Privacy Notice
This notice explains what information the CLSU Virtual Tour collects, why we collect it, and what rights you have over it under the Data Privacy Act of 2012 (Republic Act No. 10173).
Last updated:
1. Who we are
The CLSU Virtual Tour is an academic capstone project developed by BS Information Technology students of Central Luzon State University, Science City of Muñoz, Nueva Ecija. It exists to let students, visitors, and stakeholders explore the CLSU campus remotely.
2. What we collect
We deliberately collect as little as possible. In full, that is:
| Information | When it is collected | Why |
|---|---|---|
| Your name | When you fill in the welcome form, which is asked before you can use the tour | To record who has visited the tour |
| Your visitor type (student, faculty, guest, etc.) | In the same welcome form | To report what kinds of people use the tour |
| Questions you type into the chatbot, and the replies | Each time you send a chatbot message | To answer you, and to see which topics are asked about most |
| Which locations you viewed, and when | Automatically as you move through the tour | To produce visit statistics for the project evaluation |
| A problem report: the category you pick, what you write in the box, and an email address only if you choose to give one | Only if you use the “Report a problem” button on a tour | So a moderator can look into the problem, and reply to you if you asked to be told the outcome |
| With a problem report only: your browser and device description, and a scrambled one-way code standing in for your network address | Only when a problem report is submitted | To reproduce a display fault on the same kind of device, and to spot a flood of junk reports coming from one source. The code cannot be turned back into an address, so it never tells us who you are |
What we do not collect. We never store your network (IP) address in a readable form, your contact number, your physical location, or any government or student identification number. We do not ask for an email address anywhere except the optional box on a problem report. We do not use advertising or tracking cookies, we do not profile you, and we do not make automated decisions about you.
3. The welcome form, and why it is asked first
Before the tour can be used, you are asked for your name and what kind of visitor you are, and asked to tick a box agreeing to this notice. It is a single short form and it is asked once. Nothing is stored until you tick that box, so your consent is given before any of it is recorded — which is why this page can be read, as you are reading it now, without having filled the form in.
We ask because a count of visitors is one of the things this project is graded on, and a form people could click past would produce a visitor list that was not the visitor list. If you would rather not take part, the honest option is to close the page rather than to enter a name that is not yours.
Repeat visits are merged. We store a scrambled code made from your name and visitor type so that registering twice does not count you twice. It means our figures describe people rather than page loads.
4. The chatbot sends your questions to Google
The tour's AI assistant is powered by the Google Gemini API. When you send a message, the text of that message is transmitted to Google's servers outside the Philippines so a reply can be generated. Your name is never sent with it, and Google's handling of that data is governed by their own privacy policy.
Please do not type sensitive personal information into the chatbot — such as passwords, identification numbers, health information, or financial details. It is a campus wayfinding assistant and never needs them.
5. How long we keep it
- Chatbot messages — the text of your questions and answers is erased automatically after 90 days. A record that a conversation happened is kept, without its content, for statistics.
- Names and visitor types — kept for the duration of the project's academic evaluation, then deleted along with the project database.
- Visit statistics — timestamps and location views are kept for the duration of the academic evaluation.
- Problem reports — kept for the duration of the academic evaluation. A report is marked resolved or dismissed rather than deleted, so that the record of what was raised and what was done about it stays complete. If you gave an email address and would like it removed once the matter is closed, ask us and we will clear it from the report.
6. How it is protected
Information is stored in a database that is not publicly accessible. The administrative panel is unlisted, password-protected with hashed credentials, and locks out a device after repeated failed sign-in attempts. All database access uses prepared statements, and all content shown on the site is escaped before display. Staff accounts see only the pages their role allows, and the visitor records page is granted deliberately, account by account, rather than to every administrator.
7. Cookies and local storage
We use two cookies. Both are strictly necessary, and neither is used for advertising.
- The session cookie — keeps your browsing session together while you use the site. It disappears when you close your browser.
-
clsu_visitor_registered— remembers that you have already filled in the welcome form, so you are not asked again on every visit. It holds nothing but a yes, and it lasts 180 days. Clearing your browser's site data removes it, and you will simply be asked once more.
We also use your browser's local storage to remember small preferences: which tours you have liked, whether you prefer dark mode, whether you have already seen the “Getting around” instructions, and whether you have dismissed the survey invitation. None of this leaves your browser, and none of it is sent to us.
8. Your rights
Under the Data Privacy Act of 2012 you have the right to be informed, to access your information, to correct it, to object to its processing, to have it erased or blocked, to data portability, and to be indemnified for damages. To exercise any of these, contact us using the details below and tell us the name you entered so we can find your record.
9. Contact
For any question or request about this notice, or about the personal information held by this project, please reach the project team through the About page, or contact the Central Luzon State University Data Protection Officer through the University's official channels.
This project is an academic system operated by students under faculty supervision. This notice describes the practices of the CLSU Virtual Tour only, and not those of Central Luzon State University as a whole.
