Legal policy - Version 2026-10-16

Privacy Policy

# Privacy policy draft HOLISTICCORE Information Technology Services processes account details, project briefs, uploaded references, payment evidence, generated artifacts, service communications, audit events, and technical logs to provide and secure the service. ## Contact Privacy questions and deletion requests: Support in Help & Messages ## Purposes - create and secure accounts; - generate, preview, customize, and deliver projects; - verify payments and provide support; - prevent abuse and investigate incidents; - comply with legal and accounting obligations. ## Sharing Data may be processed by contracted hosting, storage, email, monitoring, payment, and AI providers only as needed to operate the service. Project text sent to an AI provider must not contain secrets or unnecessary personal data. ## Retention Temporary previews should expire automatically. Abandoned projects and uploads should follow the documented retention schedule. Payment and contractual records may be retained for legal and accounting requirements. Backups expire according to the operations policy. ## Security and rights The service uses access controls, encrypted transport, audit logging, backups, and restricted workers. Users may request access, correction, export, or deletion where applicable. Some records may be retained when required by law or to resolve disputes. This draft requires review for compliance with the Philippine Data Privacy Act and the actual providers selected for production. ## First-party usage analytics For signed-in Client accounts, the service records the application page or controller action visited, the visit date, visit count, and first and most recent visit time. This information is used to understand feature adoption, improve navigation, prioritize product work, provide support, and protect service reliability. The analytics do not record form contents, passwords, private messages, uploaded file contents, or URL query strings. Access is restricted to authorized platform administrators. ## Account-device security For Client account protection, the service stores a one-way digest of a random browser device token, the binding time, and limited request metadata (IP address and browser user agent) when a device or email change is submitted. The raw device token remains in an encrypted, HTTP-only browser cookie. Authorized administrators review account change requests; request records are retained for security and audit purposes. ## Account device security records For account security and fraud prevention, the service records the latest authenticated browser and operating-system signature, a masked internal device identifier, the latest IP address, and last-seen time. These records are visible only to authorized Admin users and are not used to store form contents or browsing query parameters. ## First-party visitor analytics The service records successful HTML page visits for guests and signed-in users to understand traffic and feature use. Records include an anonymous random browser identifier for guests, the signed-in account for authenticated users, the user category (Guest, Client, or Admin), the page/controller action, normalized path without query strings, date, count, latest request IP address, and first and latest visit times. Form contents, passwords, private messages, uploads, URL query strings, and security/MFA pages are excluded. Guest identifiers do not contain names, email addresses, or raw IP addresses. Access is restricted to authorized Admin users. ## Guest support connections While the site is open, a support connection lets an administrator offer assistance without requiring registration. The connection uses encrypted, HTTP-only browser cookies and stored one-way token hashes, with a recent connection timestamp. Raw IP addresses are not needed for this connection. Connection records are removed on disconnect; stale records expire from availability after 90 seconds and are pruned after one day when a new connection is established. Guest support messages are stored in the support inbox and remain accessible to the same browser while its cookie is retained. Clearing cookies can remove that access. Support messages are separate from AI conversations and are not automatically sent to AI. ## Independently operated downloaded applications Clients may customize, deploy, transfer, and resell authorized downloads. The independent operator is responsible for personal data collected by their application, including privacy notices, lawful processing, security, and responding to their users. HOLISTICCORE IT does not become the operator or data controller of that application merely by supplying the source code. If HOLISTICCORE IT separately provides hosting, support, or data processing, its actual role and obligations are governed by that arrangement and applicable law. This does not remove HOLISTICCORE IT's responsibilities for information processed by the Builder platform. ## Public design feedback Signed-in users may rate designs, publish comments and replies, and react to designs or comments. Comments and replies display the account's name and posting time; rating averages and reaction counts are public. Reaction lists also show the reacting account name and chosen reaction, but not its email address. Do not post private or sensitive information. You can replace your rating, change or remove your reaction, and delete your comments; deleting a parent comment also removes its replies. Authorized administrators may remove comments for moderation. Account-linked feedback is stored to provide these features and enforce one rating/reaction per account and target.