Data Privacy Act notice
Privacy notice
A petition site asking you to trust it with your name owes you a plain answer on what it does with it. This is that answer, and it is short on purpose.
Who is responsible
Boses is an independent civic project operated by Miguel Molina. Under the Data Privacy Act of 2012 (RA 10173) it acts as the Personal Information Controller for everything described here. It is not affiliated with any government agency, political party, or candidate.
Data protection contact: [email protected].
What we collect
| Field | Why | Published? |
|---|---|---|
| Full name | Appears on the signature list given to senators | Yes, on the list |
| Email address | Confirms the signature is real; campaign updates | Never |
| City or municipality | Shows how national the support is | Yes, on the list |
| Province | Shows how national the support is | Yes, on the list |
| Registered voter (optional) | Reported as its own count, never merged into the total | As an aggregate only |
| Comment text (optional) | Published on the petition page and forwarded to senators in full | Yes, with your name, city, and province |
| Reference number | Your receipt, and a backup way to withdraw | No |
| Signature timestamp | Audit trail, so the list can be verified | No |
| Page language | So links take you back to the page you signed on | No |
| Withdrawal time | Records that you withdrew, so you are never counted or emailed again | No |
| Abuse-prevention record | A hashed form of your IP address and email, kept for 24 hours to limit repeated submissions. Not stored in readable form | No |
We do not collect your home address, birthday, government ID number, mobile number, or any sensitive personal information as the DPA defines it. If a field isn't in the table above, we don't have it.
Legal basis
Consent, given by ticking the box on the petition page. Nothing here relies on legitimate interest, and there is no pre-ticked box anywhere on this site.
Who sees it
The signature list, containing names, cities, and provinces, is given to all 24 senators and their staff as part of the petition packet, and may be published in aggregate form on this site. Email addresses are never included, never sold, never rented, and never shared with any campaign, party, or candidate.
Two companies process data for us. Cloudflare, Inc. (United States) hosts this site and its database, which is stored in Cloudflare's Asia-Pacific region. Resend, Inc. (United States) delivers our emails, so it receives your name and email address.
How long we keep it
Until the campaign closes and the packet is filed, plus twelve months so the filing can be audited if anyone questions it. After that the records are deleted. Aggregate counts, with no personal data in them, are kept indefinitely as a public record of the campaign.
Removing yourself
Every email we send carries a one-click unsubscribe that also removes you from the signature list and the count. No login, no form, no reply required, honored within 48 hours. A petition campaigning for that standard has no business doing it any other way.
You also have the rights the DPA gives you: to be informed, to access, to correct, to object, to erasure or blocking, to damages, and to data portability. Write to the address above, or complain to the National Privacy Commission directly.
Cookies
None for advertising, none for cross-site tracking, and no third-party analytics that profile you. Any measurement used here is aggregate and cookieless.
Last updated 4 September 2026.