Privacy Policy

Information we collect

Depending on the features you use, we collect:

• Account information: Your name, email address, account identifier, authentication information, company affiliation, and assigned role.
• Location information: Precise location coordinates used for attendance, site visits, work verification, and technician coordination.
• Work and safety records: Work orders, checklists, reports, attendance entries, toolbox meeting records, comments, and related timestamps.
• Photos and documents: Images you capture or select for work evidence and attendance, and documents submitted during organization registration, including business licences and registration documents.
• Messages: Messages and related information submitted through work-order communication features.
• Technical information: App installation identifiers, notification tokens, app and device information, and technical information processed by our service providers.

How we use information

We use this information to create and manage accounts, authenticate users, assign and coordinate work, verify attendance and site activities, maintain operational and safety records, deliver notifications, support communication, respond to support requests, and protect the service against unauthorized use.

Location and device permissions

GEMS requests location permission for features that depend on your position. When its location-update feature is running, the app may collect and send location updates approximately every 10 minutes, in addition to location collected during specific work or attendance actions.

GEMS uses the camera to capture evidence and attendance images. File-selection features allow you to choose documents or images to upload. Notification permission enables work-related alerts.

You can manage permissions through your device settings. Denying a permission may prevent the corresponding feature from working.

How information is shared

Relevant information is made available to company administrators, supervisors, colleagues, or other users involved in the applicable work process, according to their access permissions.

GEMS uses service providers, including:

• Google Firebase Cloud Messaging, for push notifications.
• Google Maps services, for mapping and location-related functions.
• Pusher, for real-time communication and updates.
• Siteweavers, for operating the application and supporting its services.

These providers may process information needed to deliver their services, including identifiers, technical information, and relevant service content. Firebase's handling of information is described in its privacy documentation.

We may also disclose information when legally required or when necessary to investigate unauthorized activity or protect users and the service.

Data security

GEMS is configured to use HTTPS for connections to its primary API, helping protect information during transmission.

Account passwords are stored using one-way hashing. Protected application features use account authentication and, where applicable, company-membership and user-permission checks. Administrative web access is limited to permitted account types.

No electronic storage or transmission system can guarantee absolute security.

Data retention

We apply the following retention periods:

• Account and organization-registration information: While the account remains active, followed by deletion within 30 days after closure, unless retention is required for a legitimate reason.
• Precise device-location records: Up to 90 days.
• Completed work orders, attendance records, and safety records: Up to 24 months after completion.
• Work-related messages: Up to 24 months after submission.
• Deleted information in backups: Up to 90 days after deletion from active systems.

If particular records must be retained for legal obligations, security, or fraud prevention, we explain the reason and applicable retention period when responding to a deletion request.

Your choices and deletion requests

You may request access to, correction of, or deletion of your personal information by contacting dev@gibotel.com.

To request deletion of your GEMS account and associated personal information, contact that email address or follow the instructions at account deletion .

We may verify your identity before processing a request. We aim to complete verified deletion requests within 30 days. Where legitimate retention requirements apply, we explain which records must remain and why. Uninstalling GEMS does not automatically delete information stored on our servers.

Children's privacy

GEMS is intended for business users and is not directed at children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

Changes to this policy

We may update this policy as our services or data practices change. We will publish the revised policy and update its effective date.

Contact

For privacy questions or requests, contact:

Gibotel Company Limited
Email: dev@gibotel.com