Privacy Policy

This policy explains how your data is collected, used, and stored when you use the Constrak website (constraksa.com) and submit any of the request forms available on it: the "Start a Project" wizard, the contact form, the developer capabilities-file request, or the engineering-office submission form. This policy does not cover any system or site other than this one.

We rely on two legal bases, depending on the data and its purpose:

• Consent: submitting any form on this site (Start a Project, Contact, the developer capabilities-file request, or the engineering-office submission) is a voluntary act of consent to our processing the data you enter, for the purpose of reviewing and responding to your request. The "Start a Project" wizard includes an explicit consent checkbox that must be checked before the request can be sent.
• Legitimate interest: no real analytics tool is active on this site at present. The tracking module in the code (`src/lib/analytics.ts`) does not send any data to an external provider — with no analytics property configured (e.g. Google Analytics), every tracked interaction only emits a local, structured console log in your browser or on our server; nothing is actually collected or transmitted. If a real analytics tool is enabled in the future, its legal basis will specifically be our legitimate interest in understanding site usage, and this policy will be updated to describe it accurately at that time.

We process data submitted through this site's forms only for the following purposes:

• Evaluating the project request or inquiry technically and operationally (whether it falls within our services and service area).
• Contacting the submitter through their stated preferred channel (WhatsApp, phone, or email).
• Internal lead management: storing the request in the internal lead viewer, tracking its status, and flagging it internally if no staff action is logged within the configured escalation window.
• Referring the project to a licensed engineering office when regulated design or engineering approval work falls outside Constrak's scope as a contracting and execution establishment (see "Disclosure to engineering offices" below).

This site collects your data only when you submit one of four forms, using a fixed field set enforced by server-side validation (a Zod schema) before any request is accepted. The fields below are exact and match what is actually enforced in the code, per form:

The "Start a Project" wizard allows up to 12 attached files, of these types only: PDF, JPG/JPEG, PNG, capped at 25 MB per file. This list was deliberately narrowed (it previously also included DWG, DXF, HEIC/HEIF, and XLS/XLSX) pending full malware-scan testing of those wider formats.

Every file passes three independent checks before acceptance: its file extension, the actual MIME type the browser sent, and the file's real content signature (magic bytes) — a file named with a .pdf extension whose actual bytes are not a real PDF is rejected, even if the other checks pass.

Malware scanning: every file is actually scanned by a real ClamAV engine installed on this server the moment it is uploaded, and the engine name, its version, the signature-database version, and the scan timestamp are recorded against that file. Any file detected as infected is immediately moved into a separate quarantine directory (owner-only access), kept as evidence rather than deleted, and can never be downloaded. Even a file whose scan did not complete (e.g. the scan engine was briefly down) is blocked from download exactly like an infected one — no file is ever served unless its recorded scan result is actually "clean."

Once accepted, files are stored under a random, unguessable name with owner-only access permissions, outside any executable or directly publicly served path — there is no direct public URL to a file. Access is only possible through the protected internal lead viewer, and only once the file has actually scanned clean.

We collect your data exclusively through your direct, voluntary submission of one of this site's four forms. We do not purchase data from any third party, we do not collect your data from external sources (e.g. social networks or marketing databases), and there is no hidden data collection on this site without a direct action from you.

After you submit any form, your data goes through the following steps:

• Server-side validation of every field before anything is saved (an incomplete or invalid request is never stored).
• Validation and storage of any attached files (see "Uploaded documents" above).
• Saving the request in this site's database, with a reference number shown to both you and internal staff.
• An attempt to notify internal staff by email or webhook (see "Service providers" below for each channel's real, current status).
• Internal technical review of the request by Constrak's team through the protected internal lead viewer.

Your request data is seen only by Constrak staff holding credentials to the internal lead viewer (`/admin`). That viewer is gated by server-level Basic Auth and fails closed — any request without valid credentials is rejected outright. Every file download is written to a permanent internal audit log (who downloaded what, and when).

This gate is a deliberate stopgap pending a real per-staff-member login system (separate accounts and roles) — there is currently no system-level distinction between staff members beyond the username entered on each request.

Constrak is a construction and execution establishment. Where regulated design or engineering approval work falls within a project's scope, it is carried out and certified by a licensed engineering office, responsible for it under a clearly defined scope and agreement.

