Privacy Policy

1. Scope

This policy describes how the 933 Security Solutions mobile app collects, uses, stores and protects personal data. The app is an operational tool for security personnel and for business customers subscribed to our monitoring services.

The app does not offer self-registration. Every account is created and issued by an administrator at the subscribing organisation. If your account was issued by your employer, your data is additionally governed by the service contract between us and that organisation.

2. Data controller

933 Security Service Co., Ltd. is the data controller for the data described in this policy. Full contact details are in Section 12.

3. Data we collect

The table below is the complete list of data categories the app collects. The app collects nothing outside this table.

4. Location data in detail

Location is the most sensitive data the app handles, so we state precisely the only three cases in which the app reads it:

• Shift check-in and check-out. The app takes a single location fix at the moment you press the button, to compare it against the boundary of the site you are assigned to. There is no continuous tracking during a shift.
• Arrival at an incident. When you deliberately accept an assignment, the app tracks location to record when you arrive. Tracking stops as soon as you arrive, or after at most 10 minutes, whichever comes first.
• Work chat photos. Each time you take a photo in the app, the app takes one location fix at that moment, stamps it on the photo and sends it with the post. Between photos the app does not track your location.

Throughout the second case the operating system displays its active-location indicator - the green bar on iOS, the persistent icon on Android. The app deliberately does not request background location permission, and does not read your location outside these three cases.

5. Data we do not collect

The app never reads or transmits:

• Contacts, messages, or call logs.
• Photos or videos in your device gallery - the work chat accepts only photos taken in the app.
• Microphone input or audio recordings - the app does not request microphone permission.
• Browsing history or activity in other apps.
• The device advertising identifier.

The app contains no advertising SDK and no third-party behavioural analytics.

6. How we use data

• Authenticating users and enforcing role-based access.
• Delivering alarms and operational notifications to the right person, on the right device, as fast as possible.
• Confirming that personnel are at the correct site at check-in, and recording arrival at an incident.
• Shift reconciliation and reporting to business customers.
• Protecting system integrity, detecting anomalous access, and investigating technical incidents.

7. Sharing with third parties

We do not sell, rent or trade personal data. Data is passed only to the following parties, limited to the minimum necessary:

• Google LLC - Firebase Cloud Messaging, to deliver push notifications to Android and iOS devices. What is transmitted is the device push token and the notification content.
• Apple Inc. - the Apple Push Notification service, serving the same role on iOS devices.
• Zalo - only for users who deliberately link a Zalo account to receive notifications on that channel. If you do not link one, no data is passed to Zalo.
• Hostinger - an email service, to send sign-in verification codes and reports to the email address on the account. What is transmitted is the email address and the message content. The mail servers may be located outside Vietnam. If your account has no email address, no data is passed to Hostinger.
• Cloudflare, Inc. - the R2 storage service, which stores work chat photos on our behalf under Cloudflare data processing terms. The storage servers may be located outside Vietnam. Photos are encrypted in transit and at rest.
• Your own organisation - check-in records, on-site location records and operational logs are visible to authorised managers within that same organisation.
• The business customer at the site where you work - that customer’s accounts can see the work chat posts of their site, including the photos with the time, photographer name and coordinates stamped on them. Incident and urgent posts are shown to the customer only after the operations centre has reviewed them.
• Members of a site’s group chat - messages and notices you send to a site’s group are stored on our servers and can be read, with the sender name and the time sent, by: the accounts of the business customer that owns the site, the operations centre staff responsible for the site, our system administrators, and the guards on shift at the site when the message was sent.

Beyond the above, we disclose data only on a lawful written request from a competent state authority.

8. Storage and security

• All traffic between the app and our servers is encrypted with TLS.
• Session tokens are held in the operating system secure store - Keychain on iOS, Keystore on Android - never in plain text.
• Data access is partitioned by organisation and by role: a user sees only the sites they are assigned to.
• Servers are hosted in an access-controlled data centre with scheduled backups and access logging.

Retention periods for each data type are set out in the service contract with the subscribing organisation. Data kept as operational evidence - alarm history, check-in records and on-site data - is retained for the period stated in that contract. Work chat photos are deleted automatically when they expire, by post type: vehicles and people entering or leaving after 90 days, together with the post; incidents and urgent alerts after 24 months; other posts, such as shift start, shift end and patrols, after 12 months. The text of group messages and notices is not deleted automatically; it is kept for the period stated in the service contract, and photos attached to them are deleted automatically after 12 months.

9. Your rights

You may request access to, correction of, or deletion of your personal data, and you may withdraw consent you have given. In practice:

• Location and camera permissions can be revoked at any time in your operating system settings. Revoking location permission disables shift check-in, because the site boundary check can no longer be performed.
• Push notifications can be turned off in operating system settings. Signing out of the app revokes the device token on our servers.
• For access, correction or deletion requests, contact us using Section 12. We respond within 30 days of receiving the request and verifying the requester identity.

Because accounts are issued by the subscribing organisation, some requests - account deletion in particular - require confirmation from that organisation before they can be carried out.

10. Children

The app is an occupational tool for working adults. It is not directed at, and not intended for, anyone under 16. We do not knowingly collect data from children, and will delete any such data promptly once notified.

11. Changes to this policy

When this policy changes we update it at this same address and revise the effective date shown at the top of the page. For changes that materially affect your rights, we also notify you in the app.

12. Contact