Legal & Policy
Natin — Privacy & Security
Last updated: September 28, 2026
Natin means ours.
Natin is an internet ecosystem for ideas, tools, conversations, communities, information, and things people build together.
We believe that an internet that belongs to people should treat people's information with care.
This Privacy & Security Policy explains how Natin handles personal information across www.natin.ph and Natin products and services that adopt this policy.
Because Natin is an ecosystem rather than a single application, individual Natin products may have additional privacy notices or product-specific policies. Where a product has its own notice, that notice applies together with this one and will explain processing specific to that product.
1. Our Privacy Principles
Natin's approach to privacy is guided by a few simple principles.
We collect with a reason.
We collect personal information when it is needed for a specific and legitimate purpose.
We do not want to collect information simply because it might become useful someday.
We explain what we do.
When we collect personal information, we aim to explain what information is being collected, why it is needed, how it may be used, and what choices are available to you.
We try to collect only what we need.
Personal information should be adequate, relevant, and proportionate to the purpose for which it is processed.
Your Natin account is not the same thing as every Natin product.
A Natin account provides an identity and account relationship across the Natin ecosystem.
It does not automatically give an account holder access to every Natin product, community, dataset, administrative function, or piece of content.
Each product may have its own permissions, roles, rules, and data.
Different products may handle different kinds of information.
A communication product may process private communications.
A publishing product may process content that a user intentionally makes public.
A reference or information product may process information that is already publicly available.
These situations are different and are treated accordingly.
Privacy and security are ongoing responsibilities.
We design and operate our systems with privacy and security in mind, but no internet-connected system can honestly be described as perfectly secure.
We continuously work to reduce risk, detect problems, respond to incidents, and improve our systems.
2. Who This Policy Applies To
This policy applies to personal information processed through:
- www.natin.ph
- Natin account and identity services
- Natin websites and applications that expressly adopt this policy
- Natin services, tools, and communities operated directly by Natin
Individual products may publish additional privacy notices.
For example, a product such as Usapan may need rules specifically addressing private communications, contacts, messaging metadata, attachments, calls, moderation, and abuse prevention.
A product such as Buhay may need rules addressing articles, posts, contributor profiles, comments, and publicly published material.
A product such as Politiko may have a different data model because much of its purpose concerns public political and institutional information.
Where another organization independently operates a Natin project, that organization may be responsible for some or all processing carried out through that project. The applicable product notice should identify that relationship where relevant.
3. Information We May Collect
The information we collect depends on how you use Natin.
3.1. Account information
When you create or use a Natin account, we may collect information such as:
- name or display name
- email address
- username or account identifier
- password credentials or authentication information
- account preferences
- account status
- security and authentication records
We do not require every Natin product to collect the same information.
3.2. Product information
When you use an individual Natin product, that product may process information necessary to provide its functionality.
Examples may include:
- messages and communications
- files or attachments
- posts and articles
- comments
- profile information
- project participation
- moderation records
- contribution records
- project-specific permissions
- transactions or other information where a product actually provides such functionality
The precise information depends on the product.
3.3. Technical information
When you access Natin services, our systems may process technical information such as:
- IP address
- browser and device information
- operating system
- approximate network information
- timestamps
- pages or services requested
- diagnostic information
- security events
- error and performance information
Some of this information may be necessary to operate, secure, troubleshoot, and improve our services.
3.4. Cookies and similar technologies
Natin may use cookies, local storage, session technologies, and similar mechanisms to:
- maintain authentication sessions
- remember preferences
- operate website functionality
- maintain security
- understand basic service performance
Where optional analytics or similar technologies are introduced, we will provide appropriate notice and choices where required.
We do not consider tracking to be a reason to collect information indiscriminately.
