Privacy policy

Effective 16 September 2026. Applies to jazzymanhwa.com and everything served from it.

The short version

We store your email address, where you have got to in each story, and whether you are a member. We never see your card number. We do not sell or rent anything about you, we do not profile you, and members see no advertising at all. You can see, correct or delete everything we hold by emailing [email protected].

1. Who is responsible

jazzymanhwa.com is run by Jasser Mark Arioste, a sole proprietor established in the Philippines. For data protection law, that person is the controller of the information described here: the one who decides what is collected and why.

Reach the controller at [email protected]. There is no separate data protection officer; the business is not of a size that requires one, and the same address reaches the person who can act.

2. What we collect and why

Each row is one thing we store. The “legal basis” column is the reason data protection law allows it; where the basis is our legitimate interest, you may object (see your rights), and where it is your consent, you may withdraw it at any time.

What	Why	Legal basis	How long
Your account Email address, a display name taken from it, and the identifier our sign-in provider knows you by.	So you can sign in, and so a membership can be attached to you.	Performing our contract with you.	Until you delete the account. Deletion removes the email and name at once.
Where you got to For each story: the chapter and page you were last on, and when.	So the phone and the laptop agree on where you left off.	Performing our contract with you.	Until you delete the account, when it is removed immediately.
Your membership The subscription reference, whether it is active, when it renews or ends, the brand and last four digits of the card as Paddle reports them, and the link to Paddle’s page for managing it.	To know which chapters to open for you, and to show you the state of your membership.	Performing our contract with you.	As a payment record, for 7 years after the membership ends.
Paddle’s payment notifications The messages Paddle sends us about each payment: transaction and subscription details, the email you paid with, the billing country used for tax, and the card brand and last four digits. Never the card number.	To grant and end access correctly, and to trace a refund, a failed payment or a chargeback months later.	Performing our contract with you; our accounting obligations; our legitimate interest in resolving disputes.	7 years after the membership ends.
Your email address, if you ask to hear about new stories The address, and which page you gave it on.	To send you one email when a new story is published. Nothing else.	Your consent, which you withdraw by unsubscribing.	Until you unsubscribe. We then keep a record that you did, so you are not emailed again.
Technical logs IP address, browser type, the pages and files requested, timestamps, and error messages — which can include your email or account identifier when an action of yours failed.	To keep the site running, find faults, and detect abuse such as scraping or attempts to bypass the paywall.	Our legitimate interest in security and reliability.	A short period — days to a few weeks — then deleted or rotated automatically.
Messages you send us Your email and whatever you write.	To answer you.	Our legitimate interest in responding, or the contract where it concerns your membership.	For as long as it takes to deal with the matter, and for payment questions as part of the payment record.

We also count how often each story is read. Those are totals per story, not records of who read what, and they contain nothing about you.

Providing your email is necessary to have an account or a membership — without it neither can exist. Everything else is optional. We make no decisions about you by automated means that have a legal or similarly significant effect.

3. What we do not collect

Card numbers, bank details or billing addresses. Paddle takes the payment on its own pages and we never receive those details. What reaches us is the card brand, its last four digits, and the billing country.
Passwords. If you sign in with a password or a passkey, it is held by our sign-in provider, never by us.
Anything sensitive — health, beliefs, orientation, biometrics — and nothing about what you read is ever combined with such things or inferred from them.
Analytics. There is no analytics script on the site. If one is added, it will be listed in section 5 and, where consent is required, asked for first.

4. Where it comes from

Almost everything comes from you: what you type when you sign in or subscribe to the newsletter, and where you are in a story. Two things come from elsewhere:

Paddle tells us when you have paid, when a payment fails, and when you cancel or are refunded, along with the card brand and last four digits and the billing country.
Our sign-in provider tells us the identifier and email address of the person who signed in.

We do not sell, rent or trade personal information, and we do not give it to anyone for their own marketing. It is shared only with the companies that run parts of the service, and with authorities where the law requires.

Companies that process data on our instructions

Hosting — DigitalOcean (United States), which runs the server and keeps its logs.
Database — MongoDB Atlas (MongoDB, Inc., United States), which stores the accounts, memberships and reading positions described above.
Media delivery — Cloudflare (United States), which serves the story pages and audio and sees the IP address that requested them.
Sign-in — Clerk (United States), which handles signing in and holds any password or passkey.
Email delivery — a transactional email provider, used only to send the newsletter you asked for. It will be named here before the first email is sent.

Each is bound by a contract that limits it to processing on our instructions and to keeping the data secure.

Companies that are responsible in their own right

Paddle (Paddle.com Market Ltd, United Kingdom, and Paddle.com Inc., United States) is the seller of record for memberships: it takes your payment, calculates and remits tax, issues the receipt and handles chargebacks. For the payment itself Paddle is a controller in its own right, under its own privacy policy.
Advertising partners, on free pages only and only once advertising is switched on — see section 8.

If the business is incorporated, sold or merged, your information may be transferred to the new owner under this same policy. You would be told first.

