How we handle your information

1. Who we are

Harbie Automation is an independent automation practice based in the Philippines, run by Harbie Abdulmunap. For the information described here, Harbie Automation decides how and why it is used (in Data Privacy Act terms, it is the personal information controller).

Privacy contact: Harbie Abdulmunap · habdulmunap@gmail.com (please put “Privacy request” in the subject).

2. What we collect

• Contact form. Your name, email address, the message you write, and a record that you agreed to this policy. Netlify also notes basic technical details such as the time of submission.
• Emails you send us. Whatever you choose to include, plus your email address.
• Client portal and admin accounts. For clients we work with: name, email, company name, the service(s) we provide, invoice details (amounts, currency, due dates, payment status) and login records. Passwords are handled by our login provider and are never visible to us.
• AI call receptionist. Before a call: your full name, email, best phone number, and optionally your company and what you need, plus a record that you agreed. During the call: your voice audio is streamed to our voice provider, which turns it into text so the AI can reply. After the call: a transcript and a short summary of what you discussed. See section 7.
• Technical data. Like most websites, our hosting provider processes your IP address, browser type and request logs to deliver the site and keep it secure. Our voice-call endpoint also uses your IP address briefly, in memory, to limit abuse.

The lead-handoff sandbox on the homepage runs entirely in your browser; what you type there is not sent to us. We do not use analytics, advertising pixels, or tracking cookies.

Please don't send sensitive information (for example, health or medical details, government ID numbers, or financial account numbers) through the forms or on a call with our AI receptionist. We don't need it to reply to you.

3. Why we use it, and the legal basis

We only use information for these purposes. We don't sell personal information, and we don't make decisions about you based solely on automated processing.

4. Who we share it with

We use a small number of service providers that process information on our behalf. Some are based outside the Philippines (mainly the United States), so your information may be processed abroad. We stay responsible for it and choose providers with recognised security practices.

• Netlify: website hosting, form handling, and our server functions.
• Zapier: passes new form submissions and call summaries to email and sends your automatic confirmation and call summary.
• Google (Gmail): our email inbox, where inquiries and replies are kept. Google Fonts also serves the site's typefaces, so your browser connects to Google to load them.
• Supabase: login and database for the client portal and invoices.
• Retell AI (and the speech, voice and language-model providers it uses): powers the AI call receptionist and writes the call summary.
• esm.sh: a content network that delivers the open-source code libraries used by the portal and the AI call receptionist, so it receives your IP address when that code loads.

We may also disclose information when the law requires it, or to protect our rights or someone's safety.

5. How long we keep it

• Inquiries that don't become projects: up to 12 months after our last conversation, then deleted from the form inbox and email.
• Client accounts and invoices: while we work together, then for as long as Philippine tax and accounting rules require us to keep business records. After that we delete or anonymise them.
• AI receptionist calls: your call form details and the emailed call summary are kept like any other inquiry (up to 12 months if we don't end up working together). We don't keep our own audio recordings. Our voice provider is set to remove personal details from the call data it stores and to delete call data after 30 days.
• Technical logs: kept by our providers for their standard, short periods.

6. Cookies and browser storage

The public website sets no advertising or analytics cookies. If you sign in to the client portal or admin area, your browser stores a login session (in “local storage”) so you stay signed in; it is removed when you sign out. This is strictly necessary for the login to work, so we don't show a cookie banner. Our hosting provider may use strictly necessary technical cookies to deliver the site.

7. The AI call receptionist

• “Sofia” is an AI receptionist for Harbie Automation, a real agency. She answers questions about our automation services and notes a good time for a discovery call. She gives no medical, legal or financial advice, and nothing she says is a quote or a confirmed booking until we confirm it by email.
• Before the call we ask for your full name, email and best phone number (company and what you need are optional). Please use your real details: we use them to email you a summary of the call and to follow up on your inquiry. These details are saved with our form provider (Netlify) and shared with Retell AI so Sofia can greet you by name.
• Your browser asks for microphone permission. Audio is only sent after you click “Start call”, and stops when you end the call, after about 3 minutes, or after a long silence.
• Retell AI processes your audio in real time to produce a transcript, Sofia's replies, and a short call summary. After the call, Retell sends the summary to our server, which passes it through Zapier to Gmail so we can email it to you and review it. We set Retell to strip personal details from the call data it stores and to delete call data after 30 days.
• For convenience, your form details are kept in your browser tab's session storage so you don't have to retype them if you reload; they are cleared when you close the tab.
• Please don't share patient or health information, payment details, passwords or ID numbers on the call.

8. How we protect it

The site is served only over HTTPS. Portal data is protected by sign-in and database rules so each client can see only their own services and invoices, and only the administrator can create accounts or invoices. Secret keys stay on the server, never in your browser. Access to inboxes and tools is limited to Harbie Automation and protected with strong passwords and two-step verification where available.

No system is perfectly secure. If a personal data breach is likely to put you at real risk, we will tell you and, where the law requires, the National Privacy Commission, within 72 hours of learning about it.

9. Your rights

Under the Data Privacy Act you have the right to:

• be informed about how your information is used (this page);
• access the personal information we hold about you;
• correct information that is inaccurate or out of date;
• object to processing, or withdraw consent at any time (this doesn't affect processing already done);
• ask us to delete or block your information, subject to records the law requires us to keep;
• data portability: get a copy in a common electronic format;
• damages if you are harmed by inaccurate, unlawfully obtained, or misused information; and
• file a complaint with the National Privacy Commission (privacy.gov.ph).

To use any of these rights, email habdulmunap@gmail.com. We may ask you to confirm your identity, and we aim to reply within 15 business days. There is no charge for reasonable requests.

10. Children

This website and our services are meant for businesses and adults. We don't knowingly collect information from anyone under 18. If you think a minor has sent us information, email us and we will delete it.

11. Marketing

Sending an inquiry doesn't sign you up for a newsletter. We only email you about your inquiry or our work together. If we ever start a newsletter, we will ask for your separate opt-in first, and every message will include a way to unsubscribe.

12. Clinic and business clients

When we build an automation for your business (for example, a clinic's booking flow or call agent), the information of your customers or patients is processed on your instructions. In that case your business is the personal information controller and Harbie Automation acts as a personal information processor. We'll agree the details in a written data processing agreement before going live, and live systems are set up separately from the demos on this site.

13. Changes and contact

We'll update this page when our practices change and show the new date at the top. For questions or requests, contact Harbie Abdulmunap at habdulmunap@gmail.com.

See also our Terms of Use.