Privacy Notice

Effective date: 12 August 2026.

Who we are: Elumio is a software business operated from the Philippines. You can reach us at billing@elumio.io. Questions about this notice or about your data go to our Data Protection Officer: privacy@elumio.io.

This notice is written under the Philippine Data Privacy Act of 2012 (Republic Act 10173) — the law that governs how personal data is handled in the Philippines — and it is written to be read, not skimmed past. If anything in it is unclear, tell us and we will fix the wording.

1. Elumio wears two hats. Which one matters to you?

Elumio is a training platform that organisations use to train their own people. That means the data on it belongs to two different relationships, and the law treats them differently:

• If you are a trainer or organisation owner — you created an account,

you run courses, you pay us. For your account and billing data, Elumio decides what is collected and why. In the law's words, we are the personal information controller.

• If you are a trainee — your employer or training provider enrolled you.

For everything about your training (who you are, what you watched, your exam results, your certificate), that organisation decides why the data is processed, and Elumio processes it on their instructions. We are the personal information processor; they are the controller. If you want your training data corrected or deleted, your first stop is them — though you can always contact us too, and we will help route the request.

Everything below says which hat applies.

A training address or an email that wears your organisation's look does not change who processes the data. Elumio remains the processor for trainee records on a branded host.

2. If you are a trainee: what is recorded about you

Your organisation gives us your email address when they enroll you — before you have an account. When you first sign in, we store your name and email as your profile. Signing in also activates every pending invitation addressed to your email, from any organisation that invited you — you will see all of them listed.

Watch tracking — read this part

Elumio's purpose is to let your organisation prove that required training was actually completed. To do that, while you watch a lecture the platform records:

• exactly which parts of the video you watched, second by second;
• the real clock time you spent watching — leaving a tab open does not

count, and skipping ahead is detected and not credited;

• each viewing session's **date and time, your IP address, and your browser

and device description**;

• counts of progress reports the system rejected as implausible (for

example, attempts to fast-forward past unwatched material).

While a video plays, your email address may appear periodically as a faint watermark across the picture. This discourages screen-recording and sharing of your organisation's course material. Your organisation can turn this off per course.

Who sees this: trainers and administrators of the organisation that enrolled you, and Elumio's own platform administrators. You can see your own viewing coverage on your progress page. Nobody outside your organisation can see it, and it is never sold or used for advertising — Elumio contains no advertising or analytics trackers at all.

What it does and does not prove: it shows the video played in front of a signed-in session for at least the video's length. It is not a camera, it does not watch you, and it is not proof of attention.

Exams and scores

We record each exam attempt, the answer you gave to each question, your score, and whether you passed. You can see your own attempts and scores; your organisation's trainers can see them too. Depending on course settings, you may be shown the correct answers after your final attempt. Your score is never shown on the public certificate page.

Certificates — and the public verification page

If you earn a certificate, it carries your name, the course title, dates, a serial number, and a QR code linking to a public verification page. Anyone who has that link or code — an employer, a client, an auditor — can see: your name, the course title, the issue and expiry dates, the serial number, and whether the certificate is valid, expired or revoked. They cannot see your score, your answers, or your watch history. The page cannot be found by search engines or by guessing — the code is random, and lookups are rate-limited.

Client views — when your organisation shares your status with its client

Your organisation can publish a client view: a read-only web page listing chosen trainees and where each one stands, shared with one of its own clients. If you are in one, we email you to say so, naming the client who can see it. That is not optional and your organisation cannot switch it off.

What that client can see about you: your name (your organisation chooses full name, or first name and last initial, or a count with no names at all), the course title, whether your training is current, expiring, expired or absent, the expiry date, and a link to the certificate verification page described above.

What they cannot see: your email address, your score, your answers, and your watch history. Your address is never sent to that page at all.

Your organisation chooses who is included — it is not an automatic list of everybody — and the page expires unless they choose otherwise. They can revoke it at any time, which immediately breaks the link for anyone holding it. If you have been erased, you are removed from these pages entirely.

3. If you are a trainer or organisation: what we collect about you

• Registration: your name and email. If you start registering and do not

finish, that half-finished record is deleted — immediately once it expires, and within 24 hours of completion once it succeeds (your account then holds the data instead).

• Account: name, email, role. Team invitations: the email addresses

of colleagues you invite.

