Privacy Policy

1. Who we are

ConstructoVista is operated by NupaStack, a venture of the ADNK Group of Companies, based in Sri Lanka. This policy explains what data we collect, why we collect it, and the choices you have. The short version: your data belongs to your company, we only use it to run the service, and we never sell it.

2. What we collect

• Account information — your name, email address, and company name when you register.
• Sign-in data — if you sign in with Google or Facebook, we receive your name, email address, and profile picture from that provider. We never see your Google or Facebook password.
• Business data you enter — projects, quotations, rate libraries, materials, tools, invoices, and workforce records including employee names, roles, pay rates, attendance, advances, and payroll figures.
• Technical data — basic logs (such as IP address and browser type) needed to keep the service secure and diagnose problems.

We do not collect payment card details during the free pilot — there is nothing to pay.

3. How we use your data

• To provide the service: dashboards, profitability calculations, payroll, quotations, and invoices.
• To send transactional emails (such as sign-in, invitations, and invoice emails). These are delivered via Resend, our email service provider.
• To keep the service secure and fix bugs.
• To contact you about the pilot — feedback requests and important service updates.

We do not sell your data, share it with advertisers, or use your business data for anything other than providing and improving ConstructoVista.

4. Who your data belongs to

Data entered into a company workspace belongs to that company. If you are an employee whose details were entered by your employer, your employer is responsible for that data; we process it on their behalf. Members of the same company workspace can see the data in that workspace according to their assigned roles. Data from one company is never visible to another company.

5. Where your data lives and how it is protected

• Your data is stored in a managed cloud database, isolated per company.
• Connections to the service are encrypted in transit (HTTPS).
• Passwords are stored hashed — we cannot read them.
• Access to production data is restricted to the small NupaStack team, and only for operating and supporting the service.

No system is perfectly secure. If we become aware of a breach affecting your data, we will inform you without undue delay.

6. Third-party services

We rely on a small number of service providers to run ConstructoVista:

• Resend — sends our transactional emails (they process recipient email addresses and message content).
• Google / Facebook — optional sign-in providers, only if you choose to use them.
• Cloud hosting and database providers — host the application and store data on our behalf.

These providers act on our instructions and are not permitted to use your data for their own purposes.

7. Your choices: export and deletion

• Export — email us at any time and we will provide a full export of your company's data.
• Deletion — email us to delete your account and your company's data. We will confirm and complete the deletion within a reasonable period, except for minimal records we may need to keep for legal reasons.
• Correction — most data can be edited directly in the app; contact us if you need help.

We retain your data for as long as your account is active. If the pilot ends, we will give you the opportunity to export your data before it is removed.

8. Cookies

We use only the cookies needed to keep you signed in and keep the service secure. We do not use advertising or cross-site tracking cookies.

9. Changes to this policy

We may update this policy from time to time — in particular when paid plans launch. When we make material changes we will notify you by email or inside the application.

10. Governing law and contact

This policy is governed by the laws of Sri Lanka. For privacy questions, export requests, or deletion requests, contact pmadnkulathunga@gmail.com.