Privacy Policy

1. Who We Are

LevelUp CRM is a sales customer relationship management service operated by Hayah-AI Consulting (“we”, “us”, “our”). We are subject to the Philippines Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

Data Protection Officer contact: privacy@hayahai.com

2. What Data We Collect

When you submit a form or your information is added to LevelUp CRM, we may collect:

• Name, email address, phone number
• Company name, job title, industry
• Business website and LinkedIn profile URL
• Notes about your business needs or pain points
• IP address at time of form submission (for security and rate limiting)
• Email open and click activity (if you receive emails from us)

3. How We Use Your Data

We use your personal data only for the following purposes:

• To contact you about our services (only with your consent)
• To assess whether our services are a good fit for your business
• To send you relevant follow-up communications
• To improve the quality of our outreach and service offerings

We do not sell your data to third parties, use it for advertising, or share it with any party other than those necessary to deliver our services (e.g., email delivery providers).

4. Legal Basis for Processing

Under RA 10173, we process your personal data on the basis of your explicit consent, which you provide when submitting our forms. You may withdraw consent at any time by contacting us.

5. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes above, or until you request deletion. Contact records inactive for more than 2 years may be purged automatically. Email activity logs are retained for 1 year.

6. AI Processing

We use an AI service (Anthropic Claude) to help assess lead quality and draft outreach emails. Only the minimum data necessary for each task is sent to the AI service — full contact records are never transmitted. AI-generated content is always reviewed before being sent.

7. Your Rights Under RA 10173

As a data subject under the Philippines Data Privacy Act, you have the right to:

• Access — request a copy of all personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Erasure — request deletion of your personal data (“right to be forgotten”)
• Data portability — receive your data in a structured, machine-readable format
• Object — object to processing of your data for direct marketing purposes
• Withdraw consent — withdraw consent at any time without affecting prior processing

To exercise any of these rights, email us at privacy@hayahai.com. We will respond within 15 business days.

8. Data Security

All data is stored in Supabase (hosted on AWS ap-southeast-1, Singapore). Data is encrypted at rest and in transit. Access is restricted to authorized personnel only via role-based access controls and row-level security policies.

9. Complaints

If you believe your data privacy rights have been violated, you may file a complaint with the National Privacy Commission of the Philippines at www.privacy.gov.ph.

10. Contact

For any privacy-related questions or to exercise your rights:
privacy@hayahai.com