Privacy Policy

1. Who we are

3Spheres Inc. (“Three Spheres,” “we,” “us,” or “our”) is a video production company based in Makati City, Philippines. We are the Personal Information Controller for the personal data described in this policy, as that term is used in the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).

Our address is 3Spheres Inc., Accer8 by UnionSpace, UB, 111 Paseo de Roxas, Makati City, Philippines.

Our data protection contact is privacy@threespheres.net. Use it for anything in this policy, including any request to exercise your rights.

2. What this policy covers

This policy applies to threespheres.ai and threespheres.net, and to the tools we run on their subdomains: the client portal, the crew and supplier pages, the document signing pages, and our internal admin system.

It also covers the personal data we collect when you send us an enquiry, book a call, or work with us as a client, crew member, or supplier.

3. What we collect

Enquiries and estimates. When you send us a note, book a call, or use the guided costing tool, we collect your name, company, email address, phone number, and what you tell us about your project, including budget range and deadline. If you paste text or upload a brief, we receive whatever that document contains, which may include information about other people.

Crew and supplier onboarding. If you join us as crew or as a supplier, we collect your full name and nickname, date of birth, email address, mobile number, home address, the services you offer, your bank name, bank account name and bank account number, your Taxpayer Identification Number (TIN), and photographs of the front and back of a valid government-issued ID. Under the Data Privacy Act your TIN and your government ID are sensitive personal information, so we ask for your express consent before collecting them and we explain in section 4 exactly why we need them.

Documents you sign. When you sign an agreement with us electronically we record your typed legal name, the signature you draw, the date and time, your IP address, and your browser and device description. These make the signature tamper evident and are printed on a certificate attached to the signed PDF. We tell you this on the signing page before you sign.

Technical information. When you submit a form we record the IP address and browser user agent of the request, which we use to detect and limit abuse. We also count anonymous steps through the costing tool. Section 12 explains that counter in full.

4. Why we process it, and our legal basis

We process personal data only where the Data Privacy Act permits it. In practice that means one of the following.

To answer you and prepare your estimate. Legal basis: the processing is necessary to take steps at your request before entering into a contract, and to perform that contract (Section 12(b)). You do not need to consent to anything for us to reply to you.

To run a project you have engaged us for, including issuing your portal account, sending documents for signature, and billing. Legal basis: performance of a contract (Section 12(b)).

To pay crew and suppliers and to meet our tax obligations. We need your TIN and bank details to pay you and to file the returns the Bureau of Internal Revenue requires of us, and we check your identity against a government ID before releasing payment. Legal basis: your express consent (Section 13(a)), together with compliance with a legal obligation (Section 12(c)).

To keep the site working and to prevent abuse, including rate limiting and error reporting. Legal basis: our legitimate interests, weighed against your rights and freedoms (Section 12(f)).

We do not sell your personal information, and we do not make automated decisions about you that produce legal effects.

5. Consent, and how to withdraw it

Where we rely on your consent we ask for it separately, in plain language, and we never pre-tick a box for you. You are free to refuse. We will not withhold an estimate or a quote because you declined an optional consent.

You can withdraw consent at any time by emailing privacy@threespheres.net. Withdrawing is as easy as giving it. If you withdraw consent for us to hold your TIN, bank details, or government ID, we will stop processing them, although we may still be required to keep certain records to meet tax and accounting obligations. We will tell you if that applies to you.

Withdrawing consent does not affect anything we lawfully did before you withdrew it.

The current version of this policy is 2026-08-02. When you give consent we record which version you agreed to, so that both of us can tell later exactly what you were told.

