Privacy Policy

FlowWorks Systems operates from Cebu City, Philippines, serving clients locally and internationally. We are the developer and operator of Asset FLOW (property operations platform) and OAS (Ocular Asset Surveyor). For any privacy concern, question, or request, contact our Data Protection Officer at privacy@flowworkssystems.com.

Personal data you provide:

• Account information: name, email address, phone number, role, and the client workspace you belong to.
• Contact form submissions: name, company, email, phone, and your message.
• Property data entered by your property manager: unit assignments, tenant names and contact details, and asset records (brand, model, serial numbers, location within the property).
• Service records: job requests and work orders, photos and notes attached to jobs, quotes and invoices, and water delivery orders.

Automatically collected:

• Sign-in events, access and audit log entries (who did what and when), device/browser information, and IP addresses where available.
• Pages visited and features used, in aggregated, de-identified form.

We do NOT collect:

• Sensitive personal data (health, religion, biometrics) — the Service has no fields for it.
• Payment card details — payments are processed by our payment provider under its own privacy terms.

• To respond to inquiries and provide support.
• To operate the Service: route job requests, dispatch technicians, track asset health, and manage quotes, invoices, and deliveries.
• To communicate with you: service updates, account invitations and password resets, SLA alerts, and invoice delivery.
• To keep the Service secure and improve it: role-based access control, audit logging, abuse prevention, and de-identified usage analysis.
• To comply with legal obligations under Philippine and applicable US laws.

Legal bases: consent, contract performance, legitimate interests, and legal compliance.

Philippines (RA 10173):

• Your data stays within our authorized systems; we do NOT sell or rent personal data.
• Shared only with: service providers bound by confidentiality (hosting, email, payments), assigned contractors performing the work, and legal authorities where required by law.
• Cross-border transfers (if any) only with appropriate safeguards.

United States (CCPA/CPRA):

• The right to know what personal data is collected and request deletion.
• The right to opt out of sale — we do not sell personal data, so no opt-out is needed.
• Non-discrimination for exercising these rights.
• No profiling or automated decision-making without human review.

Access within the platform is role-based and least-privilege: tenants see only their own units and requests; contractors see only assigned jobs; property staff see data scoped to the workspace they manage. FlowWorks system administrators access data only for support, maintenance, or security, and such access is recorded in the audit log.

• Encryption in transit (TLS/HTTPS) and restricted, role-based access enforced at the database level.
• Immutable audit logging of privileged actions and one-time-password confirmation for destructive operations.
• Regular security reviews and updates.
• Breach notification: affected users and the National Privacy Commission (and applicable US authorities) are notified within 72 hours of confirmed discovery of a personal data breach.

Under the Philippine Data Privacy Act (RA 10173):

• Right to be informed, and to access and correct your data;
• Right to erasure or blocking of data that is no longer needed or was unlawfully processed (subject to legal retention);
• Right to data portability — a machine-readable copy of your data;
• Right to withdraw consent and object to processing based on legitimate interests;
• Right to file a complaint with the National Privacy Commission (https://npc.gov.ph).

Under the California Consumer Privacy Act (CCPA):

• Right to know what personal data is collected and how it is used;
• Right to request deletion;
• Right to opt out of sale — we do not sell personal data;
• Right to non-discrimination for exercising these rights (California AG: https://oag.ca.gov/privacy).

To exercise any right, email privacy@flowworkssystems.com. We respond within thirty (30) days.

• Contact/inquiry data: retained for 3 years, then deleted.
• Client account data: retained while the account is active, plus 5 years post-termination (financial and dispute records).
• System and audit logs: retained for 90 days, then anonymized (privileged-action audit entries may be retained longer where required for security and legal compliance).
• Invoices and financial records: retained as mandated by Philippine tax and accounting rules (typically up to 10 years).

The Service is intended for property management use and is not directed at children under 13. We do not knowingly collect their personal information.

We may update this policy as the Service evolves. Material changes will be announced in-app, by email, or by site notice before they take effect. The "Last updated" date above always reflects the current version; continued use after changes take effect constitutes acceptance.

• Data Protection Officer: Rhex Jun Villahermosa
• Email: privacy@flowworkssystems.com
• Address: Cebu City, Philippines
• National Privacy Commission (PH): https://npc.gov.ph
• California Attorney General (US): https://oag.ca.gov/privacy

General support: support@flowworkssystems.com.