Privacy Policy

PIES Information Technology Solutions, owned by Joken E. Villanueva, is the personal information controller for data collected through capstoneuml.com. We are based in Binalbagan, Negros Occidental, Philippines.

Registered address: [ to confirm: full registered business address including postal code ]
Data Protection Officer: [ to confirm: name of your Data Protection Officer, which may be yourself ]
Privacy contact: [ to confirm: privacy contact address, e.g. privacy@capstoneuml.com ]

Account information. Your email address, your name, and your profile picture if you sign in with Google. This comes from you or from Google at sign up.

Your diagrams. The entity names, attributes, relationships and labels you enter, plus the generated diagram output. This is your content, and it is stored so you can come back to it.

Usage information. Which diagram types and templates you use, how many diagrams you create, and when you export. We use this to enforce plan limits and to work out which templates to build next.

Billing information. If you subscribe, our payment providers collect your payment details. We receive a customer reference, the plan you are on, and whether the last payment succeeded. We never see or store your full card number.

Technical information. Standard server logs including IP address, browser type and pages requested. These are used for security and debugging.

We do not ask for, and you should not enter, sensitive personal information as defined by the Data Privacy Act. Diagram content is meant to describe a software system, not real people.

Under the Data Privacy Act and the GDPR, our bases are:

• Contract. We need your account details and diagram data to give you the service you signed up for.
• Legitimate interest. We use usage and technical data to keep the service secure, prevent abuse, and decide what to build.
• Legal obligation. We keep billing records for as long as tax and accounting rules require.
• Consent. For optional things such as product update emails. You can withdraw consent at any time.

We do not sell your personal data, and we do not share it for advertising. We use these processors to run the service:

• Clerk for authentication. Receives your email, name and profile picture.
• Neon for the database. Stores your account record and diagrams, hosted in Singapore.
• Vercel for hosting. Processes requests and keeps short-lived server logs.
• PayMongo for payments from the Philippines, and Stripe for international payments. They handle your card and wallet details directly.

Each of these is bound to use your data only to provide their service to us. We may also disclose data where the law requires it, or to protect our rights or someone's safety.

Your account data and diagrams are stored in Singapore, which is the closest region to most of our users. Some processors, including our authentication and payment providers, operate in the United States and Europe, so your data may be transferred and processed there.

Where data leaves the Philippines, we rely on the contractual protections offered by those providers, and we remain accountable for it under the Data Privacy Act.

• Account data: for as long as your account is open.
• Diagrams: until you delete them, or until 90 days after you close your account.
• Exported files: 30 days from generation, then automatically deleted.
• Usage records: up to 24 months, then aggregated so they no longer identify you.
• Billing records: as long as Philippine tax and accounting rules require, normally 10 years.
• Server logs: normally 30 days.

Under the Data Privacy Act, and under the GDPR if you are in the European Economic Area, you have the right to:

• Be informed about how your data is used, which is what this page is for.
• Access a copy of the personal data we hold about you.
• Correct anything that is inaccurate or out of date.
• Erase your data, subject to records we must keep by law.
• Object to processing, or ask us to restrict it.
• Data portability, meaning a copy of your data in a usable format.
• Withdraw consent at any time where consent is the basis we relied on.
• Lodge a complaint with the National Privacy Commission of the Philippines, or your local supervisory authority.

To exercise any of these, email [ to confirm: privacy contact address, e.g. privacy@capstoneuml.com ]. We will respond within 30 days. You can also delete your account yourself from your account settings, which removes your diagrams and personal data on the schedule above.

We use cookies that are necessary for the service to function, mainly to keep you signed in. Without them you would be logged out on every page.

We do not use advertising cookies or third party tracking pixels on capstoneuml.com. If we add product analytics later, we will use a privacy-respecting tool and update this page before we turn it on.

Capstone UML is built for tertiary students and working developers. It is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

Connections to capstoneuml.com are encrypted with TLS. Passwords are handled by our authentication provider and are never stored by us in readable form. Access to the production database is restricted to the people who need it to operate the service.

No system is perfectly secure. If a breach affects your personal data and is likely to put you at risk, we will notify you and the National Privacy Commission as the Data Privacy Act requires.

We will update this page when our practices change. If a change is significant, we will tell you by email or in the app rather than quietly editing the page. The date at the top always reflects the current version.

Privacy questions or requests: [ to confirm: privacy contact address, e.g. privacy@capstoneuml.com ]. For anything else, see our contact page.