Privacy Notice — Review Masters CERT

Version 1.3.0 · Interim · Effective 19 October 2026

This is an interim notice pending legal review. It describes accurately what the CERT platform does with your information today. It has not yet been reviewed by a lawyer against the Philippine Data Privacy Act of 2012 (RA 10173). It will be replaced once that review is complete.

Reviewmasters Inc., doing business as Review Masters, operates the College Entrance Readiness Test (CERT) at cert.upcatreview.com. This notice covers CERT specifically. The main Review Masters website has its own separate policy.

Who we are

Reviewmasters Inc. is the personal information controller for CERT.

Reviewmasters Inc. 307 Katipunan Ave, Loyola Heights, Quezon City, Philippines reviewmasters@upcatreview.com

What we collect

To create your account

• First name, last name, email address
• Whether you are 18 or older. We do not ask for your date of birth.
• If you are under 18: a parent or guardian's email address

When you take the assessment

• Your answers, and when each was recorded
• When each section started, and when it was submitted
• Your scores, by subject and by topic

After the assessment, if you choose to give it

• School, province, city or town, mobile number, grade level
• Your answers to our survey questions about how you are preparing

Automatically

• How you reached us (the campaign or website that referred you)
• Basic usage events, such as starting and finishing the assessment

What we do with it

• To give you your results. This is the main purpose.
• To email you your report, and a link to view it online.
• To improve the assessment, using combined statistics across many students.
• To contact you about Review Masters programs — only if you have agreed, and only in the ways described below. This includes passing your details to the Review Masters branch that serves your province or city, so that the branch nearest you is the one that gets in touch.

If you are under 18

Most CERT takers are Grade 11 students, so this applies to most people reading this.

• You can take the assessment and see your own score whether or not your parent responds. Your result is yours.
• We email the parent or guardian address you give us, once, to ask permission before contacting you about our programs.
• Once you tell us you are under 18, we run no advertising trackers on your account. Facebook's tracking pixel is switched off for under-18 accounts regardless of any other setting. Before you sign in and tell us your age, the public pages of the site are measured like any public web page — see Cookies below.
• We do not add you to any email marketing list unless both you and your parent or guardian have agreed.
• If you tick the box asking us to contact you about our programs, we may pass your details to the Review Masters branch that serves your area so that they can contact you — even before your parent or guardian has responded. Your parent or guardian's permission, on its own, also allows this. Either of you can withdraw at any time by writing to us.

• The instructions video is not an advertising tracker, and we do not switch it off for under-18 accounts. It is part of the test. It also does not load until you press play, so if you never play it, nothing about you reaches YouTube. See Who else sees your information below.

Your parent's email address is used only for that permission request. It is never added to a mailing list.

Consent

There are two separate decisions, and they are always presented separately:

1. Data processing — needed to run the assessment and give you results.
2. Marketing — optional. Never required to see your results.

You can change your marketing decision at any time by replying to any email we send, or by writing to reviewmasters@upcatreview.com. We record which version of this notice you agreed to, and when.

Who else sees your information

• Review Masters branches. Review Masters programs are delivered by licensed branches, each serving a province or a group of towns. If you have agreed to be contacted, the branch that serves your province or city or town receives your name, school, grade level, city or town, email address, mobile number, your CERT score and rating, and your weakest section, so that they can talk to you about a suitable program. A branch receives only the students in its own area, and only those who have agreed. If you have not agreed, no branch sees your details.
• Supabase hosts our database, in Singapore.
• Vercel hosts the application.
• Resend delivers our emails.
• Google Analytics measures general site usage. Advertising features are switched on only for users aged 18 or over who have agreed to marketing.
• Meta (Facebook) measures advertising on the public pages you see before you sign in, and after sign-in only for users aged 18 or over who have agreed to marketing. It is never used for anyone who tells us they are under 18. Neither tool receives your name, email address, answers or score.
• YouTube (Google) hosts the instructions video on the page where you start the test. The page shows a still picture of the video until you press play, and nothing is sent to YouTube unless you press play. When you do, YouTube receives your IP address and information about your browser and device, as any video website would, and can tell that the video was watched. We use YouTube's privacy-enhanced player (youtube-nocookie.com), which stores nothing in your browser for personalized advertising unless you play the video. YouTube never receives your name, email address, answers or score, and we do not receive anything from YouTube about who watched. Watching is optional: everything the video says is also written on the same page.

We do not sell your information. We do not rent or lease it.

How long we keep it

We keep your personal information for 12 months after the end of the college admissions cycle you took CERT for. A cycle ends on 31 August of the year you would enter college: if you took CERT to enter college in 2027, we keep your personal information until 31 August 2028. During that time you can return to your results, and we can give you and our team insights and performance analytics.

After that, we remove everything that identifies you — your name, email address, mobile number, school, and your parent or guardian's email address — and keep your test results only in anonymized form. Anonymized results are kept indefinitely, to improve the assessment and its statistics; they can no longer be connected to you.

You may ask us to delete your account and results earlier, at any time.

Your rights

Under the Philippine Data Privacy Act you may ask us to show you what we hold about you, correct anything wrong, delete it, or stop using it for marketing. Write to reviewmasters@upcatreview.com.

Cookies

We use a small number of first-party cookies: one to keep you signed in, and one to remember which campaign brought you to us. Neither is used to build a profile of you.

Two third-party tools also set cookies of their own: Google Analytics, to tell visits apart; and Meta's pixel, on public pages before you sign in and, for adults who agreed to marketing, after sign-in. No analytics script runs at all while you are inside a timed section of the test.

The instructions video sets nothing until you press play. It is loaded from youtube-nocookie.com, and while the page shows only the still picture, no request reaches YouTube at all. If you play it, YouTube may store information in your browser to run the player; in that mode it does not store information for personalized advertising.

Changes

We will post any new version here with a new version number. Your recorded consent always names the version you actually agreed to.

• 1.3.0 (19 October 2026) — discloses YouTube as the host of the instructions video on the assessment start page: what it receives, that nothing reaches it until you press play, and that it is not switched off for under-18 accounts because it is part of the test rather than advertising. Nothing else changed.
• 1.2.0 (22 September 2026) — names Reviewmasters Inc. as the controller, with its Quezon City address; describes the Review Masters branches that receive the details of students who agreed to be contacted, and what a student under 18 agrees to on their own; sets the retention period. Nothing else changed.
• 1.1.0 (11 September 2026) — describes Meta's pixel on public pages before sign-in, and the analytics cookies. Nothing else changed.
• 1.0.0 (10 September 2026) — first interim notice.