Privacy Notice

[Registered company name]TBC, with its office at [Registered office address, Metro Manila]TBC, is the personal information controller for the Nexo TV service. This notice explains what personal data we process, why, and the rights you have under the Data Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).

It applies to our apps and website, customer support, and creator tools. Creators who submit content are also covered by their creator agreement.

We do not sell your personal data. We do not process sensitive personal information (such as health or government ID numbers) unless you choose to send it to us, and we ask you not to.

• Recommendations use your viewing on a profile to rank titles. They don’t produce legal or similarly significant effects. You can turn them off per profile or withdraw consent for all profiles.
• Watch Concierge sends the message you type to a third-party language-model provider to suggest titles. It only uses your watch history if you switch that on for the request.

We share personal data only as needed, under written agreements that require appropriate security (RA 10173, Sec. 14 and 21):

• Cloud hosting and content delivery providers that run our service (hosted in Singapore).
• Payment partners: PayMongo and Xendit for GCash, Maya, GrabPay, cards and over-the-counter payments (integration pending; not yet live).
• Email delivery providers for account, security and billing messages.
• Language-model providers for the Watch Concierge and localisation tools, limited to what each request needs.
• Authorities when the law requires it, such as a valid court order or a request from the NPC.

Creators see only aggregated, non-identifying statistics about their titles. Our processors today are Vercel (hosting and the API), Neon (database), Upstash (queues and caching), Cloudflare (video and image storage), Fly.io (video processing), PayMongo (website payments), Apple and Google (app store purchases), RevenueCat (app purchase records), Expo (push notifications to the apps) and our email delivery provider; Anthropic answers Watch Concierge questions when that feature uses a language model, and an error-reporting service receives scrubbed crash reports when it is turned on. Our Data Protection Officer can give you the current list on request.

Our servers are hosted in Singapore, and some service providers may process data in other countries. Under Section 21 of RA 10173 we remain accountable for your personal data wherever it is processed, and we use contractual safeguards so that it receives protection comparable to Philippine law.

• Account, profile and viewing data: while your account is open. When you delete your account, we erase or anonymise it within 30 days.
• Viewing history you delete yourself is removed from your profile right away and from backups on their normal cycle.
• Watch-party chat and reactions: deleted with the party about 7 days after it ends. A reported message is kept with its moderation case.
• Transaction and tax records: for the period required by the National Internal Revenue Code and BIR regulations ([period to be confirmed]TBC).
• Security and audit logs: for a limited period ([period to be confirmed]TBC), longer only if needed for an investigation or legal claim.
• Support tickets and takedown notices: for [period to be confirmed]TBC after they are closed.

We use organisational, physical and technical measures, including:

• encryption in transit (HTTPS/TLS) and access tokens stored in secure, http-only cookies;
• passwords and parental PINs stored only as salted one-way hashes;
• role-based access for staff, with every sensitive action written to a tamper-evident audit log;
• rate limits and automatic sign-out of other devices when you change your password.

If a personal data breach is likely to put you at real risk of serious harm, we will notify the NPC and affected people within 72 hours of knowing about it, as NPC rules require.

You must be at least 13 to have an account, and users under 18 need a parent or guardian’s consent. Kids profiles are created and managed by the adult account holder; we don’t ask children for personal data, and kids profiles only show titles rated G or PG.

Under RA 10173 you have the right to:

• be informed about how your data is processed (this notice);
• access your personal data: download a copy in Privacy & data;
• object to processing based on consent or legitimate interests, and withdraw consent anytime;
• erasure or blocking: delete your account;
• correct inaccurate data in Profile & settings or by contacting us;
• data portability: your export is machine-readable (JSON);
• damages for harm caused by inaccurate, unlawfully obtained or unauthorised use of your data;
• file a complaint with the National Privacy Commission.

We respond to requests within 30 days. We may need to confirm your identity first. Exercising your rights is free.

We use essential cookies to keep you signed in and secure and to remember your language and profile. With your permission we also use first-party analytics. We don’t use cross-site advertising cookies. You can change your choice anytime in cookie settings or below.

For questions, requests or concerns about your personal data, contact our Data Protection Officer:

• Email: dpo@nexo.tvTBC
• Post: Data Protection Officer, [Registered office address, Metro Manila]TBC
• Signed in? Use the Help center and choose “Privacy & my data”.

If you believe we have not handled your personal data lawfully, please tell our DPO first so we can fix it. You also have the right to file a complaint with the National Privacy Commission; see privacy.gov.ph for how to file.

We will post any changes here and update the date at the top. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect and, where needed, ask for your consent again.