ConsTrack Privacy Policy

A product of Suturalysis IT Solutions

Version: 2026-10-21
Published: 21 October 2026
Effective date: 21 October 2026
Operator: Mark Angelo Leynes, using the unregistered brand Suturalysis IT Solutions
Country: Philippines
Business mailing address: Banaba, Padre Garcia, Batangas 4224, Philippines
Privacy contact email: suturalysis.admin@gmail.com

This Privacy Policy explains how the individual operator identified above, using the unregistered brand Suturalysis IT Solutions, processes personal information in connection with ConsTrack. It covers visitors, account holders, people named in business records, and people who contact support. It applies to ConsTrack rather than automatically covering other products we may offer.

Suturalysis IT Solutions is currently an unregistered brand, not a separate legal entity. The individual operator is responsible for the processing described below.

1 Who is responsible for information

The individual operator determines how ConsTrack account administration, service security, subscription administration and our own support operations work. For these purposes, we act as the organization responsible for processing, often called a personal information controller or data controller under applicable law.

A business using ConsTrack generally determines why it collects and uses the worker, customer, supplier and project information it enters. For that business-controlled content, we generally process information on the business’s instructions to provide the service. The legal roles depend on the actual activity and applicable law. A business’s responsibility for its records does not remove our own legal responsibilities.

If your employer, contractor or another business entered your information, that business may be the appropriate first contact about the record. You can also contact us; we will assess our role, verify the request as needed, and coordinate appropriately without disclosing unrelated people’s information.

2 Information we process

Account and identity information includes your name, email address, authentication identifiers, verification status, optional contact number, and business or job-title details you provide. When you use Google sign-in, we receive identity information authorized through that sign-in flow, such as your account identifier, name, email and profile information. Authentication credentials are handled through the authentication provider; application administration screens do not display your password.

Business and construction records may include company details, project addresses and schedules, work reports, approvals, quantities, inventory, supplier and customer contacts, expenses, receipts, billing records, worker details, attendance or payroll figures, and files or photographs you choose to upload. Such records can contain personal or confidential information about people other than the account holder. Images may contain embedded metadata or information visible in the image itself.

Access and administration records include invitations, business and project membership, permissions, subscription allowances, consent or acknowledgment records, account status, and records of administrative changes. Subscription records may include plan, fee, renewal dates, payment references and payment-verification notes.

Online platform billing records include invoice descriptions, business identifiers, amounts, due dates, receipt and refund entries, payment references and recorded dates. Monthly usage snapshots may include stored-file totals, project counts, AI-credit totals and manually entered provider costs. Administrative histories may record the acting account, changes, versions and timestamps to support accountability and billing disputes. These platform records are restricted to authorized website-owner access; ordinary business membership does not grant access to the platform ledger.

Support information includes the request subject, category, priority, description, replies, screenshots, requester details, related business and subscription information, status and read indicators. Technical and connection information may include IP addresses, browser or device information, sign-in events, request times, errors and performance measurements processed by us or our service providers.

We collect information directly from you, from authorized business users who enter records about you, from your selected sign-in provider, and from the operation of the service. We do not require payment-card security codes, account passwords or unrelated sensitive documents in construction records or support requests.

3 Why we use information

We use account and identity information to create accounts, verify email addresses, authenticate sign-ins and manage workspace access. We use business records to store, display, update, synchronize and export the features your business chooses to use. Permissions and administration records help enforce access, preserve accountability and investigate disputed or unauthorized changes.

We use subscription and billing records to administer purchased entitlements, verify payment information, respond to billing questions and meet applicable accounting obligations. Support information allows us to investigate issues, respond to you and keep a history of the request. Technical information helps maintain availability, prevent abuse, diagnose failures and improve the service.

We may send necessary account, security, billing and service messages. Optional promotional messages require the choice or other lawful basis applicable to those messages, and are separate from access to the core service. You may withdraw optional marketing consent without canceling essential service communications.

Where a law requires us to identify a lawful basis, the basis depends on the purpose and information involved. It may include performing our agreement, following a business customer’s lawful instructions, complying with a legal obligation, consent where required, or a legitimate interest such as protecting the service where that basis is legally available and does not override protected rights. Information requiring additional protection must have the additional authorization or basis the applicable law requires.

