Privacy policy.
No dark patterns.

Northernware is a small software studio based in Northern Luzon, Philippines. We build business websites, e-commerce stores, redesigns, custom web apps, and technical SEO for clients here and abroad. When we say "we" on this page, we mean the five operators behind northernware.ph. For anything privacy-related, the point of contact is hello@northernware.ph.

Only what you hand us or what the browser has to send to load a page. Concretely:

• Project brief form (on /contact): name, work email, company, role, services you're interested in, budget range, timeline, the message you write, and whether you want a mutual NDA before we reply.
• Newsletter signup (footer): email address only. We use it to send technical updates and nothing else.
• Theme preference: light or dark mode, stored in your browser's localStorage so the site doesn't blind you on the next visit.
• Request metadata: IP address, user agent, referrer, timestamps. Standard server log material, handled by our hosting provider.
• Anonymous usage analytics: aggregate page views, performance metrics, device class. No personal profile is built.

No ad-network tracking pixels. No cross-site retargeting. No fingerprinting. No selling or renting data to third parties. No hidden data brokers. The honeypot field on our contact form (fax_number) exists only to catch bots—if it's filled, the submission is silently discarded and nothing is stored.

Each field has one job. Contact-form data lets us reply to your brief, quote scope honestly, draft contracts, and keep a record of the engagement. Newsletter email lets us send the newsletter. Theme preference keeps the UI consistent. Server logs and analytics keep the site fast and help us spot abuse or outages. If a piece of data doesn't serve one of those jobs, we don't ask for it.

A short list, all acting as processors under instructions from us:

• Resend — delivers the email your brief generates. Your form contents are transmitted through them to our inboxes.
• Vercel — hosts the site and runs Vercel Analytics and Speed Insights. Both are designed to be cookieless and non-identifying.
• Google Fonts — serves the typefaces (Space Grotesk, Inter, JetBrains Mono). Your browser fetches them on page load.
• Iconify — serves the icon set used across the site from its CDN.
• Meta (Facebook) — we include a domain-verification meta tag in the page head. It verifies ownership; it does not load any Meta scripts or tracking on this site.

We do not sell your data. We don't share it with anyone outside the list above without your explicit consent or a lawful request.

We don't set first-party cookies for advertising or tracking. The only client-side storage we use is localStorage for your theme preference. Vercel Analytics and Speed Insights are configured to run without identifying cookies. Third parties loaded by your browser (fonts, icons) may set technical cookies per their own policies; those are governed by the providers above.

Project briefs: for the duration of our conversation plus a reasonable business-records window (typically up to 2 years after last contact) so we can reference prior scope and honor NDAs we've signed. Client records for active engagements are kept as required by Philippine tax and accounting law. Newsletter email: until you unsubscribe. Server logs: rolling short-term windows managed by our hosting provider. Ask us to delete anything early and we will, unless we're legally required to keep it.

Under the Philippines' Data Privacy Act of 2012 (and similar regimes elsewhere) you can ask us to: (a) confirm what we hold about you, (b) get a copy, (c) correct it, (d) delete it, (e) object to processing, or (f) withdraw consent at any time. Email hello@northernware.ph with the request. We'll respond within a reasonable period, usually inside a week. If you think we've mishandled your data, you can also escalate to the National Privacy Commission at privacy.gov.ph.

Everything on this site moves over HTTPS. Form submissions are encrypted in transit. Access to brief inboxes is restricted to the operators who need it, on accounts protected by two-factor authentication. We keep the blast radius small: fewer systems, fewer copies, fewer people with keys. No system is perfectly secure, but we'd rather tell you that than pretend otherwise.

Some of our processors (Resend, Vercel, Google, Meta, Iconify) are based outside the Philippines and may process data on servers in the US or EU. By using this site or submitting a brief, you understand your data may be transferred internationally. We pick providers who publish their own data-protection terms and align with GDPR and similar standards.

This site is aimed at businesses and the adults who run them. It's not directed at anyone under 18. We don't knowingly collect data from minors. If you believe a minor has submitted data to us, email us and we'll delete it.

We'll update this page when our stack, processors, or practices change. Every change bumps the "Last updated" date at the top. Material changes—new data collection, new processors, new purposes—will be called out here plainly, not buried. Previous versions are available on request.

Privacy questions, access requests, NDA questions, or a correction: hello@northernware.ph. We read everything. You'll get a real reply from a real person, usually within one business day.