• Billing: your subscription, plan and invoice history. **We never see or

store your card number** — payment happens at our payment provider, PayMongo, and the most we keep is the card brand (like "visa") and the billing records the law requires us to keep.

• Content you upload — videos, questions, notes — is your organisation's

content. Do not put other people's personal or medical information in it.

4. Everyone who touches the sign-in box

Requesting a sign-in code — even with a mistyped address, even if you never had an account — records your email and IP address in a throttling log that is deleted within 24 hours. A separate security audit log also records sign-in events (including the email used and the IP) and is kept long-term to investigate abuse; if you ask us to erase you, your address is redacted from it. The only cookies Elumio sets are the ones that keep you signed in.

5. AI features: your data does not train or feed any model

Trainers can use AI assistance to draft exam questions, tidy lecture notes, and generate certificate background artwork. Here is exactly what is sent to the AI providers (Anthropic for text, Google for images):

• the lecture transcript and titles, for question drafting;
• the trainer's own notes and instructions, for note editing;
• the trainer's artwork description, for backgrounds.

No trainee name, email, enrollment, score, watch record, or any other trainee data is ever included in anything sent to an AI model. This is enforced in the platform's code, not just promised in this notice. One honest limit: if a trainer speaks or types someone's name inside a lecture or their own notes, those words are part of the content and travel with it — so trainers should keep personal details out of course material.

6. Where your data goes, and who helps us process it

Elumio runs on infrastructure outside the Philippines. Your data is protected by contracts with each provider, as the Data Privacy Act requires for overseas processing:

Everyone above is a processor: they handle data on our instructions and for no purpose of their own.

There is one disclosure that is not on that list and works differently, so it is set out separately here. Your training provider can publish a read-only view of certification status to a client of theirs — for example, a clinic that requires proof that the people assigned to its account are trained. Where they do:

• it shows a name, the course, whether the person is currently certified, and when it expires;
• it never shows scores, assessment attempts, or how the material was watched;
• the provider chooses who appears in it and whether to tell them, and is responsible for having a lawful basis to share it;
• the link can be revoked or expired at any time, and every view of it is logged.

We host that page; we do not decide who may see it. If you are a trainee and want to know whether your status is shared, ask your training provider — they hold that decision.

Beyond the processors above and that one disclosure, we never sell personal data and we share it with no one, except when the law compels us.

7. How long we keep things

8. Your rights, and what erasure honestly means here

Under the Data Privacy Act you have the right to be informed (this notice), to access the data held about you, to correct it, to object to processing, to erasure or blocking of data that is no longer necessary, to damages if mishandling harms you, to data portability, and to complain to the National Privacy Commission (privacy.gov.ph). For training records, requests may need your organisation's decision, because they are the controller — we will tell you when that is the case rather than bounce you around.

If you ask us to erase you, here is exactly what happens, because a vague promise helps no one:

• your name and email are removed from your profile, enrollments,

invitations and sign-in records, and redacted from the security log;

• your certificate PDF is destroyed and your **name is removed from the

certificate record** — but the certificate itself continues to verify, showing "[erased at the holder's request]" instead of a name. We keep it because employers and auditors already hold the link, and a credential that vanishes on request is not a credential;

• you are removed from any client view your organisation has published,

so the client can no longer see you listed at all;

• your watch history and exam records are kept, with your identity detached,

as the training evidence described in section 7;

• IP addresses in security and watch logs are kept — on their own they no

longer identify you;

• database backups can hold pre-erasure copies for a bounded period before

they age out.

To exercise any right, contact the DPO (top of this notice). We will need to verify you are who you say you are before acting.

9. If something goes wrong

If a data breach involving sensitive personal data occurs, we notify the National Privacy Commission and affected people within 72 hours of knowing, as NPC rules require, and we will tell you plainly what happened and what we are doing about it.

10. Readers outside the Philippines

Elumio is offered in the Philippines and is not currently directed at the European Union or United Kingdom, so the GDPR does not currently apply to it. If your organisation is subject to the GDPR or similar laws and enrols you on Elumio, the data-protection commitments it needs from us are set in our contract with that organisation.

11. Children

Elumio is a workplace training tool for adults. It is not directed at children, and we do not knowingly process children's data.

12. Changes to this notice

When this notice changes materially, we will tell account holders by email and show the change in the product before it takes effect, with the previous version available on request.