Privacy Policy

Revised as of September 2026

This is the privacy policy and privacy notice (the “Privacy Policy”) of the web application known as Internly, including the website located at internly.io and all of its subdomains (collectively, the “Platform”), which is owned and operated by Vision Solutions Technology Inc. (the “Company,” “us,” “our,” and “we”). This Privacy Policy is integrated with and forms an integral part of the Terms and Conditions of the Platform (the “Terms”).

This Privacy Policy applies to all personal data and personal information that we hold about you, as well as to any personal data you may provide to us, in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (the “DPA”), its implementing rules and regulations (the “IRR”), the pertinent issuances of the National Privacy Commission (the “NPC”), and other relevant laws, rules and regulations. It is a binding and enforceable agreement between the Company and the end users of the Platform, whether registered as a student or trainee (each, a “Student”) or as an employer, company or host training establishment (each, an “Employer”) (collectively, “you” or the “Users”).

By creating an account on, accessing, or otherwise using the Platform, you confirm that you have read, understood, and agree to be bound by this Privacy Policy. The Company may make changes to this Privacy Policy from time to time by posting the updated version on the Platform. Your access to and continued use of your account following the publication of the updated Privacy Policy shall be considered an acceptance of such changes.

A. The Platform

The Platform is an internship and on-the-job training (“OJT”) listing and matching service for Filipino students. It allows Students to create a profile, browse and search internship listings, and submit applications, and allows Employers to publish listings, receive and review applications, and purchase credits used to publish or promote those listings.

The Company acts as a personal information controller with respect to the personal data described in this Privacy Policy. An Employer to whom you submit an application acts as a separate and independent personal information controller with respect to the copy of your data that it receives, as further described in Section F.

B. Personal Data We Collect

Personal data is collected, used and processed by manual, electronic, and automated means as is necessary to provide the services and features of the Platform. Depending on how you use the Platform, we collect the following categories of data:

Account data. Your name, email address, authentication identifiers issued by our authentication provider, the role you select (Student or Employer), and, where you sign in through a third-party identity provider, the basic profile information that provider releases to us.
Student profile data. Your school, course, year level, biography, skills, required OJT hours, external links you choose to publish, prior experience, preferred location, availability, work-mode preference, and any résumé and profile photograph you upload.
Employer data. Company name and details, website domain, work email address, and the name, position and contact details of the representative who registers on the Employer's behalf.
Verification documents, which may constitute sensitive personal information. In order to verify the legitimacy of an Employer and of the person acting for it, we require the submission of supporting documents (the “Verification Documents”). These may include government-issued identification such as a UMID, passport, driver's licence or PhilSys card, a professional licence, and business records such as a DTI or SEC registration, a BIR certificate of registration or official receipt, a mayor's or business permit, a client contract or invoice, or an accreditation certificate. Government identification documents constitute sensitive personal information under Section 3(l) of the DPA and are processed on the basis of your consent and of our legitimate interest in preventing fraudulent listings against students.
Application data. The listings you apply to, your answers to an Employer's screening questions, the résumé attached to a given application, the status of that application, and any relevance score generated as described in Section E.
Transaction data. Records of credit purchases, credit balances and credit usage. Payments are processed by our payment service provider. The Company does not collect or store your full card number, card verification value, or bank credentials.
Usage, device and log data. Internet protocol address, browser and device information, pages and listings viewed, actions taken on the Platform, and diagnostic and error data collected for the purpose of monitoring stability and abuse.
Communications data. Email notifications sent to you, your subscription and unsubscribe preferences, and any correspondence you send to us.

You acknowledge that you are responsible for the accuracy and correctness of any personal data you provide to us, as well as for the consequences of providing inaccurate, incorrect or out-of-date personal data. You must not upload the personal data of any other individual, including any identification document that is not your own, except where you are duly authorised to do so.

C. Eligibility

The Platform is intended solely for individuals who are at least eighteen (18) years of age. We do not knowingly collect the personal data of minors. If we become aware that an account has been created by a person below eighteen (18) years of age, we will disable the account and delete the personal data associated with it, subject only to any retention required by law. A parent or guardian who believes that a minor has provided personal data to us may request its deletion through the contact details in Section N.

D. Purposes of Processing

Your personal data is used only for the specific purposes for which it was collected. Generally, we collect, use, and disclose your personal data for the following purposes:

To create, authenticate, secure and administer your account on the Platform;
To provide the core features of the Platform, including publishing your profile to Employers you apply to, delivering your applications, allowing Employers to publish and manage listings, and producing internship recommendations relevant to you;
To verify the legitimacy of an Employer and of its representative, and to detect and prevent fraudulent, exploitative or non-existent listings;
To process the purchase of credits and to maintain accurate transaction records;
To send you transactional and service messages, including application updates, verification emails, and notices concerning your account;
To provide customer support, to investigate reports and complaints, and to enforce the Terms and this Privacy Policy;
To monitor, analyse and improve the operation, security and stability of the Platform, and to understand aggregate usage of its features;
To investigate, address, or defend against fraud, abuse, or suspicious activity linked to or associated with your account; and
To comply with applicable laws, rules and regulations, and to respond to lawful requests from government regulators, law enforcement and the courts.