4 Who can see records inside ConsTrack

Business records are available to people who have the relevant active business or project permissions. Business administrators manage team access, and an authorized person may download or share a copy outside the service. The permissions on that later copy depend on the person or system handling it.

Support requests are private to the person who submitted the request and authorized website-owner support access. Replies and screenshots follow the same restriction. Coworkers and business administrators cannot open another person’s support request merely because they work for the same business. Technical service providers may process support information on our behalf to operate the service.

Website-owner administrative access covers functions such as business relationships, account directories, subscriptions and support. Website-owner status does not by itself grant routine application access to a business’s construction project records. Authorized technical access may be necessary to operate the infrastructure, respond to a verified support or security issue, or comply with law, subject to appropriate restrictions.

We do not make private project files or support screenshots publicly browsable as a default. A person who lawfully downloads a file can create a separate copy, and no application permission can prevent that person from disclosing a copy outside the system.

5 Service providers and other disclosures

Supabase provides authentication, database, file storage and Realtime infrastructure. Cloudflare provides production hosting, delivery, security and Web Analytics. Google processes information when you choose Google sign-in. These providers receive information necessary for the services they provide and may also process certain information under their own privacy notices and legal obligations.

We currently maintain subscription, invoice, receipt, refund and monthly usage records online within ConsTrack. Recording a receipt or refund is bookkeeping and does not itself transfer money or process payment credentials. PayMongo is the intended provider for future online checkout. If that checkout is enabled, we will identify the provider and the information exchanged before you authorize payment. Payment credentials entered into a provider-hosted checkout are processed by that provider; a reference to future checkout is not a claim that the current application already collects card details.

Live external AI is currently disabled on the production deployment. If we introduce a feature that sends information to an external AI provider, we will explain the relevant provider, purposes and information involved before that processing begins, and obtain any consent required by law. Existing calculations or rule-based assistance should not be assumed to be external AI processing.

We may also disclose information when necessary to comply with a binding legal obligation, protect people or the service, investigate fraud or abuse, or establish, exercise or defend legal claims. We assess the scope and legitimacy of such requests and disclose only information appropriate to the situation. If the business or service is transferred, personal information may be included subject to applicable law, confidentiality safeguards and notice where required.

We do not sell personal information or use it for advertising across unrelated websites. Using ConsTrack does not automatically authorize unrelated use of your construction or support content by another Suturalysis IT Solutions product.

If you choose to contact us through Gmail, WhatsApp or Viber, your message and contact details are processed through that service as well as by us. Those services apply their own terms and privacy practices. External messages do not automatically become private in-app support tickets. You can contact support at suturalysis.admin@gmail.com or on WhatsApp/Viber at +63 992 696 4362.

6 Browser storage analytics and device features

ConsTrack uses browser storage to maintain sign-in sessions, application preferences, local workspace copies and demonstration records. Some historical or administrative features may store records locally in your browser. Current platform invoice/payment records and monthly usage snapshots are stored online. Older browser records may remain on the device after an explicit import; importing does not automatically erase the originals. Local copies, exports and server records require separate handling. Clearing browser storage can remove those local copies and sign you out; it does not necessarily erase server records or cancel a subscription. Use caution on a shared device and sign out when finished.

Production Web Analytics uses Cloudflare’s privacy-focused analytics service to measure visits and performance. Cloudflare states that this analytics service does not use cookies or similar tracking techniques to follow individuals. Hosting and security services may separately process connection information to deliver and protect the website. This distinction does not mean that no provider ever receives an IP address.

We do not currently use advertising cookies in the production app. If we add a different analytics or advertising technology that requires consent, we will explain it and provide any choice the law requires before it is used. Your browser may provide controls for cookies, storage and tracking, although disabling required storage can affect sign-in and local features.

Camera or file access occurs when you choose to attach an image and your device grants the relevant permission. ConsTrack does not request your device location for routine operation. A project address you type, or location information already embedded in an uploaded image, is different from a device-location permission. Remove information from attachments that is not needed for your request or business record.

