INDOGLOBALIOT

Privacy Policy

Last updated: April 25, 2026 · Effective immediately upon publication

This Privacy Policy describes how INDOGLOBALGPS ("we", "us", "our") collects, uses, and protects information when you use the INDOGLOBALIOT mobile application and the related backend service hosted at indoglobaliot.com (collectively, the "Service"). The Service is provided to authorized factory operators for monitoring industrial water-tank and sensor telemetry.

1. Who this policy applies to

The INDOGLOBALIOT app is intended for use by employees and authorized contractors of factories that have purchased a monitoring subscription from INDOGLOBALGPS. Each user account is provisioned by an administrator and tied to a specific factory. The app is not intended for use by the general public or by children under the age of 13.

2. Information we collect

2.1 Information you provide

• Account credentials — email address and password used to log in. Passwords are stored on our server only as a salted bcrypt hash; we never see your plaintext password.
• Profile information — your display name and the factory you are assigned to, set by the administrator at account creation.
• Custom device images (optional) — if you upload a photo to label a sensor device, that image is stored on our server and shown only inside your factory's account.

2.2 Information collected automatically

• API session token — a Laravel Sanctum bearer token issued at login and stored on the device using the OS keystore (Android Keystore / iOS Keychain) via flutter_secure_storage.
• Push notification token — a Firebase Cloud Messaging (FCM) registration token, used solely to deliver sensor alerts to your device. The token is sent to our server and replaced when it rotates. It is deleted from our server when you log out.
• Device label — a coarse identifier ("Android" or "iOS") stored alongside the FCM token to help administrators identify which device received an alert. We do not collect IMEI, advertising ID, MAC address, serial number, or installed-app inventory.
• Login timestamp — the time of your last successful login, used for security auditing.
• IP address and request metadata — recorded transiently in standard server access logs for security and rate-limiting. Logs are rotated and not used for analytics.

2.3 Information about your factory's equipment

The Service displays sensor telemetry — for example tank level, pressure, temperature, signal strength, and battery — pulled on demand from the GPS hardware tracker integrated with our backend. This telemetry describes equipment owned by your factory; it is not personal data about you.

3. How we use information

• To authenticate you and authorize access to your factory's data.
• To deliver real-time push notifications when a sensor crosses a threshold you or your administrator configured.
• To display historical sensor charts and current device status inside the app.
• To provide customer support, diagnose bugs, and improve reliability.
• To enforce security controls (rate limiting, anomaly detection, single-session enforcement).

We do not use your information for advertising, profiling, automated decision-making with legal effects, or sale to third parties.

4. Permissions requested by the app

Permission	Why it is requested
Internet	To communicate with the INDOGLOBALIOT backend.
POST_NOTIFICATIONS (Android 13+) / Notifications (iOS)	To show alert push notifications. You may decline; the app will still work but will not surface alerts via the OS notification tray.
Photos / Camera (only when you tap "Upload device image")	To pick or take a photo to attach to a sensor device. The image is uploaded only when you confirm the action.

The app does not request access to your contacts, calendar, microphone, GPS location, SMS, call log, or files outside the system photo picker.

5. Third-party services

The Service relies on the following third parties to function. Their handling of any data we transmit to them is governed by their own privacy policies.

Provider	Purpose	Data shared	Policy
Google Firebase Cloud Messaging (Google LLC)	Delivering push notifications.	FCM registration token, notification title and body, alert metadata.	policies.google.com/privacy
GPSWox / VipitGPS (back-end integration)	Source of GPS tracker and sensor telemetry for your factory's equipment.	Server-to-server only — the mobile app never talks to GPSWox directly.	gpswox.com/privacy-policy
Hostinger (VPS hosting)	Hosting our backend at indoglobaliot.com.	Whatever traverses standard HTTPS — content of API requests, server logs.	hostinger.com/privacy-policy

We do not embed third-party analytics, advertising, or attribution SDKs in the app.

6. Data sharing and disclosure

We do not sell, rent, or trade your personal information. We disclose information only:

• To the third parties listed in section 5, strictly to operate the Service.
• To your factory's designated administrator, who can see which users belong to the factory and which devices have registered FCM tokens.
• When required by Indonesian law, court order, or enforceable government request, after good-faith review.
• In the event of a corporate transaction (merger, acquisition, asset sale), in which case the acquirer will be bound by terms at least as protective as those in this policy.

7. Data retention

• Account records are kept for as long as your account is active. When an administrator deletes your account, your profile and login records are removed within 30 days.
• FCM push tokens are deleted from our database immediately when you log out, and are also deleted automatically if Firebase reports the token as expired or unregistered.
• Sensor alerts are retained as long as the factory's subscription is active so that history charts and alert logs remain available.
• Server access logs are rotated on a rolling 30 to 90-day window depending on log volume.

8. Data security

We use industry-standard practices, including:

• HTTPS/TLS for all transport between the app and the backend.
• Bcrypt password hashing with per-user salts.
• OS-keystore-backed secure storage for the API session token on the device.
• Encrypted-at-rest storage of third-party API credentials on our server.
• Rate limiting on login endpoints to deter credential-stuffing.
• Automatic invalidation of session tokens on logout and on suspicious activity.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately using the address below.

9. Your rights

Subject to applicable Indonesian law and to your factory's contract with INDOGLOBALGPS, you may:

• Request a copy of the personal information we hold about you.
• Request correction of inaccurate personal information.
• Request deletion of your account and associated personal information. (Note that telemetry records belonging to your factory's equipment will not be deleted unless the factory's administrator authorizes it.)
• Withdraw push notification consent at any time through your device's notification settings or by logging out.

To exercise any of these rights, email the contact address in section 12. We will respond within 30 days.

10. Children's privacy

The Service is intended for adult industrial-monitoring personnel. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. International transfers

The backend server is hosted in a Hostinger data center. Push notifications transit Google infrastructure, which may store and process them outside Indonesia. By using the Service you consent to such transfers, which are conducted under contractual safeguards equivalent to those required by Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP).

12. Contact us

For privacy questions, data-access requests, or to report a suspected breach:

13. Changes to this policy

We may update this policy as the Service evolves. The "Last updated" date at the top will change. Material changes affecting how we collect or share your data will be announced inside the app and via email to active users at least 14 days before they take effect.