Summary
- We collect what we need to run ConstaSite: your account, what you enter, how the service is used, and your purchases (through Stripe).
- We do not sell personal information, show advertising, or use tracking cookies. The app uses only the cookies it needs to keep you signed in and secure.
- A short list of providers helps us run the service: Microsoft Azure, Azure Communication Services, Auth0, Stripe, Google Maps and OpenFreeMap.
- You can ask for a copy of your information, an export, a correction, or deletion.
- ConstaSite is a business service for people aged 18 and over.
1. Who we are and what this covers
ConstaCore Technologies, Houston, Texas (“we”, “us”), runs ConstaSite and is responsible for the personal information described here. This policy covers ConstaSite (the app), its sign-in pages and the emails it sends. Our public website sets no cookies and has no analytics or advertising trackers.
The public data ConstaSite shows (census figures, agency projections, public project lists and the like) describes places, not you; this policy is about information about the people who use ConstaSite.
2. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account | name, email address, sign-in identifiers, whether your email is verified, two-step verification settings (we never see your password) | you, through our sign-in provider Auth0 |
| Workspace | workspace name, members, roles, invitations, the version of the terms each member accepted | you and your workspace’s admins |
| What you enter and create | addresses, areas, search criteria, saved sites, notes, reports | you |
| Usage and device | features used, site checks and searches run, times, IP address, browser and device type, error and performance diagnostics, security events such as sign-ins | your use of the app |
| Purchases | what you bought, amounts, tax, billing status, billing country and postal code (Stripe holds your card details; we never see them) | Stripe |
| Map requests | the map area, Street View location and map images your browser asks for, with your IP address | your browser, sent directly to Google (or, for the fallback map, OpenFreeMap) |
| Messages | what you write when you email us, and records of the emails ConstaSite sends you (delivery, bounce, unsubscribe) | you; our email provider |
We do not ask for sensitive information such as government ID numbers, health or financial account details, and we ask you not to enter it.
3. Why we use it
- To provide ConstaSite: run your checks, searches and reports, save your work, show maps.
- To run your account and workspace: sign-in, invitations, roles, plans and credits.
- To keep the service secure: detect fraud and abuse, enforce limits, investigate incidents, keep audit records.
- To communicate: service and security emails, receipts (from Stripe), answers to your requests. Account and security emails cannot be turned off while you have an account; others have an unsubscribe link.
- To improve ConstaSite: understand which features are used, using counts that do not identify you.
- To meet legal duties: tax, accounting and lawful requests.
We do not use your information for advertising or to build data products, and we do not sell the searches or reports you create.
4. Who we share it with
We share personal information only with these providers, and only what each needs to do its job for us. Each processes it under a contract with us, except where noted.
| Provider | What it does for us | Data involved | Where |
|---|---|---|---|
| Microsoft Azure | hosting, databases, storage, backups, monitoring and diagnostics; address lookup (Azure Maps) | everything in section 2 that we hold | United States |
| Azure Communication Services (Microsoft) | sending ConstaSite’s emails | email address, the message, delivery events | United States |
| Auth0 (Okta) | sign-in, password and email verification, sign-in security | account and sign-in data | United States |
| Stripe | checkout, payments, tax, receipts, invoices, billing portal | purchase data, card details (held by Stripe) | United States and where Stripe operates |
| Google Maps Platform | the live map, Street View and map images | the map requests in section 2, which your browser sends directly to Google | Google’s data centres |
| OpenFreeMap | map tiles for the fallback map | the map tiles your browser requests, with your IP address | its servers |
Stripe collects payment information under its own Privacy Policy, and where Stripe sells to you as seller of record (see the Terms of Use, section 4.2), it does so as an independent business. Google receives map requests under the Google Privacy Policy. We do not send your name or email address to Google or OpenFreeMap.
We may also disclose information when the law requires it, to protect people’s safety or our rights, or as part of a merger, acquisition or sale of the business, in which case this policy continues to apply to it.