4. Why We Process Information
Depending on the service, Natin may process personal information for purposes including:
- creating and maintaining accounts
- authenticating users
- providing requested services
- connecting users to the Natin products they are authorized to use
- maintaining project-specific permissions
- communicating with users about their accounts or services
- protecting accounts and systems
- detecting abuse, fraud, unauthorized access, and security incidents
- troubleshooting and improving services
- complying with legal obligations
- responding to lawful requests
- establishing, exercising, or defending legal claims
- operating communities and moderation systems where applicable
We seek to process information only for purposes that are declared, specified, legitimate, and proportionate.
5. Identity, Data, and Authorization
One of Natin's foundational architectural principles is:
Identity ≠ Data ≠ Authorization.
Your Natin account establishes an identity relationship with the Natin ecosystem.
The information held by an individual product is separate from the fact that you have a Natin account.
Access to a product is also separate.
For example, a person may have:
- a Natin account;
- access to Usapan;
- no access to a particular Usapan administrative role;
- contributor privileges in Buhay;
- no researcher privileges in Politiko.
Permissions are granted according to the product and role involved.
Having a Natin account does not mean that Natin employees, project operators, or other users automatically receive access to all information associated with that account.
6. Public Information and User-Published Content
Some Natin products are designed to publish information to other people.
If you intentionally publish content publicly, that content may be visible to other users or the public depending on the product's design and your chosen settings.
Public content may also be copied, quoted, indexed, cached, archived, or redistributed by other people or services outside Natin's control.
Before publishing something publicly, consider whether you want it to remain available outside the Natin service.
Private information should not be intentionally published in a public area unless you understand the consequences.
7. Communications and Private Content
Products designed for private communication may process communications and related information as necessary to provide the service, maintain security, prevent abuse, and comply with applicable law.
The exact technical treatment of communications depends on the product.
Natin will not describe a communication product as "end-to-end encrypted," "zero-access," "zero-knowledge," or using any other specific security architecture unless that product actually implements and maintains the corresponding architecture.
Product-specific documentation should explain important security properties where appropriate.
8. Sharing of Personal Information
Natin does not treat personal information as something to be freely exchanged across the ecosystem.
Information may be shared or disclosed when reasonably necessary for purposes such as:
- providing a service you requested;
- operating infrastructure and service providers;
- maintaining security;
- enforcing product rules;
- preventing fraud or abuse;
- complying with legal obligations;
- responding to valid legal process;
- protecting the rights, safety, and security of Natin, our users, or others;
- carrying out a transaction or organizational change where legally permitted.
Where personal information is shared with service providers processing information on Natin's behalf, Natin seeks appropriate contractual, organizational, and technical safeguards.
A user's participation in one Natin project does not by itself authorize unrelated projects to access that user's project data.
9. Independent Natin Projects
Natin may host or support projects that are:
- operated directly by Natin;
- independently developed within the Natin ecosystem;
- operated with partners;
- maintained by separate teams;
- supported by investors or other organizations.
The Natin name or ecosystem relationship does not necessarily mean that every project has the same operator or processes information in exactly the same way.
Where another organization is responsible for processing, the relevant product should identify that organization and provide its applicable privacy notice.
10. Service Providers
Natin may use third-party providers for infrastructure and operational functions such as:
- hosting
- databases
- authentication
- email delivery
- storage
- monitoring
- security
- communications
- payments, where applicable
- analytics, where applicable
Service providers should receive only the access reasonably necessary for the services they provide, subject to applicable agreements and safeguards.
We do not treat service providers as a general-purpose source of permission to use your information for unrelated purposes.
11. Data Retention
We seek to retain personal information only for as long as reasonably necessary for the purpose for which it was collected, for legitimate operational needs, or as required or permitted by law.
Retention periods can differ substantially between products.
For example, security logs may need to be retained for a period necessary to investigate abuse or security incidents, while some user content may remain available until the user or product removes it.
When information is no longer needed and there is no legal or legitimate reason to retain it, we seek to securely delete, anonymize, or otherwise dispose of it.
Deletion from one system does not necessarily mean immediate deletion from every backup or disaster-recovery copy. Backup systems may retain information temporarily until those copies expire according to their retention cycle.
