Privacy Policy
Version 2026-08-15 · Effective August 15, 2026
This policy explains how Anido Creatives Web Development Services handles personal information in Lykha. It is written to meet the Data Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission.
1. Two different roles
This distinction determines who you should contact about what.
We are the controller for information about the people who sign up and use Lykha directly: names, work email addresses, passwords, sign-in activity and billing details.
We are a processor for everything an organisation puts into its workspace — employee records, payroll figures, attendance, client and contact details, documents. For that information the organisation is the controller. It decides what to collect and why; we only hold and process it on their instructions. If you are an employee asking about your own records, your employer is the right first contact, though you may also write to us and we will help you reach them.
2. What we collect as controller
- Account details — name, email, hashed password, role, workspace.
- Organisation details — workspace name, address, TIN and tax settings you enter.
- Billing details — plan, invoices, payment records. Card details are handled by our payment provider and never stored by us.
- Usage and security records — sign-in times, IP address, and an activity log of changes made in your workspace.
- Support correspondence — what you send us when you ask for help.
3. Why we process it, and on what basis
- To provide the service — necessary to perform our contract with you.
- To bill you — contract, and compliance with tax and accounting law.
- To keep accounts secure — our legitimate interest in preventing unauthorised access, and yours in the same.
- To contact you about the service — contract. Service and security notices are not marketing and cannot be opted out of while you hold an account.
- To meet legal obligations — where a law or lawful order requires it.
We do not sell personal information, and we do not use the contents of your workspace for advertising or to train machine-learning models.
4. Who else sees it
We share personal information only with providers who help us run the service — hosting, email delivery and payment processing — each bound to handle it only on our instructions. We disclose information to authorities only where legally compelled, and will tell you unless prohibited from doing so. Some providers process data outside the Philippines; where they do, we require protections consistent with the Data Privacy Act.
5. How long we keep it
Workspace data is kept while the workspace is active. After it closes we retain it for 30 days so you can change your mind or complete an export, then delete it permanently. Records we must keep by law — invoices and accounting records in particular — are retained for the period the law requires, even after an account closes.
6. Your rights
Under the Data Privacy Act you have the right to be informed, to object, to access your data, to correct it, to have it erased or blocked, to damages for a violation, to complain to the National Privacy Commission, and to obtain a copy in a portable format. To exercise any of these, write to our Data Protection Officer at hello@lykha.solutions. We respond within a reasonable period and will not charge you for a first request.
Where we hold your data as a processor for your employer, we will pass your request to them and support them in answering it, since the decision is theirs to make.
7. Security
Passwords are stored hashed and are never recoverable in readable form, including by us. Access to each workspace is isolated, and administrative access to production is limited to staff who need it. Traffic is encrypted in transit. No system is perfectly secure, so we also keep activity logs to detect and investigate misuse.
8. If something goes wrong
If a breach occurs that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the people affected within 72 hours of knowing about it, as the Data Privacy Act requires. Where we are a processor, we will notify the controlling organisation without undue delay so they can meet their own obligations.
9. Children
Lykha is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 18 other than as part of an employer's lawful employment records.
10. Changes
We may update this policy. Material changes are notified and you will be asked to acknowledge the new version. The version and date at the top of this page always shows what applies.
11. Contact
Data Protection Officer
Anido Creatives Web Development Services
3F, 1900 Session Road Building, Session Road, Baguio City, Philippines
hello@lykha.solutions
You may also complain to the National Privacy Commission, 5th Floor Delegation Building, PICC Complex, Pasay City.