Privacy Policy

Who is responsible for your data

The Philippine Data Privacy Act of 2012 (Republic Act No. 10173) gives two roles to the organizations handling your personal data. WaterMax decides why your data is collected and what it is used for, and is registering with the National Privacy Commission under NPC Circular 2022-04. AI Prime Automations builds and operates this application for WaterMax, and only handles data on WaterMax's instructions.

Personal information controller

WaterMax Enterprises

Personal information processor

AI Prime Automations

Our data protection contact will be named here; until then, contact us at 0920-965-0272, 0916-644-4406 or 0933-814-9389, or at #140 San Pedro Ili, Alcala, Pangasinan.

Personal data this application handles

Access to the app is by invitation from WaterMax, either as a client (Client App) or as staff (Operations Hub, Field App). We collect the following categories, each only for the purpose stated.

• Account and contact information

  Your name, email address, phone number, and your role (owner, delegate, staff, or technician) on a WaterMax account. Used to sign you in, identify who is on an account, and route service records to the right client.

• Sign-in and session data

  Your chosen sign-in method (a one-time email code, or a password), and a session identifier that keeps you signed in. The app never creates an account for you automatically; access is granted by WaterMax staff or an existing account owner.

• Service requests and communications

  Messages, service requests, and notes exchanged between you and WaterMax staff on your account, including a record of any correction to a message. Used to keep one record of your service history.

• Appointment and site information

  Scheduled visit times, and the address or site instructions that you or WaterMax staff type in for a visit. This is information you enter, not your device's location: the app does not request device GPS access.

• Machines and service history

  The water systems registered to your account, their serial numbers and QR codes, build and installation progress, and field-visit reports. Used to give you and WaterMax staff one lifetime record per machine.

  The printed QR label on the machine itself opens a public card to anyone who scans it, with no sign-in required: the owner's name, the site, the package, the TDS reading, the membrane type, the release and installation dates, and the names of the staff who built the machine. An account owner can ask WaterMax to hide the owner name from this card on a per-machine basis. The card never shows a phone number, an email address, or a client code.

• Financial and billing records

  Quotation and invoice line items, amounts, and payment references tied to your account. Used to prepare, send and track your quotations and invoices.

• Photos and documents

  Files such as service photos or signed documents that you or WaterMax staff attach to your account or a machine record. These are stored with our storage provider, and are only visible to the people who can already see the record they are attached to.

• Camera access (Field App only)

  WaterMax staff using the Field App on a phone or tablet can use the device camera to scan a machine's QR code. The app does not request microphone access, and does not request device location access.

• Diagnostic information

  When something goes wrong, the app records a general error category and a random incident number so our team can investigate, rather than the raw content of what you typed. Our hosting and infrastructure providers separately keep their own standard connection logs.

• Push notifications (optional)

  You can choose to receive WaterMax notifications on a phone or computer. Nothing is sent until you turn it on for that device and your device asks for, and receives, your permission. To deliver them we store the device's push address and its encryption keys, issued by your browser's push service. An alert shows only a short label such as "New request message" and a link into the app, never the message itself. Turning in-app notifications off in your preferences also stops them, and you can turn push off on a device at any time.

Who we share your data with

We do not sell your personal data. A small number of service providers process data on WaterMax's behalf, under AI Prime Automations' direction as processor, only to the extent needed to run the app:

• Supabase, our database, authentication, and file storage provider.
• Resend, which delivers transactional email such as sign-in codes and service notifications.
• Vercel, which hosts the application infrastructure.

These providers are only given the data needed to perform their function, and are not permitted to use it for their own purposes. We may also disclose data where required by Philippine law or a valid legal process.

How long we keep your data

We keep personal data for as long as your WaterMax account stays active, and afterward only as long as needed to meet legal, tax, or accounting obligations, or to resolve an open dispute. A client can erase their own personal sign-in details at any time from Account, Delete my account inside the app; this is delayed only while an order on the account is not yet delivered or an invoice is not fully paid, and business records WaterMax must keep for accounting are not deleted by it. A detailed retention schedule is being finalized.

Your rights under the Data Privacy Act

Under Republic Act No. 10173 and its implementing rules, you have the right to:

• Be informed that your personal data is being processed
• Access your personal data
• Object to processing, or withdraw consent
• Correct inaccurate or outdated personal data
• Erasure or blocking of your personal data, where the law allows it
• Data portability
• File a complaint with the National Privacy Commission, and be indemnified for damages from a data breach

To exercise any of these rights, contact WaterMax using the details in the section above.

How we protect your data

Access to your account is limited to you and to WaterMax staff whose role permits it: a client cannot see another client's records, and staff-only areas such as pricing and accounting are hidden from client accounts. Sign-in uses one-time email codes or a password, and every request is checked against your account and role before any record is shown or changed, except the public machine card described above.

Children

This application is for WaterMax clients and staff, and is not directed at children. Access is by invitation only, and we do not knowingly collect personal data from children.

Changes to this policy

If this policy changes, we will update the date at the top of this page. Where a change is significant, such as a new category of data or a new provider, we will call it out in-app before it applies to you.