Legal
Privacy Policy
This policy explains what personal data I-Trust Systems collects when you use the I-Trust app, why we collect it, who we share it with, how long we keep it and what rights you have. We keep it short on purpose: we do not advertise, we do not track you and we do not sell data.
1. Who we are
The app and these pages are operated by I-Trust Systems, a smart home, home cinema and audio-visual integration company established in 2011 and based in the United Arab Emirates (“I-Trust”, “we”, “us”). I-Trust is the controller of the personal data described in this policy.
Dubai office
Abraj Center, Office 904Deira, Dubai, UAE
We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”) and its implementing regulations.
The app is used by two groups of people: customers (owners or managers of villas and other properties we serve) and I-Trust staff (engineers, support and administrators). This policy covers both, and points out where they differ.
2. What we collect and why
We collect only what is needed to run the support and maintenance service. We do not collect your location (the app never asks for location permission), we do not access your microphone, contacts or advertising identifier, and we do not use third-party analytics or advertising SDKs.
| Data | Purpose | Legal basis |
|---|---|---|
| Account details: name, email address, mobile number, password (only if you choose one) and, if you use Continue with Google or Continue with Apple, the account identifier and email address that Google or Apple confirms | I-Trust creates your account when we invite you; we use these details to sign you in, secure your account and contact you about your requests. Passwords are stored only as an argon2id hash and can never be read by anyone, including us. We never receive your Google or Apple password. | Performance of the service you request; our legitimate interest in securing accounts |
| Property details: villa or property address, area and city, access notes, location link | Know where to attend a site visit and how to get in. You choose what to enter; the location link is a web link you paste, not a live location. | Performance of the service you request |
| Support tickets: title, description, category, urgency, preferred visit time, contact phone, photos, chat messages | Diagnose the problem, reply to you, plan and carry out the visit. Photos are resized on your phone and their EXIF and location metadata is removed before upload. | Performance of the service you request |
| AMC and maintenance records: contract status and dates, maintenance report content (including the spare parts used), technician name, timestamps, handwritten signature and signer name | Document the work done, give you a signed PDF report, show your maintenance contract status. The signature is stored as vector strokes with the signer’s name and a timestamp and embedded in the PDF; it is not analysed biometrically. | Performance of our service or AMC agreement; legal obligation to keep commercial records; your consent when you sign |
| Push notification token and platform (iOS or Android) | Send you notifications about your requests and reports (see section 11). | Your consent (you can refuse or withdraw in your phone’s settings) |
| Security and session data: IP address, user-agent (device and app version), sign-in sessions, security and audit logs | Keep the service secure, detect abuse and repeated failed sign-ins, keep you signed in safely, investigate incidents. | Our legitimate interest in the security of the service; legal obligations |
| Emails and text messages we send you: your invitation with a setup code, sign-in codes by SMS, password-reset codes, copies of maintenance reports | Let you sign in, set or recover your password and receive your reports. | Performance of the service you request |
| Staff accounts: name, email address, role, activity on tickets and reports | Operate the service, assign work, show customers who attended, keep an audit trail. | Our legitimate business interests as employer or service provider; legal obligations |
Customers may also appear in our records because I-Trust staff created a customer file for them (for example when a maintenance contract is signed). Those records can contain your name, contact details, villa details, contract dates and staff-only internal notes about your service. Internal notes, and what spare parts cost us, are never shown to customers.
Providing data marked as account details is required to create an account. Everything else is provided by you voluntarily when you send a request or a staff member records a visit; if you do not provide it we may be unable to carry out the request.
3. How we use your data
- To provide the app: sign-in, tickets, chat, visit scheduling, AMC status and maintenance reports.
- To carry out and document service visits and maintenance work.
- To send service notifications and, where you have chosen to receive them, emails such as password-reset codes and report copies.
- To protect the service against misuse and to investigate security incidents.
- To meet legal, accounting and contractual record-keeping obligations.
We do not use your data for advertising, we do not build advertising profiles, we do not sell or rent personal data and we do not make decisions about you using fully automated processing.
4. Sharing and processors
Inside I-Trust. Customer data is visible to I-Trust staff who need it to handle your requests, visits and contracts. Other customers can never see your data: every customer only has access to their own records.
Service providers (processors). We use a small number of providers who process data on our instructions and only to run the service:
| Provider | What they do | Data involved |
|---|---|---|
| Our VPS hosting provider | Hosts the servers and storage that run the app, database and file storage. | All data described in this policy, stored on our servers. |
| Expo push service (Expo, Apple Push Notification service, Google Firebase Cloud Messaging) | Delivers push notifications to your phone. | Your push token and the short notification text (for example “Your service report is ready”) and a link to open in the app. Notifications do not contain your photos or the full text of your messages. |
| Our email provider (SMTP) | Delivers emails we send on your behalf. | Your email address, and the content of the email (invitation and setup code, password-reset code, or a maintenance report PDF). |
| Twilio (Twilio Verify) | Sends the 6-digit code when you sign in with your mobile number or change it, and checks the code you enter. | Your mobile number and the code. Twilio creates and checks the code; we never see it. Codes expire after 10 minutes. |
Sign-in providers. If you choose Continue with Google or Continue with Apple, Google or Apple confirms who you are under their own privacy policies. We receive a signed confirmation containing an account identifier, your email address and whether it is verified, and we use it only to find the account I-Trust created for you. If you use Apple’s “Hide My Email”, we only receive the relay address. For Apple we also keep an encrypted token that we use for one thing only: when you delete your account, we ask Apple to remove I-Trust from the apps that use your Apple ID. You can always sign in another way instead.
Legal and safety. We may disclose data to courts, regulators or law-enforcement authorities in the UAE where we are legally required to, or to protect our rights, our staff or others.