Where processing is founded on your consent, you may withdraw that consent at any time in accordance with Section L, without prejudice to the lawfulness of processing carried out before the withdrawal.

E. Automated Processing and Artificial Intelligence

The Platform makes use of a third-party artificial intelligence service provider in the following ways, and you are informed of them expressly:

Résumé parsing. Where you choose to upload a résumé during onboarding, its contents are transmitted to our artificial intelligence provider in order to extract information and pre-fill the fields of your profile. You remain free to edit or delete any field so generated, and to complete your profile manually instead.
Listing assistance. An Employer may generate draft listing text with the assistance of the same provider. The Employer remains responsible for the accuracy of the published listing.
Application relevance scoring. An application may be assigned an automatically generated score indicating its apparent relevance to the requirements stated in the listing.

A relevance score is an aid to the Employer's review and does not by itself decide the outcome of any application. The Company does not accept, reject, shortlist or rank applications on your behalf, and no decision producing legal effects concerning you is made solely by automated means. You have the right to obtain information about the automated processing described in this Section, to object to it, and to request that a human review be undertaken, by writing to us at the address in Section N.

F. What an Employer Receives When You Apply

When you submit an application, the Employer that published the listing receives your name, your Platform profile including your school, course, year level, skills and stated experience, the contact details in your profile, your answers to that Employer's screening questions, and access to the résumé attached to the application.

Access to an uploaded résumé is granted through a time-limited link rather than by publishing the file. You should nonetheless understand and accept that once an Employer has viewed or downloaded a document, the Company has no technical means of recalling, retrieving or deleting the copy in that Employer's possession. From the moment of transmission, the Employer processes that copy as an independent personal information controller and is responsible under the DPA for its own handling, retention and disposal of it. Requests concerning that copy, including access, correction and erasure, must be addressed to the Employer directly, although we will assist you in identifying and contacting it.

Your profile is not published to Employers who you have not applied to, and is not made available for general browsing by Employers or by the public.

G. Disclosure of Personal Data

The Company does not sell, rent, trade or otherwise make your personal data available for consideration to any third party. We do not disclose your personal data to data brokers, advertising networks, or marketing list providers, and we do not permit any service provider engaged by us to use your personal data for its own purposes.

We disclose personal data only in the following circumstances:

To an Employer to whom you have submitted an application, as described in Section F;
To service providers who process personal data on our behalf, under contract, only on our instructions, and only to the extent needed to perform their function. These are our authentication provider (account sign-in and sessions), our database provider (application data), our file storage provider (résumés, profile photographs and Verification Documents), our payment processor (payment for credits), our email delivery provider (transactional and notification email), our artificial intelligence provider (the features described in Section E), and our analytics and error-monitoring providers (usage measurement and diagnostics);
To government authorities, law enforcement, regulators and the courts, where required by law, by subpoena, or by lawful order, or where disclosure is otherwise necessary to establish, exercise or defend a legal claim, to prevent harm, or to protect the rights, property or safety of the Company, its Users or the public; and
To a successor in interest in connection with a merger, acquisition, reorganisation or sale of assets, provided that the recipient is bound to honour this Privacy Policy in respect of the personal data transferred, and that you are notified of any change in the identity of the controller.

H. Processing Outside the Philippines

Your personal data may be stored and processed on servers located outside the Republic of the Philippines. Data privacy laws vary between jurisdictions, and some afford a lesser degree of protection than others. Regardless of where your personal data is processed, the Company applies the protections described in this Privacy Policy and remains accountable for personal data transferred to any third party for processing, in accordance with Section 21 of the DPA. The DPA and its IRR shall govern any complaint or breach involving your personal data.

I. Retention and Disposal

We retain your personal data only for as long as it is necessary to fulfil the purposes for which it was collected, or for such longer period as is required or permitted by law. In particular:

Account and profile data is retained for as long as your account remains open, and for a period of one (1) year following the closure or termination of your account, after which it is deleted.
Application data is retained for as long as necessary to allow you and the Employer concerned to refer to the application, and is deleted together with your account in accordance with the preceding paragraph.
Verification Documents are collected for the sole purpose of verifying an Employer, and are retained only for as long as is necessary to complete that verification. Immediately upon a determination being made on an Employer's verification, whether it is approved or refused, the Verification Documents submitted for that purpose are deleted, both from our database and from our file storage. We retain only the outcome of the verification. We do not retain the government identification documents submitted for it, and we do not use any Verification Document for any other purpose.
Transaction and payment records are retained for the period required under the National Internal Revenue Code and other applicable tax, accounting and anti-fraud laws, notwithstanding the closure of your account.
Data subject to a dispute, investigation or legal claim is retained until the matter is finally resolved.

