Privacy Statement

The data controller for VINCE is the BS Computer Science thesis team at Visayas State University (VSU), Baybay City, Leyte. VINCE is an academic prototype developed as a capstone project and is not a commercial service.

For data privacy inquiries, contact: baguion445@gmail.com

VINCE collects only the data necessary to operate the chatbot and evaluate the system:

• User queries — the text messages you send to VINCE (e.g., "Where is the library?").
• Detected intent — the NLP classification of your query (e.g., ask_location).
• Confidence score — the system's certainty in its classification (a number between 0 and 1).
• Response status — whether the query was answered successfully, returned an error, or is pending.
• Timestamp — the date and time the query was submitted.
• Platform — which interface was used (e.g., web browser or Facebook Messenger).
• Session cookies — used exclusively for admin authentication; not stored for regular users.

VINCE does not collect your name, email address, student ID, or any other personally identifiable information (PII) as part of normal use. Interaction data is treated as anonymized.

The data collected is used solely for the following purposes:

• Academic evaluation of the VINCE chatbot system (thesis research).
• Improving the accuracy and coverage of VINCE's responses.
• Generating aggregate analytics (e.g., most-asked topics, system performance metrics).
• Identifying unanswered or poorly answered queries for knowledge base improvement.

Data is not sold, shared with third parties for commercial purposes, or used for targeted advertising.

Processing of interaction data is based on legitimate interest under Section 12(e) of RA 10173 — specifically, the legitimate academic interest of evaluating and improving a research prototype. Where consent is required for non-essential cookies or data collection, it is obtained through the cookie consent banner displayed on first visit.

Interaction logs are stored in a cloud database provided by Supabase (hosted on AWS infrastructure), with access restricted to authorized system administrators and thesis researchers. Data is protected by:

• Row-level security policies enforced at the database level.
• Encrypted connections (TLS/HTTPS) between the application and the database.
• Admin accounts protected by secure authentication.

Interaction data will be retained for the duration of the thesis research period and for a reasonable period thereafter for academic documentation purposes. Data will be deleted or anonymized upon completion of the degree program and after any required academic archiving period.

As a data subject under the Data Privacy Act of 2012, you have the right to:

• Be informed — to know what data is collected and how it is used (this statement).
• Access — to request a copy of data associated with your queries.
• Correction — to request correction of inaccurate data.
• Erasure / Blocking — to request deletion of your data where there is no legitimate basis for retention.
• Object — to object to the processing of your data for specific purposes.
• Data Portability — to receive your data in a structured, machine-readable format.
• Lodge a complaint — to file a complaint with the National Privacy Commission (NPC) at privacy.gov.ph if you believe your rights have been violated.

To exercise any of these rights, contact us at baguion445@gmail.com. We will respond within 15 business days.

VINCE uses the following cookies:

• Essential session cookies — required for admin authentication. These cannot be disabled without breaking admin functionality.
• Consent preference cookie (vince_cookie_consent) — stores your Accept/Reject choice for up to 12 months. No personal data is stored in this cookie.

VINCE does not use third-party tracking cookies, advertising cookies, or cross-site analytics cookies.

VINCE integrates with the following third-party services that may process data:

• Supabase — database and authentication. Subject to Supabase's Privacy Policy.
• Facebook Messenger (optional channel) — Facebook's own data handling applies when interacting through Messenger. See Meta's Privacy Policy.

We may update this Privacy Statement as the system evolves or as legal requirements change. The effective date at the top of this page will reflect the most recent revision. Continued use of VINCE after an update constitutes acceptance of the revised statement.