Privacy Policy

The short version

• We set no cookies. None at all.
• We count visits with Plausible, which uses no cookies, stores nothing on your device and never builds a profile of you. No advertising pixels, no session recording, no fingerprinting.
• Your bag lives in your own browser and is never sent to us until you check out.
• We never see your card, wallet or banking credentials. You pay in your own app.
• You send us a screenshot of your payment. We store it, and Google's Gemini reads it to check the amount. That is the one image we hold about you.
• One third party script loads when you browse, and it is the counter above. Every font, stylesheet and image is ours.
• We do not sell your information, and we never will.

Everything below is the same thing said properly. If any of it stops being true, this page changes on the same day.

1. Who is responsible for your data

Alexander Jethro Alfonso is the Personal Information Controller for the purposes of the Data Privacy Act of 2012 (RA 10173). There is no separate data protection department here. Write to agosperformance@gmail.com and the same person answers.

2. What we collect

What you give us

Your name, email address, delivery address, phone number and what you ordered, when you buy something or contact us. If you write to us, we keep the message.

The payment screenshot

You upload a screenshot of your own payment confirmation. We store that image in a private Google Drive folder and send a copy to Google's Gemini API, which reads the amount, the reference number and which app it came from so we can match it to your order. Nothing else is done with it and it is not used to train anything.

That screenshot is whatever your banking app put on your screen, so it may show your own name and a partial account number. We do not ask for either and we do not use them for anything routine. The one exception is a refund: because you paid us by transfer, the account on that receipt is how we know where to send the money back, and Shipping and Returns explains why we will not send it anywhere else. We never receive and cannot store your card number, your wallet credentials or your bank login.

Receipts are kept with the order for 10 years, which is the retention the BIR requires for sales records. After that the row is deleted. and then deleted. That has to outlast the returns window and the warranty, since a refund depends on the receipt still being there.

Where the order is written down

Placing an order writes a row to a Google Sheet we control, through Google Apps Script. That row holds the date, an order reference, your name, mobile number, email address, delivery address and region, what you bought and what it cost. The confirmation email is sent from the same place.

What the server records

Our host, Netlify, keeps ordinary web server logs, which include the IP address of the device requesting a page, the page requested, and the browser's user agent string. These are operational and security records. We do not build profiles from them.

If you join the list

Your email address, and only if you asked us to have it.

3. Measurement, and what we do not collect

This site sets no cookies. There is no tag manager, no advertising or social media pixel, no session recording, and no fingerprinting.

We do count visits, using Plausible Analytics. It is a cookieless counter that writes nothing to your device and has no way to recognise you on a second visit or across any other website. What it records is the page address, the referring site, the country, and whether you are on a phone, tablet or desktop, and it records all of that as a number in a total rather than as a row about you. Your IP address is used to work out the country and is then discarded; it is never stored. There is no profile of you to ask for, export or delete, because none is made.

Plausible is operated by Plausible Insights OÜ, an Estonian company, and the data sits on servers inside the European Union. Their own privacy notice is at plausible.io/privacy.

If we ever add anything beyond this, it will be named here before it goes live.

4. Where your bag actually lives

Adding a paddle to your bag writes it to your browser's local storage on your own device. It is not a cookie and it is not sent to us with each request. It sits there until you check out, clear it, or clear your browser data. If you never check out, we never learn it existed.

The same is true of the order summary shown on the confirmation page after a purchase. That copy is local to your browser so the page can show you what you bought.

5. Why we use it, and on what basis

• To take payment and deliver what you ordered, and to handle returns and warranty claims. Basis: performance of our contract with you.
• To answer you when you write to us. Basis: our legitimate interest in running a business people can talk to.
• To check that a payment is real and matches your order, which includes having software read the receipt you upload before a person checks it against our account. Basis: performance of our contract, and our legitimate interest in not shipping a paddle against a forged receipt.
• To detect and prevent fraud and abuse, and to keep the site up. Basis: legitimate interest.
• To send you email about AGOS. Basis: your consent, which you can withdraw in one click at the bottom of any of them.
• To meet tax, accounting and record keeping obligations. Basis: legal obligation.

6. Who else touches it

We do not sell, rent or trade personal information. We share it only with providers who need it to get your order to you:

Google

Runs Apps Script and the sheet your order is written to, stores your payment screenshot in Drive, and sends the confirmation email.

Google Gemini

Reads the payment screenshot once, to pull out the amount and reference. It is sent the image and nothing else about you.

GCash, Maya, RCBC, GoTyme

Receive your payment. What they see is between you and them; we only ever see the screenshot you send us.

Plausible Insights OÜ

Counts visits. Receives the page you are on, where you came from and your device type, plus your IP address, which it turns into a country and then discards. It is sent nothing that identifies you and it sets nothing on your device.

Netlify

Hosts the site and keeps the server logs described above.

GoGo Xpress, nationwide.

Receives your name, address and phone number so the parcel can be delivered.

Only Plausible is contacted by simply reading this site, and all it learns is that somebody in your country opened this page. Every font, stylesheet and image here, and every other script, is served from our own domain. Nothing that could identify you leaves before the checkout, and then only because you asked it to.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

7. How long we keep it

Order records

10 years, which is the retention the BIR requires for sales records. After that the row is deleted., to meet BIR and accounting requirements

Support messages

Two years from the last reply

Server logs

As long as our host retains them; we do not archive them ourselves

Visit counts

Kept by Plausible as totals with no personal data in them, so there is nothing in there to delete

8. Your rights

The Data Privacy Act gives you the right to be informed about what we hold, to access it, to have it corrected, to object to how we use it, to have it erased or blocked where the law allows, to receive a copy in a portable form, and to be compensated for damage caused by mishandling it. You can withdraw consent to marketing at any time without giving a reason.

Write to agosperformance@gmail.com and we will act within the period the law requires. If we get it wrong, you can complain to the National Privacy Commission, which is the regulator for this in the Philippines.

If you are buying from the European Union, the United Kingdom or California, the rights you have at home apply to your order too, and the same address handles them.

9. Data leaving the Philippines

Some of the providers above run infrastructure outside the Philippines, so your information may be processed abroad. Where that happens we rely on the contract with that provider to hold it to a standard comparable to the Data Privacy Act.

10. Children

This site is not aimed at children and we do not knowingly collect information from anyone under 18. If you believe a child has given us something, write to agosperformance@gmail.com and we will delete it.

11. How we protect it

The site is served over HTTPS. No page here has a field that asks for card details, which keeps card data off this origin entirely. We ship a content security policy that blocks scripts, styles, fonts and images from anywhere but our own domain, we load no third-party JavaScript, and everything read back out of your browser's storage is validated before it can reach the page.

The detail, and how to tell us if you find a hole in it, is on the Security page. No system is perfectly secure and we are not going to claim ours is.

12. Changes

We will update this page when what we do changes, and the date at the top will move. If a change is material we will say so on the site rather than hope you reread it.

13. Contact

Anything at all about your data: agosperformance@gmail.com.