When we dispose of your personal data, we use reasonable procedures to destroy it or render it unreadable, in a manner that prevents further processing, unauthorised access or disclosure.

J. Security Measures

The Company has implemented reasonable and appropriate organisational, physical and technical security measures to protect your personal data against loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction. These include:

Encryption of personal data in transit between your device and the Platform;
Storage of résumés and Verification Documents in private storage that is not publicly addressable, with access granted only through short-lived, individually issued links;
Access controls that scope every stored file to the account that owns it, so that one User cannot address another User's files;
Restriction of access to personal data to authorised personnel who are bound to confidentiality and who require such access to perform their duties; and
Logging and monitoring for errors, abuse and anomalous activity.

No method of transmission over the internet and no method of electronic storage is entirely secure. While we strive to protect your personal data using commercially acceptable means, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your sign-in credentials and for signing out when using a shared device. If you believe your account has been compromised, notify us immediately using the details in Section N.

K. Cookies and Analytics

The Platform uses cookies and similar technologies. Cookies are small files placed on your device that allow the Platform to recognise your browser and to retain certain information. Some cookies are strictly necessary for the Platform to function, including those used to keep you signed in; these cannot be disabled without rendering the Platform unusable.

We additionally use a third-party analytics service to understand how the Platform is used in the aggregate. Analytics cookies are set only after you have accepted them. Advertising and remarketing signals are permanently disabled and we do not use analytics data for advertising. If you decline, we record only an anonymous, cookieless count of the visit, with no identifier attached to it. You may change your choice at any time below, or by clearing cookies and site data in your browser.

The Platform does not track your browsing activity on other websites, and does not read your search history or your email.

L. Rights of the Data Subject

As a data subject under the DPA and its IRR, you have the following rights, which you may exercise at any time:

The right to be informed. You have the right to know whether your personal data shall be, are being, or have been processed, and for what purposes.
The right to access. You have the right to demand reasonable access to your personal data in our possession, together with a description of the manner and purposes of its processing and the recipients to whom it has been disclosed.
The right to object. You have the right to object to the processing of your personal data, including processing for direct marketing and the automated processing described in Section E.
The right to erasure or blocking. You have the right to suspend, withdraw or order the blocking, removal or destruction of your personal data in the circumstances provided by the DPA.
The right to rectification. You have the right to dispute any inaccuracy or error in your personal data and to have it corrected without delay.
The right to data portability. You have the right to obtain a copy of your personal data in an electronic or structured format that is commonly used and allows further use.
The right to damages. You have the right to be indemnified for damages sustained by reason of inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of your personal data.
The right to file a complaint. You have the right to lodge a complaint with the National Privacy Commission if you believe your rights as a data subject have been violated.

You may exercise any of these rights by writing to us at the address in Section N. Requests must be made in writing and we may require you to verify your identity before acting on a request, in order to prevent the disclosure of your data to another person. We will respond within the period prescribed by the DPA and its IRR. In certain cases a request may be refused or restricted, for example where compliance would prejudice an ongoing fraud investigation or a legal proceeding, or where retention is required by law; where a request is refused, we will inform you of the reason.

You may also unsubscribe from non-transactional email at any time using the link contained in every such message.

M. Third-Party Websites

The Platform may contain links to websites and services operated by third parties, including Employers and their careers pages. Those websites are not owned or controlled by the Company and are governed by their own privacy policies. The Company is not responsible for the content of those websites, for your use of them, or for their privacy practices.

N. Changes to this Privacy Policy

The Company reserves the right to amend or update this Privacy Policy from time to time. Any such amendment shall take effect upon its publication on the Platform, and your continued access to or use of the Platform shall constitute your agreement to be bound by it. Where an amendment materially changes the purposes for which your personal data is processed, we will take reasonable steps to notify you.

O. Contact Information

For inquiries regarding the processing of your personal data, to exercise any of the rights described in Section L, or to raise a concern or complaint regarding data privacy, you may contact us at hello@internly.io. Please state the material facts clearly, specify your contact information, and include any supporting evidence.

This Platform is owned and operated by Vision Solutions Technology Inc., a corporation duly organized and existing under the laws of the Republic of the Philippines, with principal office in Makati City, Philippines. If you are not satisfied with our response, you may lodge a complaint with the National Privacy Commission, 5th Floor, Delegation Building, PICC Complex, Roxas Boulevard, Pasay City, Metro Manila.