Privacy and Personal Data Protection Policy

1. Data controller

1.1. The Company acts as data controller for the personal data it processes in order to manage registration, purchase, billing, security, support, communications, user administration and compliance with legal obligations relating to the Application.

1.2. Where the Company processes personal data on behalf of a User and in accordance with the User's instructions, it may act as data processor, depending on the nature of the service and the content uploaded by the User. In that case, the specific conditions may be documented in an annex, agreement or service order.

2. Personal data that may be processed

2.1. The Company may process the following categories of data, as applicable to the type of User, the purchased plan and the features used: identification data, contact data, professional or employment data, data on the representation of legal entities, billing and tax data, access credentials, usage records, IP address, device identifiers, technical logs, support information, communications with the Company, payment data processed by third parties, and data contained in projects, activities, documents, minutes, reports, RFIs, submittals, commitments, constraints or files uploaded by the User.

2.2. The Application is not directed to minors and therefore the Company does not collect data of minors. The User must not upload data of minors.

2.3. The Company does not request sensitive data as an ordinary condition of using the Application. The User must refrain from uploading sensitive data, unless it holds legitimacy, consent where applicable, and adequate security measures.

3. Sources of collection

3.1. Personal data may be collected directly from the data subject, from the Account's administrator User, from registration forms, electronic purchase, communications, technical support, documents uploaded to the Application, automatic capture tools, cookies or similar technologies, and from public sources or third parties where lawful and necessary for the provision of the service.

4. Purposes of processing

4.1. Personal data may be processed for the following main purposes: creation and administration of Accounts, authentication and access control, provision of the Application, configuration of projects, folios, permissions and roles, technical support, handling of enquiries, payment management, billing and collections, operational, legal and security communications, prevention of fraud or misuse, maintenance, improvement and security of the Application, backup and recovery of information, compliance with legal, tax, contractual and regulatory obligations, and defence of the rights of the Company or of third parties.

4.2. In addition, the Company may process data to send commercial communications, news, invitations, surveys, service improvements or information about features, provided there is agreement to receive them and respecting the data subject's ability to object or to unsubscribe from those communications where applicable.

5. Legal bases for processing

5.1. Processing may be based, as applicable, on: the data subject's consent, performance of a contract, compliance with legal obligations, the legitimate interest of the Company or of third parties provided the rights and freedoms of the data subject do not prevail, and the other bases permitted by applicable law.

5.2. Where processing requires consent, that consent must be prior, freely given, specific, informed and unambiguous. The data subject may withdraw it free of charge in accordance with applicable law, without affecting the lawfulness of processing carried out beforehand. Any contact must be made through the channels set out in clause fifteen.

6. Data uploaded by the User

6.1. The User is responsible for the lawfulness, accuracy and updating of third-party personal data that it uploads or allows to be uploaded into the Application, including data of workers, contractors, professionals, suppliers, clients, representatives, collaborators or any other natural person connected with the project.

6.2. The User represents that it holds a sufficient legal basis to upload that data and that it has informed the data subjects about the processing, where applicable. The Company may act as processor with respect to that data, to the extent that it processes it on the User's behalf and in accordance with the User's instructions.

7. Rights of data subjects

7.1. Data subjects may exercise, at any time and in accordance with applicable law, their rights of access, rectification, erasure, objection and portability, together with the other rights recognized by Law No. 7593/2025.

7.2. To exercise these rights, the data subject may send a request to the contact details identified in clause fifteen, stating their name, identity document, the right they wish to exercise, a description of the request and a means of contact. The Company may request reasonable additional information to verify the requester's identity and handle the request properly.

7.3. Where the request concerns data processed on behalf of a User, the Company may channel or forward the request to the responsible User, as appropriate.

8. Transfers and disclosures to third parties

8.1. The Company may disclose personal data to technology providers, hosting, security, support, email, analytics, payment processors, advisors, auditors, affiliated companies, competent authorities or third parties necessary for the provision of the service, legal compliance, security, billing, collections or defence of rights.

8.2. Where applicable, the Company will seek to ensure that third parties processing personal data on the Company's behalf assume obligations of confidentiality, security and processing in accordance with instructions and applicable law.