12. Your Rights
Subject to applicable law and lawful limitations, you may have rights concerning your personal information, including rights to:
- be informed about processing;
- access personal information;
- request correction of inaccurate or incomplete information;
- object to certain processing;
- request deletion or blocking in appropriate circumstances;
- withdraw consent where processing is based on consent;
- request data portability where applicable;
- lodge a complaint concerning privacy practices.
The Data Privacy Act of 2012 and its implementing rules establish rights of data subjects and require processing to observe transparency, legitimate purpose, and proportionality.
Requests should identify the relevant Natin product and enough information for us to determine what account or information the request concerns.
Some requests may be subject to legal, security, or other lawful limitations.
13. Account Deletion
Where account deletion is available, you may request deletion of your Natin account through the applicable account controls or support process.
Deleting an account may not automatically delete:
- information that must be retained by law;
- information necessary to establish or defend legal claims;
- security and abuse records that must reasonably be retained;
- information that has been lawfully published or shared with others;
- information maintained in temporary backups until those backups expire.
Individual products may have additional deletion rules.
14. Security
Natin uses organizational, physical, and technical safeguards appropriate to the nature and risks of the information we process.
Depending on the service, these may include:
- access controls and role-based permissions;
- authentication and session protections;
- encryption in appropriate parts of the system;
- secure development practices;
- infrastructure security controls;
- logging and monitoring;
- vulnerability management;
- backups and recovery mechanisms;
- incident response procedures;
- restrictions on internal access;
- privacy and security reviews.
Security is designed into systems rather than treated only as a feature added after development.
No security measure can eliminate every risk.
Users also have an important role in protecting their accounts. Do not share passwords, authentication codes, recovery credentials, or other account-security information with others.
15. Security Incidents and Data Breaches
If Natin becomes aware of a personal data breach requiring notification under applicable law, we will investigate, contain, and respond to the incident and make notifications required by law.
Under applicable Philippine privacy rules, qualifying personal data breaches may require notification to the National Privacy Commission and affected data subjects within seventy-two (72) hours from knowledge of or reasonable belief that the breach occurred.
We may provide additional information as our investigation develops.
Security incidents that do not constitute a reportable personal data breach may nevertheless be investigated, documented, and addressed as appropriate.
16. International Processing
Natin and its service providers may process or store information in locations outside the Philippines where necessary to operate the services.
Where information is transferred or processed across jurisdictions, Natin will seek to apply appropriate safeguards and comply with applicable privacy requirements.
17. Children's Privacy
Natin products may have different age requirements depending on their purpose and applicable law.
Unless a product expressly states otherwise, Natin services are not intended to encourage children to provide personal information without appropriate authorization.
Where a product is intended for children or young people, additional safeguards and product-specific rules should apply.
18. Changes to This Policy
Natin may update this policy as our products, technology, legal obligations, and practices change.
When changes are significant, we will provide appropriate notice.
The "Last updated" date at the beginning of this policy indicates the current version.
19. Contact and Privacy Requests
Privacy questions, requests, and concerns should be submitted through the privacy/contact mechanism published by Natin.
When contacting us, please identify:
- your name or account identifier, where appropriate;
- the Natin product involved;
- the nature of your request or concern;
- enough information for us to understand and respond to the request.
Do not send passwords, authentication codes, payment-card numbers, or other unnecessary sensitive information in a privacy request.
20. Philippine Privacy Law
Natin seeks to comply with applicable Philippine privacy requirements, including Republic Act No. 10173, the Data Privacy Act of 2012, its implementing rules and regulations, and applicable issuances of the National Privacy Commission.
This policy is intended to explain Natin's practices in plain language. It does not limit rights that cannot lawfully be waived.
The National Privacy Commission is the Philippine authority responsible for administering and implementing the Data Privacy Act.
Natin's Commitment
Natin is built on the idea that the internet should be something people can participate in, shape, and build together.
That requires trust.
Our commitment is not to claim that technology can eliminate every privacy or security risk.
Our commitment is to collect responsibly, explain clearly, protect carefully, give people meaningful control, and keep improving.
NATIN — Our internet.