Privacy Policy
LAYAW System makes LAYAW Project Manager, software that construction companies use to run their projects: schedules, bills of quantities, materials, purchasing, billing, accounting and payroll. This page explains what information the software keeps, why, where, and what you can do about it. We follow the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).
Who we are
LAYAW System, Philippines. Questions about this policy or your information: layawsystem@gmail.com.
Your company's people, and who is responsible
Your company enters information about its own people and others — employees, clients, suppliers, subcontractors. For that information your company is the personal information controller under the Data Privacy Act: it decides what to enter and why. LAYAW System is a personal information processor: we keep and process it only on your company's behalf and instructions, to run the software for you, and for nothing else. Your company is responsible for having a lawful reason to keep it, for telling those people, and for answering their requests; we help where we can. A person whose information your company entered should write to that company first.
What we keep, and why
- Your company's records — projects, costs, billings, materials, employees, payroll and the rest you enter. They belong to your company. We keep them only to run the software for you.
- Your sign-in — the email address and a password (stored only as a protected hash, never readable), and, if you turn it on, your two-step sign-in. Used to let you in and keep others out, and to send the company's Owner notices about the account itself, such as a reminder before the free trial ends. Never newsletters or advertising.
- One sign-in, one company at a time — a sign-in is active in one company only. A person who moves from one company that uses LAYAW Project Manager to another keeps their sign-in: once the old company removes their access, the new company can add them. We keep which companies a sign-in has belonged to, so this rule can be applied. Each company has its own record of the person and sees only its own. A company that tries to add someone still active elsewhere is told only that, never which company it is.
- A new person's sign-in, by email — when your company gives someone a sign-in, we send that person one email with the app's address, their email and a temporary password that works only once: they choose their own the first time they sign in. The temporary password is not kept anywhere after it is sent.
- Notifications on phones and computers — if a person turns them on, we keep an address for that browser or phone, given by its maker, so a notice reaches it, and which person in your company it belongs to. Turning them off removes it.
- Who did what — the app records which person made each change, so your company has an honest trail.
- Contact details you send us when you ask for help or buy a plan.
- Your name, company and email when you open the demo or start a free trial — so we know who is trying LAYAW Project Manager and can help with questions about it. We send one welcome email about getting started. We send you product updates and news only if you tick the box that asks for them; it is never ticked for you. To stop them, use the unsubscribe line in any update or write to us, and we stop.
We do not sell your information, show you advertising, or use your company's records to train anything.
Counting visits, without names
To know how many people are interested in LAYAW Project Manager, we count four things: a visit to our website, an opening of the demo, a free trial started on one computer, and an installation of the app. Each is sent as a single word — for example "demo opened" — and added to that day's total. Nothing else goes with it: no name, no email, no company, no device identifier, and no cookie. Your browser remembers only the date it last counted, so the same device is counted once a day. Our server uses the sending address for a moment to stop one machine from counting itself many times, and does not store it. We see only daily totals.
Where it is kept
On a Solo plan, everything stays on your own computer. On a Team plan, your records are also kept on secure cloud servers in Singapore so that your computers and phones show the same numbers. The software is built and tested so that every request is checked on the server: a person sees only what their role in your company allows, and one company cannot see another's.
Google Drive (optional)
If your company's Owner chooses Connect Google Drive, LAYAW Project Manager asks Google for permission to create files in your Google Drive (the “drive.file” permission). With it the app:
- makes one folder, “LAYAW Project Manager — your company”, with a folder for each team and project inside;
- saves there the papers your people attach — receipts, delivery receipts, signed billings;
- opens those files again for the people in your company allowed to see them.
The app can only see the files and folders it created. It cannot see, read or change anything else in your Drive. To do this on your behalf, we keep a permission key from Google, stored where no app or person at your company can read it, used only to upload and open these files.
LAYAW Project Manager’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer this information to anyone, use it for advertising, or let anyone read it except to provide this feature.
You can stop this at any time: Disconnect on the Cloud Sync screen, or remove “LAYAW Project Manager” at myaccount.google.com/permissions. The files stay in your Drive; they are yours.
How long we keep it
While your company uses the software. After a Team plan ends and is not renewed, we keep your company's records for 90 days so you can export them or renew, as the Terms say; after that we may delete them. Your company's Owner may also ask us to delete them sooner: we do so within 30 days of the request, after giving you a chance to export everything. Backups we keep for recovery are deleted on their own within weeks. We may keep what the law requires us to keep, such as our own payment records.
Your rights
You may ask to see, correct, export or delete the information we hold about you, or object to how it is used. Write to layawsystem@gmail.com. Your company's Owner can also export everything at any time from the Company screen. For information your company entered about you, write to that company first (see above). If you believe your rights were not respected, you may also complain to the National Privacy Commission.
Security
Connections are encrypted. Access is checked on the server for every request, and our security rules are tested against attacks before every update. Two-step sign-in is available to every account. No system connected to the internet can be promised to be perfectly secure; keeping passwords private and two-step sign-in on is part of keeping your records safe.
If something goes wrong
If we learn of a security incident that affects personal information we hold, we act to contain it, tell the affected company's Owner without undue delay with what we know, and notify the National Privacy Commission where the law requires us to. For information your company entered, your company as controller decides how to tell its own people, and we help with the facts.
Changes
If we change this policy, we update the date at the top and, for important changes, tell your company's Owner.