9. International transfers

9.1. The technology infrastructure, providers or services associated with the Application may involve processing or storage of data abroad. In such cases, the Company will adopt the measures and safeguards required by applicable law, seeking to ensure that the processing maintains an adequate level of protection.

10. Data retention

10.1. Personal data is retained for as long as necessary to fulfil the stated purposes, provide the service, maintain the contractual relationship, comply with legal, tax, accounting or regulatory obligations, handle claims, resolve disputes, carry out audits, preserve system security or defend rights.

Once the applicable retention period has elapsed, data may be deleted, anonymized or blocked, as appropriate.

11. Security and confidentiality

11.1. The Company implements reasonable technical and organizational measures to protect personal data against loss, alteration, destruction, accidental damage, unauthorized access, unlawful processing or improper disclosure.

In the event of security incidents involving personal data, the Company will act in accordance with applicable law and will notify the competent authority and/or the data subject where required, within the legally applicable time limits.

12. Cookies and similar technologies

12.1. The Application and the Company's website may use cookies, identifiers, pixels, activity logs or other similar technologies for authentication, security, technical operation, preferences, usage analysis, service improvement and, where applicable, commercial communications.

12.2. The User may manage cookies from their browser or device settings, noting that disabling certain cookies may affect the operation of the Application.

13. Commercial communications

13.1. The Company may send commercial communications by electronic means where a valid legal basis exists. Each commercial communication will seek to clearly identify the sender and to provide reasonable mechanisms to unsubscribe or object, where applicable. The User may withdraw this authorization through the channels identified in clause fifteen.

14. Changes to this Policy

14.1. The Company may update this Policy to reflect legal, regulatory, technical, operational or commercial changes. Updates will be published in the Application or communicated by electronic means where appropriate. Continued use of the Application after changes are published constitutes awareness of the version in force.

15. Contact

15.1. For enquiries, requests or complaints relating to privacy and personal data protection, the data subject may contact the Company at: email hello@surco.dev, telephone +595 985 909066 and address Avenida Mariscal López N.º 4877, Oficina, barrio San Cristóbal, Asunción, Paraguay.

16. Annex: supplementary information

B.1. Payments and Paddle (Merchant of Record). The order process and payment processing are carried out by Paddle.com, which acts as Merchant of Record and as an independent controller of payment and billing data. The Company does not collect or store full payment-card details. Paddle's processing is governed by its privacy policy, available at paddle.com/legal/privacy. Paddle shares limited order and billing-contact information with the Company to fulfil the order and provide support.

B.2. Processors and sub-processors. The Company does not sell personal data. It discloses data only to the providers necessary to operate the service, acting on the Company's behalf:

• Paddle: payments, billing, tax and merchant-of-record services.
• Google Firebase / Google Cloud: authentication and database for Application data.
• Vercel: website and application hosting and content delivery.
• Resend: transactional email delivery (verification and notifications).
• Upstash: rate limiting and abuse prevention.
• Microsoft, Google, Dropbox, Box and other storage providers: only where the User chooses to connect a file-storage integration.

B.3. The Surco mobile app. If the User uses the Surco mobile app, the following also applies. The app stores the session and a copy of the project data the User opens (schedules, drawings, punch list items and workflow records) on the device so it keeps working without a connection; this local copy is removed when the User signs out or uninstalls the app. Photos the User captures with the camera or chooses from the photo library are attached to the selected project record and become part of User Content; the app accesses the camera or photo library only when the User chooses to attach a photo. If the User allows notifications, a push notification token for the device is stored, linked to the account, solely to deliver alerts such as work assignments; notifications can be disabled in the device settings and the token is removed when the User signs out. The app contains no advertising and no third-party tracking, and it does not access the User's precise location, contacts or microphone.

B.4. California residents. California residents may have rights under the CCPA/CPRA to know, access, correct and delete their personal information, and to opt out of its “sale” or “sharing”. The Company does not sell or share personal information as those terms are defined under California law, and does not use sensitive personal information for purposes that require an opt-out. To exercise these rights, write to hello@surco.dev. The Company will not discriminate against anyone for exercising them.