We do not share personal data with advertisers, data brokers or analytics companies.
5. International transfers
Notifications sent through Expo, Apple and Google are routed through infrastructure that may be located outside the UAE. Our hosting and email providers may also operate data centres outside the UAE. Where personal data leaves the UAE we rely on the safeguards the PDPL permits, such as contractual commitments from the provider to protect the data to an equivalent standard, and we limit what is sent (for example, notification text is kept minimal). You can ask us for details by contacting us (section 14).
6. How long we keep data
| Data | Retention |
|---|---|
| Account data (login, profile, devices) | Until you delete your account (staff accounts are deactivated and anonymised on deletion, or when an administrator deactivates them). |
| Tickets, messages and photos | Treated as service records: kept for up to 5 years after the end of our service relationship with you, unless removed earlier under the account-deletion rule in section 9. |
| AMC contracts and signed maintenance reports | Kept for up to 5 years after the end of our service relationship with you, in line with UAE commercial record-keeping requirements. |
| Security logs and session records | About 180 days. |
| Backups | Rotate every 14 days. Data you delete may remain in backups until they are overwritten, and is not restored to the live service except for disaster recovery. |
After the applicable period we delete the records or irreversibly anonymise them.
7. Security
We protect your data with measures appropriate to the risk, including:
- All app traffic is encrypted in transit with HTTPS (TLS).
- Passwords are hashed with argon2id; we cannot read them. Sign-in uses short-lived access tokens and rotating refresh tokens, which are kept in your phone’s secure storage (Keychain on iOS, Keystore on Android).
- Rate limiting and temporary account lock-out after repeated failed sign-ins.
- Strict access control: customers only reach their own records; staff access is role-based; internal notes are never sent to customer devices.
- Uploaded files are checked by file type, stored under random names and served only to people allowed to see the related ticket or report.
- Sensitive values such as passwords and tokens are removed from our server logs; sensitive actions are recorded in an audit log.
- Servers run in isolated containers with the database on a private network, and nightly backups.
No system is perfectly secure. If a breach affects your personal data in a way that creates a risk to you, we will notify you and the competent UAE authority as required by law.
8. Your rights under the PDPL
Subject to the conditions and exceptions in the PDPL, you have the right to:
- Access your personal data and get information about how we process it;
- Correct inaccurate data (most details can be edited directly in the app under Account);
- Delete your data (see section 9);
- Restrict processing in certain cases, for example while you contest the accuracy of data;
- Object to processing, including processing based on our legitimate interests, and to decisions based solely on automated processing (we make none);
- Receive your data in a portable format where processing is based on consent or on a contract and carried out by automated means (your signed maintenance reports are already available to you as PDF files in the app);
- Withdraw consent at any time where processing is based on consent, without affecting processing already carried out. For example, you can switch off notifications in your phone’s settings.
How to exercise your rights. Email info@itrustsystems.com with the subject “Privacy request” from the email address registered to your account, or call 800 487878. Tell us which right you want to use. We may ask you to confirm your identity to protect your account. We respond within 30 days. There is no charge unless requests are clearly unfounded or excessive.
We may be unable to delete records we are legally required to keep (see sections 6 and 9); we will tell you which and why. If you are not satisfied with our response you may lodge a complaint with the UAE Data Office, the federal data protection authority.
9. Account deletion
Customers can delete their account at any time in the app: Account → Delete account, then confirm (with your password, if you set one). Deletion takes effect immediately. What happens next depends on whether you have a service relationship with us:
- You created your account yourself in an earlier version of the app, nobody else uses your customer file, and you have no AMC contract and no maintenance reports: we delete all your data — your login, profile and devices, requests, messages, photos, saved villas and your customer record.
- Otherwise (you have an AMC contract or maintenance reports, I-Trust set up your customer file, or other people use the same customer file): we delete your login, profile and devices. The customer file and its service records — villas, contracts, signed maintenance reports and requests — are retained for legal and contractual reasons (up to 5 years after the end of the service relationship) and are disconnected from your deleted login; messages you wrote keep the name shown at the time.
You can also ask by email; see our account deletion page for full details. Staff can delete their own account in the app (More → Delete account); it is deactivated and anonymised immediately.
10. Children
The app is intended for adults aged 18 or over who own or manage properties and for I-Trust staff. It is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has an account, contact us and we will delete it.
11. Push notifications
With your permission, the app sends push notifications, for example when I-Trust replies to your request, changes its status, schedules a visit or issues a signed maintenance report. Staff receive notifications about new tickets, customer replies and assignments. The app asks for permission at a relevant moment (after your first request for customers), never at launch.
To deliver them we store a push token for each of your devices, together with the platform (iOS or Android), and send the message through the Expo push service and Apple or Google. Tokens are deleted when you sign out, when you delete your account, or when the provider reports that they are no longer valid. You can turn notifications off at any time in your phone’s settings; the app continues to work, you just will not be alerted.
12. Cookies and tracking
The app does not use cookies, and the pages on this website do not set any cookies, run scripts or load content from other websites. We do not use advertising identifiers, cross-app tracking, fingerprinting or third-party analytics. The app stores sign-in tokens in your phone’s secure storage and keeps an unsent maintenance-report draft or form entries on your device so you do not lose your work; this stays on your phone and is not sent to us until you submit it.
13. Changes to this policy
We may update this policy when our service or the law changes. The effective date at the top shows the current version. If a change is significant we will tell you in the app or by email before it takes effect. Previous versions are available on request.
14. Contact
Questions about this policy or requests about your personal data:
Abraj Center, Office 904, Deira, Dubai
Email: info@itrustsystems.com
Phone: 800 487878 (toll-free) · +971 56 699 0926 (also WhatsApp)
Monday to Saturday, 8:00 AM – 6:00 PM (GST)