When your project is referred to a licensed engineering office on this basis, your project's files and data (drawings, measurements, site details) may be shared with that office to the extent needed to carry out the engagement, under a working agreement between us and the office. When a project is instead referred to us by an engineering office (a confidential submission), communication stays routed through that office's named point of contact, and your identity as the end client is not shared with Constrak unless the office authorizes it.

This site runs on a single server rented from Hetzner Online GmbH, physically located in Helsinki, Finland — outside the Kingdom of Saudi Arabia. This means your data, including uploaded files, is actually processed and stored on a server outside the Kingdom's borders, not within them.

No offsite backup is currently configured specifically for this site — all of this site's data exists only on this single server, with no second backup destination yet.

The database and all uploaded files are stored on the local disk of the server described above (Helsinki, Finland). There is currently no second copy of the data in any other geographic location.

The actual outside parties involved in processing your data today are:

• Hetzner Online GmbH — the server hosting provider (Helsinki, Finland). This is the only service provider with actual access to the infrastructure your data is stored on.
• No outbound email provider (SMTP/Resend/SendGrid or similar) is currently configured. Internal email notification is always logged as "skipped — not configured," and no email is actually sent.
• A webhook notification channel: technically built and ready, but it only fires if a real webhook URL is configured in the server environment; if unconfigured, it likewise logs as "skipped" and your data never reaches any outside destination through it.
• No external customer-relationship-management (CRM) system is connected to this site — every request is stored locally only.

Request data (the text fields) remains stored in the database with no automatic time limit, until a staff member manually deletes it through the internal lead viewer, or until you ask us to delete it (see "Your rights" below).

For attached files specifically, a real retention mechanism exists and is ready (a separate script that deletes files older than a defined window, set via the `UPLOAD_RETENTION_DAYS` environment variable), but it is not yet actively enforced: that environment variable is currently empty, and no recurring job (cron) runs the script, so there is currently no actual automatic deletion of old files — real retention today is indefinite until a staff member acts manually.

A staff member can also manually delete a single file from within a given request's viewer at any time; on deletion, the file is actually removed from disk, while a record that a file existed and was deleted (the deletion date) is kept for internal audit purposes only — not the file's content.

Deleting an attached file (whether done manually or, later, by the retention script once enabled): the file is actually removed from the server's disk — from the quarantine directory if it was a quarantined infected file, or from the normal uploads directory otherwise (no trash bin or temporary copy remains) — and its database row is marked "deleted" with the deletion date, while limited metadata (the file's original name, the deletion date, and who/what performed the deletion) is retained for audit purposes only.

Deleting an entire request at your request: handled manually by internal staff, based on you contacting us through the published email address above, since no self-service tool on the site currently lets you delete your own request directly.

The security controls actually in place on this site today:

• Triple validation of every uploaded file: extension, actual MIME type, and content signature (magic bytes).
• Files stored under random, unguessable names with owner-only access permissions, outside any executable or directly publicly served path.
• Real, active malware scanning (ClamAV) on every file at upload time, with infected files quarantined (owner-only access, kept as evidence, not auto-deleted), and any file blocked from download unless its recorded scan result is actually "clean" — not just infected files, but also any file whose scan did not complete.
• A total-storage quota that prevents the disk from being filled by a flood of fake submissions.
• A per-IP rate limit on every form within a 10-minute window, to prevent automated abuse.
• Server-level rejection of any request originating from outside the site itself (cross-origin).
• The internal lead viewer is protected by Basic Auth that fails closed if unconfigured.
• A permanent audit log of file downloads, file deletions, and request handling actions, including blocked download attempts for a file that hasn't scanned clean yet.

As the person the data belongs to, you have the following rights over data you submitted through this site's forms:

• Access: knowing what data is held about you in your request.
• Correction: requesting correction of any inaccurate data you entered.
• Deletion: requesting your request and its attached files be deleted.
• Objection: objecting to any use of your data for a purpose other than the one you submitted it for, including any marketing use.
• Withdrawing consent: withdrawing your consent to the processing of your data at any time, without affecting the lawfulness of processing carried out before the withdrawal.

If you have an objection or complaint about how we handle your data, we ask that you contact us first through the email address published at the top of this page, so we can understand and address it directly.

If the matter is not resolved to your satisfaction, you have the right to file a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA), as the competent authority for enforcing the Personal Data Protection Law issued by Royal Decree No. M/19 and its Implementing Regulations.