PRIVACY POLICY

1. Who We Are

Mushaba is a product of IOTFIY Solutions, registered in Pakistan. We operate the Mushaba mobile application and the website iotfiysolutions.com ("the Service"). Our registered contact is info@iotfiysolutions.com.

2. Information We Collect

We collect information you provide directly and information generated by your use of the Service:

• Account information: Name, email address, phone number, and profile photo when you register or sign in with Google.
• Location data: Real-time GPS coordinates, floor level (barometric sensor data), and movement history while you are actively using the group tracking features.
• QR band data: Names, hotel addresses, room numbers, bus station details, and emergency contact numbers you enter for QR safety bands.
• Payment information: When you subscribe to a paid plan, payment is processed by our third-party payment processor (e.g. Stripe). We do not store full card details on our servers.
• Communications: Messages, images, voice notes, and location pins shared in group chats.
• Device data: Device type, operating system, app version, and crash logs used for service improvement.

3. How We Use Your Information

• To provide real-time group tracking, SOS alerts, and offline mesh networking features.
• To generate and display QR safety bands accessible via a public URL when scanned.
• To process subscription payments and send billing receipts.
• To deliver AI voice translation and ritual guidance features.
• To improve the app through anonymised usage analytics.
• To send important service notifications (not marketing unless you opt in).

4. Location Data

Location data is the core of Mushaba. Your GPS coordinates are shared in real time with other members of your group only. They are not shared with third parties, sold, or used for advertising. Location sharing stops immediately when you close the app or disable tracking in settings. Historical location data is retained for 30 days and then automatically deleted.

5. QR Band Public Pages

Each QR safety band generates a publicly accessible web page (e.g. mushaba.iotfiysolutions.com/qr/[ID]). This page displays the pilgrim's name, hotel, bus station, and emergency contacts. It is intentionally public so that any person who finds the band can access the information without needing an account. You accept this when creating a QR band. You may delete a band at any time, which immediately removes the public page.

6. Payment Processing

Subscription payments are processed by third-party payment providers (including Stripe and Tap Payments). These providers are PCI DSS compliant. When you make a payment, you are subject to the payment provider's privacy policy in addition to ours. We retain transaction records (amount, date, plan) for accounting and legal compliance but never store raw card numbers or CVV codes.

7. Data Sharing

We do not sell your personal data. We share data only with:

• Other members of your Mushaba group (location and chat only).
• Payment processors for subscription billing.
• Cloud hosting providers (data stored in encrypted, access-controlled environments).
• Law enforcement where required by applicable law.

8. Data Retention

• Location history: 30 days, then automatically purged.
• Chat messages: Retained while your account is active; deleted 90 days after account closure.
• QR band data: Retained until you delete the band.
• Payment records: 7 years (legal requirement).
• Account data: Deleted within 30 days of account closure request.

9. Your Rights

Depending on your jurisdiction you have the right to access, correct, export, or delete your personal data. To exercise these rights, email info@iotfiysolutions.com with the subject line "Data Request". We respond within 30 days.

You can also permanently delete your account at any time. See our account deletion page for full steps and what is removed.

10. Security

All data in transit is encrypted using TLS 1.3. Data at rest is encrypted using AES-256. We conduct regular security audits and follow responsible disclosure practices for vulnerabilities.

11. Children

Mushaba is designed to protect children during pilgrimage. Children may appear in QR bands created by a parent or guardian. We do not knowingly collect data directly from children under 13 without verified parental consent.

12. Changes to This Policy

We may update this policy. We will notify registered users by email and display a notice in the app. Continued use of the Service after changes constitutes acceptance.

13. Contact

Privacy enquiries: info@iotfiysolutions.com · IOTFIY Solutions · Pakistan