to MailerLite, the email service provider we use to manage subscriptions and send the newsletter itself. We don’t keep a separate copy of newsletter subscriber emails in our own systems — MailerLite is the system of record, governed by MailerLite’s own privacy policy. You can unsubscribe at any time via the link in any newsletter email.
Contact form messages
If you use our Contact page, we collect your name, email, subject, and message, and email it directly to our team so we can respond. We do not store contact form messages as a database record on this site beyond that email.
Automated spam and abuse prevention
Every form on this site is protected by two automated checks: a rate limit (no more than 5 submissions per form per IP address per hour) and Google reCAPTCHA v3. For the rate limit, we store a one-way, non-reversible hashed version of your IP address — never the raw address — purely to count submissions; this hash is automatically deleted after one hour and is never linked to the content of your submission. Google reCAPTCHA independently receives your IP address and certain browser signals as part of verifying you’re not a bot; that exchange happens directly with Google and is governed by Google’s Privacy Policy, not ours.
What we don’t collect
This site does not run Google Analytics, advertising trackers, or any third-party analytics or advertising pixel — we checked our own code to confirm this before writing this policy, rather than assume. We also don’t use tracking cookies. A few interface preferences — dark or light mode, list or calendar view on the Events page, and whether you’ve dismissed the install prompt or newsletter popup — are stored only in your browser’s local storage. Our servers never receive or read that information; it stays on your device.
How we use this information
We use the information above to: review and, if appropriate, publish your directory submission; correspond with you about a submission or contact message; send our newsletter to people who’ve asked for it; and detect and prevent spam or abusive form submissions. We do not sell personal information, and we do not use anything you submit for advertising or profiling purposes.
Data retention
We aim to be specific here rather than fall back on a generic “retained indefinitely” statement, since that’s not accurate for how this site actually works:
- Published listings are retained as your live public profile for as long as it stays on the site — until you ask us to remove it, or we remove it ourselves for a policy violation or accuracy issue.
- Pending or declined submissions are retained only as long as needed for our review team to evaluate them. You can ask us to delete a pending or declined submission at any time.
- Rate-limit data (the hashed IP address described above) is automatically deleted after one hour — this happens without any request on your part.
- Contact form messages live only in the email inbox they’re sent to, governed by our team’s normal email retention, not a database table on this site.
- Newsletter subscriber emails are retained by MailerLite per their own retention practice, until you unsubscribe or ask us to remove you.
Who we share information with
We share information with exactly three categories of outside party, and only as needed to run the site: MailerLite (newsletter delivery), Google reCAPTCHA (spam prevention), and our web hosting provider (which, like any web host, keeps standard server access logs). We do not sell or rent personal information to anyone. We may disclose information if genuinely required to by Philippine law or a valid legal process.
Your rights under the Data Privacy Act
As a data subject under RA 10173, you have the right to:
- Be informed that your personal data is being processed — which is what this page is for.
- Access the personal data we hold about you.
- Correct inaccurate or outdated data we hold about you.
- Erasure or blocking of your data, including withdrawing a submission or having a published listing taken down.
- Object to processing of your data.
- Data portability, where applicable.
- File a complaint with the National Privacy Commission if you believe we’ve mishandled your data.
- Damages, where the law provides for it, for violations of your rights as a data subject.
To exercise any of these rights, reach us through our Contact page — select “Report an Error” or “Technical Issue” if your request relates to a specific listing, or “General Inquiry” otherwise.
Security
We apply reasonable technical safeguards to submitted information, including CSRF protection, server-side input validation, and spam/rate-limit protection on every form. No method of transmission over the internet is completely secure, and we can’t guarantee absolute security.
Children’s privacy
startup.ph is a business and startup ecosystem platform and isn’t directed at children. We don’t knowingly collect personal information from anyone under 18.
Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision.
Contact
Questions about this policy or how we handle your data? Reach us through our Contact page.