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
5. Cookies and browser storage
The app uses only strictly necessary cookies: a session cookie that keeps you signed in, a security cookie that protects your requests against forgery, and short-lived cookies used while you sign in or enter a two-step code. They end when you sign out or they expire. Our sign-in provider sets the cookies it needs on its own sign-in pages, and the map your browser loads from Google is covered by Google’s privacy policy (section 4). We use no analytics, advertising or cross-site tracking cookies. The app keeps display preferences (such as light or dark theme) in your browser’s own storage; they stay on your device.
6. How long we keep it
| What | How long |
|---|---|
| Account, workspace and your content | while the workspace is open; deleted within 90 days after it is closed (section 13.4 of the Terms of Use) |
| Backups | deleted data leaves our backups within 35 days |
| Diagnostic and security logs | generally up to 90 days |
| Audit records of account and workspace actions | 400 days, then an archive that holds identifiers and amounts only, anonymised when a workspace is deleted |
| Purchase, payment and tax records | 7 years, as tax and accounting law requires |
| Support emails | up to 2 years after the conversation ends |
| Email suppression list (bounced or unsubscribed addresses) | while it is needed to honour the bounce or unsubscribe |
7. Your rights
You can ask us to:
- tell you what personal information we hold about you and give you a copy;
- give it to you in a portable format;
- correct it; or
- delete it.
Email hello@constacore.com from the address on your account. We will confirm your request, may need to verify your identity, and will answer within 45 days (we will tell you if we need up to 45 more, and why). You may use an authorised agent. We will not treat you differently for using these rights. If we decline a request, you can appeal by replying to our answer; we will answer the appeal within 60 days, and if you are still not satisfied you may contact your state’s attorney general (in Texas, the Office of the Attorney General).
We honour the rights given by applicable US state privacy laws, including the Texas Data Privacy and Security Act. If you are in the European Economic Area or the United Kingdom, you also have the rights given by the GDPR, including to object and to complain to your data protection authority; we rely on our contract with you, our legitimate interest in running a secure service, and legal duties as the bases for the processing in section 3. Information in a workspace (for example a note naming someone) is controlled by the workspace’s organization. If you are a member, some requests, such as deleting your membership, go to your workspace admins; we will help them answer.
8. Security
Data is encrypted in transit and at rest. Access to production systems is limited to the people who need it and protected by strong authentication; secrets are kept in a managed key vault; every account can turn on two-step verification, and we may require it for owners and billing admins. No system is perfectly secure. If a breach affects your personal information, we will tell you and the authorities as the law requires.
9. Where your data is
ConstaSite stores your information in the United States. If you use it from elsewhere, your information is transferred to the United States.
10. Children
ConstaSite is for business use by people aged 18 and over. We do not knowingly collect information from anyone under 18; if you believe we have, contact us and we will delete it.
11. Changes
We may update this policy. Each version has a version string and an effective date at the top. For a material change, we will tell account holders by email or in the app at least 30 days before it takes effect.
12. Contact
Privacy questions and requests: hello@constacore.com. ConstaCore Technologies, Houston, Texas, United States.
Note for workspace admins: processing your organization’s data
When your organization uses ConstaSite, it decides who joins its workspace and what they enter. For the personal information in your workspace (your members’ accounts and anything they enter about other people), your organization is the controller (the “business” under US state laws) and we act as your processor (or “service provider”): we process it only to provide ConstaSite to you, on your instructions as set by the Terms of Use and this policy, and not for our own purposes beyond running, securing and improving the service as section 3 describes.
- Our commitments. Confidentiality of everyone who handles it; the security measures in section 8; help with your people’s rights requests; notice to you without undue delay of a breach affecting your workspace; deletion at the end of the service as section 6 says; and the information you need to show your own compliance.
- Sub-processors. The providers in section 4 are our sub-processors. We will list a new one on this page at least 30 days before it starts processing your workspace’s data; you may object by writing to us, and if we cannot address the objection you may close your workspace with a pro-rated refund of the unused part of any prepaid period.
- A signed agreement. If your organization needs a signed data processing agreement (for example with the EU Standard Contractual Clauses), write to hello@constacore.com.