This Privacy Policy explains how personal information is handled when you use the CICC AI Assistant (the “Assistant”), the chat service that helps people understand and report cybercrime incidents. It is issued in accordance with Republic Act No. 10173, the Data Privacy Act of 2012 (“DPA”), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (“NPC”).
Please do not share passwords, one-time passwords (OTPs), PINs, or full ID or card numbers in the chat. The Assistant does not need them, and a genuine CICC representative will never ask for them in this chat unless a human handler has joined the conversation and explicitly requests specific details.
1. Scope and controller
The Cybercrime Investigation and Coordinating Center (“CICC”, “we”, “us”) is the personal information controller for information collected through the Assistant. The technology service provider that hosts and operates the Assistant acts on CICC’s behalf and only on CICC’s documented instructions.
This policy applies to conversations with the Assistant on any web page where it is embedded. It does not cover other CICC websites, hotlines, or channels, which may have their own notices.
2. Information we collect
We collect only what is needed to answer your questions and, if you choose, to help route a concern to a human handler.
| Information | What it includes | Required? |
|---|---|---|
| Conversation content | The messages you type and the Assistant’s replies, with timestamps. This may include details of an incident that you choose to describe, such as the type of scam, platforms, amounts, dates, and account names. | Needed to use the Assistant |
| Image attachments | An optional image (JPG, PNG, WebP or HEIC, up to 5 MB, one per message), for example a screenshot of a suspicious message. The image is analysed to help answer your question. The image file itself is not stored. Only a note that an image was attached is kept in the conversation record. | Optional |
| Contact email address or mobile number | If you choose to provide one, your email address or mobile number, so that a CICC agent can reach you if the chat is disconnected. | Optional |
| Feedback | Thumbs-up or thumbs-down reactions on individual answers. | Optional |
| Technical data | A randomly generated session identifier, the web page from which the chat was opened, response times, and standard server and network logs (such as IP address) generated by our hosting infrastructure for security and operations. | Generated automatically |
| Derived information | Where a conversation describes an incident, the Assistant’s systems may assign a complaint category and an urgency level, and extract details you mention (for example names of platforms, accounts, or amounts) to help a human handler review the concern faster. | Generated automatically |
We do not knowingly require you to provide sensitive personal information to use the Assistant. If you choose to include it in a message, it is handled with the same safeguards described in this policy.
3. How we use your information
- To answer your questions about cybercrime, how to report an incident, and what happens after a report is filed.
- To help identify the nature and urgency of a concern and route it to an authorized CICC handler, including when you ask to speak to a person.
- To let a CICC agent follow up on your request, if you provided an email address or mobile number.
- To protect the service and its users, including preventing abuse, spam, and attempts to disrupt or misuse it.
- To monitor and improve the quality, accuracy, and safety of the Assistant, using aggregated statistics wherever possible.
- To comply with legal obligations and to carry out CICC’s functions as a public authority.
We process personal information on the basis of your consent (for example, where you voluntarily provide an email address or mobile number), and where processing is necessary to fulfil CICC’s mandate as a public authority or to comply with a legal obligation, as permitted by Sections 12 and 13 of the DPA. We do not use your information for advertising or sell it.
4. AI and automated processing
Replies are generated by an artificial intelligence system that draws on CICC-approved information. AI can make mistakes or give incomplete answers, so please confirm important details with CICC or the relevant agency before acting on them.
The Assistant does not make decisions that produce legal effects on you. Categorisation and urgency labels are used only to help authorized CICC personnel prioritise and review concerns; a person reviews any matter that is escalated. Authorized CICC personnel may read conversations and, where appropriate, join a conversation to reply directly.
6. Processing outside the Philippines
Some of the providers above store or process information on servers located outside the Philippines, including in Japan and the United States. Where this happens, we require the provider to protect the information with safeguards comparable to those required by the DPA, and we limit what is sent to what is needed to provide the service.
7. Retention
- Contact email address: automatically and permanently deleted after 90 days. You may ask for earlier deletion at any time (see Your rights).
- Conversation records: kept only as long as necessary for the purposes in this policy, including handling a reported concern, and then disposed of securely in line with applicable government records retention and disposal rules.
- Image files: not retained (see Information we collect).
- Session identifier: held in your browser only for the life of the browser tab.
8. Security
We use reasonable organizational, physical, and technical measures to protect personal information against unauthorized access, disclosure, alteration, and loss. These include encryption of data in transit using TLS, role-based access controls and authentication for staff who use the administration system, separation of contact details from conversation content, rate limiting and abuse detection, and contractual commitments from our service providers. No online service can guarantee absolute security. If a personal data breach occurs that requires notification, we will notify the NPC and affected individuals as required by law.
9. Your rights
Under the Data Privacy Act you have the right to:
- Be informed about how your personal information is processed.
- Access the personal information we hold about you.
- Object to processing, including where it is based on your consent, and withdraw consent at any time.
- Correct inaccurate or incomplete information.
- Erasure or blocking of information that is unlawfully obtained, no longer necessary, or that you have withdrawn consent for, subject to legal retention requirements.
- Data portability, where applicable.
- Be indemnified for damages caused by inaccurate, false, unlawfully obtained, or unauthorized use of your personal information.
To make a request, contact CICC through the channels in the Contact section below or ask the Assistant to connect you with a CICC support agent. We may need to verify your identity and the conversation concerned, for example using details of what you reported. Because the Assistant does not require you to create an account, we can locate records only from details you can provide.
If you believe your rights have been violated, you may lodge a complaint with the National Privacy Commission.
10. Children and sensitive reports
The Assistant is intended for use by adults and is not directed at children. If a conversation indicates that a child may be a victim of online sexual abuse or exploitation, the Assistant will not continue the intake itself, will not ask you to send or describe the material, and will hand the conversation to a human CICC handler. Please keep any evidence safe and do not download, copy, or forward such material. If a child is in immediate danger, contact local police or emergency services first.
11. Cookies and browser storage
The Assistant does not use cookies, advertising trackers, or third-party analytics on this page. It stores a random session identifier and a few interface preferences (for example, that you dismissed a prompt) in your browser’s session storage. This data stays on your device and is cleared when you close the browser tab.
12. Changes to this policy
We may update this policy to reflect changes in the service, our providers, or the law. The “Last updated” date at the top of this page shows when it last changed. Where a change is material, we will provide a more prominent notice.
13. Contact us
For questions about this policy or to exercise your rights:
- Call the CICC Inter-Agency Response Center (I-ARC) hotline at 1326 (toll-free, 24 hours a day).
- Use the Report section of the eGovPH Super App.
- Ask the Assistant to connect you with a CICC support agent.