6. Who we share it with

We do not sell personal data. We share it with service providers who process it on our behalf, only for the purposes described in this policy. They are:

Clerk (staff, client, and supplier accounts, sign-in sessions, password recovery, and account security). Supabase (database and file storage). Netlify (website hosting, form processing, and abuse rate limiting). Resend (sending email). Sentry (error reporting, so we can find and fix faults). Cal.com (booking calls, embedded on our contact page). Google (Workspace email and calendar, Drive folders where a project's working files are kept, and web fonts loaded on each page view). Telegram (an internal alert to our team when a new enquiry arrives, containing your name, company, email address, and the beginning of your message). Anthropic (if you paste or upload a brief, its contents are sent to an AI service to read out the project scope). Mux and Frame.io, which is part of Adobe (video hosting and client review). Documenso (document signing). Invoice Ninja (quotes and invoices).

We may also disclose personal data where the law requires it, or where it is necessary to establish, exercise, or defend a legal claim.

7. Where your data is processed

Some of these providers process data outside the Philippines, including in the United States and the European Union. Where that happens we remain accountable for your personal data under Section 21 of the Data Privacy Act, and we select providers that commit to appropriate security safeguards.

8. How long we keep it

Enquiries, estimates, and client contact records: kept indefinitely as part of our client relationship records, so that a conversation you started with us can be picked up later. You can ask us to delete them at any time and we will, unless we are legally required to keep them.

The IP address and browser information attached to a form submission: 90 days, then removed from the record. We only need them to spot abuse.

Crew and supplier records, including your TIN, bank details, and government ID photographs: 10 years after our last engagement with you, matching the record-keeping period we are held to for tax purposes.

Signed documents and their signature certificates: 10 years, because they are the evidence that an agreement exists.

Anonymous costing tool statistics: 24 months.

Abuse rate limiting counters, which contain an IP address: 90 days.

9. How we protect it

Personal data is held in access-controlled systems. Every table is protected by row level security, so only authorised staff accounts can read it. Government ID photographs and signed documents are kept in private storage that is not publicly readable. Traffic to our sites is encrypted in transit using HTTPS.

On the crew and supplier self-service page, your TIN and bank account number are shown only as their last four characters, so that someone who obtained your private link still cannot read them in full.

No system is perfectly secure. If something does go wrong, see section 11.

10. Your rights under the Data Privacy Act

You have the right to be informed about how we process your personal data; to access the data we hold about you; to object to processing, including for direct marketing; to have your data erased or blocked where the law allows; to correct anything inaccurate or out of date; to be indemnified for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of your data; to obtain a copy of your data in a portable electronic format; and to lodge a complaint with the National Privacy Commission.

To exercise any of these, email privacy@threespheres.net. We will respond within a reasonable period. We may need to confirm who you are before we act, so that we do not hand your data to someone else.

You can also complain directly to the National Privacy Commission at privacy.gov.ph.

11. Data breaches

If a personal data breach occurs that puts sensitive personal information, or information that could be used for identity fraud, at risk of serious harm, we will notify the National Privacy Commission and the people affected within 72 hours of learning about it, as Section 20(f) of the Data Privacy Act requires. We will tell you what happened, what data was involved, and what you should do.

12. Cookies and tracking

We do not use advertising cookies, tracking pixels, analytics cookies, or session replay. There is no Google Analytics, no Meta pixel, and no third-party analytics product on this site. That is why you are not asked to dismiss a cookie banner.

We do count anonymous steps through the guided costing tool, so we can see which parts of it confuse people. That counter uses a random identifier held in your browser for the current tab only. It is erased when you close the tab, it is not a cookie, it is not stable between visits, and it is never connected to you or to anything you submit.

Two functional exceptions. If you sign in to the client portal, your session is stored in your browser so that you stay signed in. The booking tool embedded on our contact page is operated by Cal.com and sets its own storage inside that embed.

13. Children

Our services are sold to businesses and this site is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy. The current version is always posted on this page with the date it was last updated. If we make a change that materially affects how we use data you have already given us, we will tell you, and where the law requires it we will ask for your consent again.

15. How to contact us

For anything about privacy, including a request to access, correct, or delete your data, email privacy@threespheres.net.

For anything else, email hello@threespheres.net, or write to 3Spheres Inc., Accer8 by UnionSpace, UB, 111 Paseo de Roxas, Makati City, Philippines.