Privacy Notice
Last updated 17 August 2026
This notice explains what Narra Warranty collects, why, and what you can ask us to do about it. It is written to the Data Privacy Act of 2012 (Republic Act 10173) and its implementing rules.
There are two kinds of people here, and the difference matters throughout. A shop signs up and issues warranties. A customer buys something from that shop and receives one. For a customer's details, the shop is the personal information controller and we act on the shop's instructions as its processor.
What we collect
From a shop owner or staff member
- Name and email address, and a password hash if you set a password.
- Your Google account identifier and email, if you sign in with Google. We never receive your Google password.
- The shop's own details: name, address, phone, contact email and logo — all of which you choose to print on your warranties.
- How you heard about us, if you answered that during sign-up.
- Your role and permissions, and which branch you work at.
About a customer, entered by the shop
- Name, and an email address or mobile number where the warranty is sent.
- What was bought: item, serial number, amount, purchase date and warranty period.
- The receipt or invoice number, if the shop records one.
- Any claims made against the warranty, and whether it was voided.
Automatically
- A session cookie when you sign in, so the next page knows it is still you. It holds a random token and nothing about you.
- Server logs of requests, kept for troubleshooting.
- We do not use analytics, advertising or tracking cookies, and there are no third-party scripts on any page.
Why we may hold it
For a shop: to perform the contract you entered into when you created an account, and to charge you if you are on a paid plan.
For a customer: because a warranty is a record the shop is obliged to be able to honour, and because a warranty nobody can produce later is not a warranty. A shop relies on its legitimate interest in keeping its own sale records, and on Republic Act 7394 where that applies.
Who else sees it
We do not sell personal information, and we never will. It is shared only with the services needed to run this one, and only when they are actually used:
| Service | What it sees | Where |
|---|---|---|
| Amazon Web Services | Everything — the server and database run there | Singapore |
| Cloudflare | Requests to the site, including visitor IP addresses | Global |
| Resend | The recipient's email address and the warranty email | United States |
| PayPal | If you pay through PayPal: your email and payment details. We never see card numbers | Global |
| PayMongo | If you pay by card or e-wallet through PayMongo: the same | Philippines |
| Only that you chose to sign in, if you use Google sign-in | Global | |
| FreeTSA | A cryptographic hash only, never the warranty or any name | Germany |
The timestamping service is worth singling out. It receives a hash — a fixed-length fingerprint that cannot be turned back into what produced it — so it can attest that a batch of warranties existed on a given day without ever learning what any of them say.
We will also disclose information where the law requires it, and will tell you unless we are forbidden from doing so.
How long we keep it
Warranties are kept for as long as the shop's account is open, because a warranty issued today may be claimed years from now, and because a record that vanished could not be verified by anyone relying on it. A voided warranty is kept and marked voided rather than deleted — the record of what happened is the thing being protected.
If a shop closes its account, we keep its records for 30 days so it can be recovered from a mistake, then delete them. Sessions expire after seven days. Backups are kept for 30 days.
Your rights
Under the Data Privacy Act you may ask to be told what we hold about you, to have it corrected, to have it erased or blocked, to object to how it is used, to receive a copy in a portable form, and to be indemnified for damage caused by false or unlawfully obtained information.
If you are a customer of a shop, ask the shop first — they control your record and can correct or void it directly. If they cannot help, write to us and we will act on their behalf.
Write to barrera.vincentlloyd@gmail.com. We answer within 15 working days.
You may also complain to the National Privacy Commission at privacy.gov.ph.
How it is protected
Every page is served over TLS. Passwords are stored as hashes and never in a form we could read. Session tokens are stored hashed, so a copy of the database does not let anyone sign in as you. The database is not reachable from the internet. Each warranty is signed when issued and linked to the one before it, so a record altered afterwards stops verifying — including by us.
If a breach occurs that is likely to put you at risk, we will notify the National Privacy Commission and the people affected within 72 hours of knowing, as the Act requires.
Changes
If this notice changes in a way that affects you, we will say so on this page and date it. The date at the top is when it last changed.