7 Storage locations and international processing

ConsTrack is operated from the Philippines and serves users in different countries. Our infrastructure providers and authorized service operations may process information outside your country, including where their hosting, support or security systems operate. We do not promise that information stays in your country solely because you use a local currency or enter a local address.

Where applicable law requires a safeguard or agreement for an international transfer, we must use an appropriate legal mechanism for that transfer and provide the information required by that law. Contact the privacy contact listed below to ask about the locations and safeguards relevant to your information.

8 How long information is kept

We determine retention by the purpose of the record, whether the account or business relationship continues, the customer’s lawful instructions, applicable legal and accounting obligations, security needs, limitation periods and any unresolved dispute. We do not set a universal deletion period for every record or claim that closing an account instantly removes all information.

Account and workspace records are generally needed while the service relationship continues, with limited information retained afterward where justified for security, legal or dispute purposes. Business content follows the business’s lawful retention requirements and closure or deletion instructions, subject to our own obligations. Invoice/payment entries and usage-change histories are designed to preserve administrative accountability rather than allow unrestricted editing or deletion in the dashboard. This design does not override applicable correction, deletion or other privacy rights; contact us for assessment of a request. Billing and consent records may need to remain for the period required to document transactions, authorizations and legal compliance. Support history is retained as needed to resolve the issue, document its handling and address related disputes or security concerns.

Backups and recovery copies are handled separately from active records. A deletion from the live service may not immediately remove a backup copy. Any retained copy must remain protected and must not be used as a reason to restore deleted information for unrelated purposes. Local browser copies and exports held by business users are also separate from server records.

Ask us for the retention criteria applicable to your information and available deletion options.

9 Security

We use measures intended to protect information, including encrypted website connections, authenticated access, database authorization, private file storage and restrictions on administrative functions. Access depends on verified identities and the permissions relevant to the record. We also use safeguards against common browser attacks and abusive requests.

No service can guarantee absolute security. Protect your device and credentials, grant business permissions carefully, and avoid sharing exports with unauthorized recipients. Report suspected unauthorized access through support or the privacy contact. Where a personal data breach triggers notice obligations, we will assess and provide the notifications required by applicable law.

10 Your privacy choices and rights

Depending on applicable law and the circumstances, you may have rights to be informed about processing, access information, correct inaccuracies, request deletion or restriction, object to certain processing, obtain a portable copy, withdraw consent, and complain to a competent regulator. Withdrawing consent does not make earlier lawful processing unlawful, and does not prevent processing supported by a different lawful basis where permitted.

To make a request, contact the privacy contact below and describe the information or processing concerned. We may ask for proportionate information to confirm your identity or authority. Do not send unnecessary identity documents in a general support screenshot. We will respond within the time required by applicable law and explain a refusal or limitation where appropriate.

A request does not automatically authorize disclosure of another person’s information, deletion of records a business must lawfully retain, or release of confidential material without review. For business-controlled records, we may need to coordinate with the responsible business while respecting your independent rights.

In the Philippines, you may raise a privacy concern with the National Privacy Commission. Complaint information is available at https://privacy.gov.ph. People in other countries may also have the right to contact their local supervisory authority. You do not have to give up a regulatory complaint right by contacting us first.

11 Children and automated decisions

ConsTrack is designed for business use and is not directed at children. Accounts must be controlled by adults authorized to act for the business. A business entering information about a younger worker or another minor must have the authority and safeguards required by applicable law. Contact us if you believe information about a child has been collected improperly.

ConsTrack may calculate totals, display progress indicators, enforce access or plan limits, and provide forecasts. The service itself does not make employment, credit or legal-eligibility decisions about individuals. Businesses remain responsible for decisions they make using their records and for any additional notice or review rights the law requires.

12 Changes and contact

We will display an effective date and update this policy when our practices change. We will provide appropriate notice of material changes and request fresh consent where the law requires it. A new product, payment provider or data-use purpose does not automatically inherit permission merely because it appears in a later policy.

Individual operator: Mark Angelo Leynes
Brand: Suturalysis IT Solutions (currently unregistered)
Product: ConsTrack
Country: Philippines
Business mailing address: Banaba, Padre Garcia, Batangas 4224, Philippines
Privacy contact email: suturalysis.admin@gmail.com