Legal
Privacy Notice.
Effective September 1, 2026 · Written to comply with the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.
This notice explains what personal data Stochastic collects, why, who sees it, and the rights you have over it. It covers stochastic.ph and every institution site hosted on Stochastic — the subdomains and any custom domains institutions point at us. Our Terms of Service cover the rest of the relationship.
1. Who we are
Stochastic (“we”) operates this platform from the Philippines and is the personal information controller for your account and for the platform itself. The institution that runs a course you take also processes your learning data for that course: its staff can see your enrollment, progress, grades, submissions, and discussion activity in their own courses — and only in their own courses.
2. What we collect
- Your account — the name you go by, your email address, your password (stored only as a hash by our authentication provider), and an avatar if you add one.
- Your legal name — only if you want a certificate: first name, optional middle name, last name, optional suffix. It lives in a restricted table that only you and the certificate-issuing process can read, and it is printed on the certificates you earn.
- Your learning — enrollments, lesson progress, activity submissions and grades (including transcripts of AI chat activities), workshop peer reviews, discussion posts and votes, and live-class attendance where your institution records it.
- Payments — which course you bought, the amount, and our payment processor’s reference numbers. Your card or e-wallet details go directly to the processor on its own checkout page; we never see or store them.
- Technical — the cookies that keep you signed in, and standard server logs. We run no advertising or third-party tracking cookies.
3. Why we process it
- To provide what you signed up for — accounts, enrollment, grading, certificates, payments, and refunds (performance of a contract).
- To keep the platform safe and honest — moderation, fraud prevention, and audit trails of staff actions like grade changes (legitimate interest).
- To send you service email — enrollment receipts, replies and answers on your questions, and live-class reminders. These are part of the service, not marketing.
- Because the law requires it — tax and accounting records for payments and refunds (legal obligation).
- With your consent — anywhere we ask first, such as sending certificate details to LinkedIn when you click “Add to LinkedIn”.
4. Who sees your data
- Your institution — staff of the institution running a course see your learning data inside that course, as described above.
- The public, by design — a certificate’s verification page is public so employers can check it: it shows the serial, the name printed on the certificate, the course, the institution, and the dates. Discussion posts are visible to everyone else in the course.
- Service providers — companies that process data on our instructions: Supabase (database and login), Vercel (hosting), Cloudflare (video), PayMongo (payments), Resend (email), Zoom or LiveKit (live classes, when your institution runs them), and Anthropic (AI-graded activities — your submission or chat transcript is sent to the Claude API to be graded, and for nothing else). Some of these providers store data outside the Philippines; we remain accountable for it under the Data Privacy Act wherever it is processed.
- LinkedIn — only when you click “Add to LinkedIn” on your own certificate, which sends its details to LinkedIn to pre-fill your profile entry.
- Nobody else. We do not sell personal data and we do not share it with advertisers.
5. How long we keep it
Account and learning data are kept while your account exists. Certificates are permanent records — a credential that vanished when an account closed would be worthless to the person holding it, so issued certificates stay verifiable. Payment and refund records are kept for as long as Philippine tax and accounting rules require. Audit logs of administrative actions are kept for accountability.
6. Your rights
The Data Privacy Act gives you the right to be informed about how your data is processed; to access a copy of it; to correct it; to have it erased or blocked where we no longer have grounds to keep it; to object to processing; to data portability; and to be indemnified for damages from unlawful processing. Write to our Data Protection Officer at privacy@stochastic.ph to exercise any of these — we will answer within the periods the law sets. If you are not satisfied, you may complain to the National Privacy Commission (privacy.gov.ph).
7. How we protect it
Every institution’s data is isolated with database row-level security; traffic is encrypted in transit; legal names sit in a restricted table readable only by you; and staff actions that change grades are audit-logged. If a breach ever puts your data at real risk, we will notify you and the National Privacy Commission within the periods NPC rules require.
8. Minors
Stochastic is built for adult learners. If you are under 18, use the platform only with the consent and supervision of a parent or guardian.
9. Changes to this notice
When this notice changes, we update it here and revise the effective date above. If a change meaningfully affects what we collect or who sees it, we will tell you on the platform or by email before it takes effect.
10. Contact
Data Protection Officer: privacy@stochastic.ph · Everything else: hello@stochastic.ph