6. Where it is stored

The controller is in the Philippines; the providers above are in the United States and, for Paddle, also the United Kingdom. If you are in the European Economic Area, the United Kingdom or Switzerland, your information therefore leaves the place you live.

For each provider we rely on the safeguards European law recognises: the EU–US Data Privacy Framework where the company is certified under it, and otherwise the European Commission’s standard contractual clauses built into the provider’s terms. The controller’s own access from the Philippines is limited to what is needed to run the service you have asked for and to answer you. You can ask us at any time which safeguard applies to a given provider.

7. Cookies and your browser

The site uses very little, and nothing that follows you elsewhere.

One cookie keeps you signed in. It is set when you sign in, contains only a session reference, and is strictly necessary for the account to work, so no consent is asked for it. Signing out removes it.
The reader remembers your place and settings in your own browser (its local storage): the page you were on, playback speed, whether the text is shown. That copy never leaves your device and we cannot read it. Clearing the site’s data in your browser removes it.
Advertising cookies do not exist on the site today. When advertising is introduced, they will be set on free pages only, and in the European Economic Area, the United Kingdom and Switzerland only after you have agreed through a consent banner, which will also let you change your mind. Section 8 has the details.

Do Not Track and Global Privacy Control. The site does not change its behaviour in response to a Do Not Track signal, because there is no tracking to switch off. Once advertising exists, a Global Privacy Control signal from your browser will be treated as an opt-out from personalised advertising.

8. Advertising

Free chapters will carry advertising; that is what pays for them. Members see no advertising anywhere on this site.

The reader — the screen where the story plays — is limited to one advertisement, in a band across the bottom of the screen, never over the artwork. Its height is part of the layout before anything loads into it, and it does not refresh while you read. The full commitment is in the terms.

We intend to use Google AdSense. When it is live, the following applies: third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and to other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet. You may opt out of personalised advertising by visiting Google’s Ads Settings, and opt out of other vendors’ personalised advertising at aboutads.info (US) or youronlinechoices.eu (EU).

In the European Economic Area, the United Kingdom and Switzerland, personalised advertising will load only after you consent through a banner meeting Google’s consent-management requirements. Declining leaves you with the free chapters and non-personalised or no advertising. This section will be updated on the day advertising is switched on, and the effective date above will change.

9. Your rights

Wherever you live, you can ask us to show you what we hold about you, correct it, or delete it. If you are in the European Economic Area, the United Kingdom or Switzerland, the law gives you these rights specifically:

Access — a copy of your personal data and this information about how it is used.
Rectification — correction of anything inaccurate.
Erasure — deletion, which your account page does immediately for your account and reading history. Payment records are kept for the period in section 2, because the law and the payment provider require it; they are used for nothing else.
Restriction — a pause on processing while a dispute about it is resolved.
Portability — the data you gave us, in a machine-readable form.
Objection — to any processing based on our legitimate interests, which we will stop unless we can show a compelling reason; and to direct marketing, which we will stop without exception.
Withdrawing consent — at any time, for anything based on it, without affecting what came before.

To exercise any of them, email [email protected] from the address on your account, or tell us which account you mean. We answer within one month, free of charge, and may ask you to confirm your identity first so that nobody else can obtain your data by asking for it.

You also have the right to complain to a supervisory authority:

Philippines: National Privacy Commission
European Union: the data protection authority of the country where you live
United Kingdom: Information Commissioner’s Office

We would rather hear from you first, and will try to put things right.

10. Readers in the United States

The rights above are yours too, as a matter of policy, whether or not a state privacy law applies to a business of this size. In the terms California and other states use:

We do not sell personal information, and we do not share it for cross-context behavioural advertising today. If personalised advertising is introduced on free pages, that may count as “sharing” under California law; you will be able to opt out through the advertising controls in section 8, and we will honour Global Privacy Control signals as that opt-out.
You may know what we collect (section 2), delete it (your account page, or email us), and correct it (email us). We will not treat you differently for exercising a right.
We do not disclose personal information to third parties for their own direct marketing, so there is nothing to report under California’s “Shine the Light” law.
Marketing emails, when they exist, will carry an unsubscribe link and a postal address, as the CAN-SPAM Act requires, and an unsubscribe is honoured within ten business days.

11. Age

The site is for adults. Some stories contain violence and implied sex. You must be at least 18 to create an account or buy a membership, and we do not knowingly collect information from anyone under 13 in the United States or under the age of digital consent where you live. If you believe a child has given us information, email us and it will be deleted.

12. Security

Everything travels over HTTPS. Access to the database is limited to the controller and the providers named above, each under contract. Payment details never reach our systems, which is the single most effective protection a small site can have. If a breach ever puts your rights at risk, we will tell the relevant authority within 72 hours where the law requires it, and tell you directly without undue delay.

13. Changes to this policy

The effective date at the top changes whenever this policy does. For a change that affects you materially — a new purpose, a new category of recipient, advertising switching on — account holders are emailed before it takes effect and a notice is shown on the site. Earlier versions are available on request.

14. Contact

Jasser Mark Arioste, trading as jazzymanhwa.com, the Philippines.
[email protected]