Privacy Policy

This Privacy Policy explains how the eMunicipal system, an academic demonstration project for Biringan City, collects, uses, and handles information that users provide while using the platform. Because this is a fictional demonstration system, no information entered here is used for any real government purpose, and no real municipal services are delivered.

By creating an account or submitting a document request through this system, you acknowledge that you are using an academic demonstration and that this Privacy Policy applies to your use.

---

1. Information We Collect

When you use eMunicipal, the following categories of information may be collected:

• Registration information: First name, last name, email address, contact number, and home address. These are required to create an account.
• Request information: Purpose of request, document type selected, number of copies requested, and any additional fields required for a specific document type.
• Uploaded files: Supporting documents you attach to a request, accepted as PDF, JPEG, or PNG files up to 5 MB each.
• Account activity: Login events, request status changes, profile updates, and other actions you perform within the system, which are recorded in an audit log.
• Session data: A session cookie is used to keep you logged in while you use the system. This cookie is not used for tracking across other websites.
• Email logs: When the system sends you an email notification, the recipient address, notification type, and send status are logged. Email delivery uses the Mailtrap service, which is configured for demonstration and development environments only.

---

2. How We Use Your Information

The information collected within this academic demonstration system is used solely to:

• Create and authenticate your account.
• Process and track the document requests you submit.
• Send you email notifications about the status of your requests, where email is configured.
• Allow authorized staff and administrators to review and act on your requests.
• Maintain an audit trail of significant system actions for demonstration purposes.

Because this is a demonstration project, your information is not shared with any real government agency, third-party service provider for production use, marketing platform, or external database. No real government document processing occurs.

---

3. Access to Your Information

Within this system, access to your information is controlled by role:

• Residents can view and manage only their own account information and their own submitted requests.
• Staff members can view the details of all submitted requests, including the Resident's contact information and uploaded files, in order to process requests.
• Administrators can access user account records, all requests, audit logs, and system settings.

All access is enforced by the system's role-based access control, and unauthorized access attempts are rejected.

---

4. Data Storage and Retention

All data entered into this system is stored in the MySQL/MariaDB database configured for this academic demonstration. Uploaded files are stored on the server in a directory that is not directly accessible from the web.

Because this is an academic project, no formal data-retention schedule is enforced. Accounts that have associated requests cannot be deleted through the application interface; they can only be deactivated. This preserves the integrity of historical request records.

Data may be cleared or reset when the demonstration environment is restarted or reconfigured by the project administrator.

---

5. Cookies and Session Data

eMunicipal uses a single server-side PHP session cookie named EMUSESSID to maintain your authenticated session. This cookie:

• Is set when you log in and expires when you close your browser or log out.
• Is marked HttpOnly, so it cannot be accessed by client-side scripts.
• Is set with SameSite=Lax to help protect against cross-site request forgery.
• Does not track your activity across other websites.

No analytics cookies, advertising cookies, or third-party tracking cookies are used by this system.

---

6. Security Measures

This demonstration system implements several standard security practices, including:

• Passwords are hashed using PHP's password_hash() function and are never stored in plain text.
• All database queries use PDO prepared statements to prevent SQL injection.
• CSRF tokens are validated on all form submissions.
• Uploaded files are validated for MIME type and size, stored outside the web root, and renamed to prevent path traversal.
• HTTP security headers are set on all responses.

While reasonable precautions are in place for a demonstration project, this system should not be used to store real personal identification documents, sensitive government records, or any confidential information.

---

7. Privacy Questions

Because this is an academic demonstration, there is no formal data protection officer. If you have questions about how information is handled within this system, you may use the contact form on the homepage to reach the project team.

Requests to review or remove demonstration data should also be directed through the same contact form.