MonitorMate Privacy Policy

1. Introduction & Scope

This Privacy Policy (“Policy”) governs the collection, processing, storage, and protection of personal and sensitive user data by MonitorMate Technologies Inc. (“MonitorMate”, “we”, “us”, or “our”) in connection with the MonitorMate Mobile Application (the “Application” or “App” for Android devices), our web dashboard located at dashboard.monitormate.app, and our website located at monitormate.app (collectively, the “Services”).

MonitorMate provides parental control, employee device management, consensual accountability, and device recovery software. We are deeply committed to protecting the privacy, security, and integrity of personal and sensitive user data in accordance with the Google Play Developer Program Policies (including the User Data Policy and Sensitive Permissions Requirements), the European General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and international privacy frameworks.

2. Information We Collect

To provide our device safety, telemetry, and parental control features, the Application collects specific categories of personal and sensitive device data. We collect only data strictly necessary to perform authorized monitoring functions:

A. Account & Identity Information

• Registration Details: Your email address, encrypted account password hash, and full name provided during registration.
• Payment Metadata: Transaction reference IDs, billing currency, subscription tier, and payment status. Note: Payment card details and M-Pesa STK push credentials are processed directly by certified, PCI-DSS Level 1 compliant payment gateways (Paystack, IntaSend, Safaricom). MonitorMate never stores raw credit card numbers or banking PINs.

B. Precise & Background Location Data

• Geographic Coordinates: Precise latitude, longitude, altitude, accuracy radius (typically within ±4 meters), speed, and heading obtained via GPS satellites, Wi-Fi networks, and cellular cell towers.
• Location History: Timestamped location breadcrumbs, stop durations, and geofence boundary events (entering or exiting designated safety zones).

C. Communications & Message Records

• Cellular SMS & MMS Metadata: Incoming and outgoing text message bodies, sender and recipient phone numbers, contact names, and exact network transmission timestamps.

D. Phone Call Telemetry

• Voice Call Logs: Incoming, outgoing, and missed call records, caller phone numbers, contact names, call start timestamps, and talk duration in seconds. (MonitorMate does NOT record or intercept voice call audio).

E. Contacts & Address Book Information

• Contacts Metadata: Stored contact names, phone numbers, and email addresses from the target device address book to enable contact resolution across call and message logs.

F. Installed Applications & Screen Time Usage

• App Inventory: Package names, application titles, and installation/update timestamps of applications installed on the device.
• Screen Time: Active foreground usage duration, launch frequency, and daily screen time metrics per application.

G. Photos & Stored Media Metadata

• Gallery Files: Image metadata (file name, EXIF timestamp, size) and thumbnail previews of photos stored on the device camera roll or received in download folders for parental oversight and backup.

H. Technical & Device Identifiers

• Device State: Device manufacturer, model, Android OS version, battery percentage, charging state, available storage, network connection type (Wi-Fi or Cellular), IP address, and unique Android ID.

3. Sensitive Permissions & Prominent Disclosures

In compliance with Google Play Sensitive Permissions Policies, the MonitorMate Application requires explicit, user-granted Android system permissions during setup. The Application provides prominent in-app disclosures before requesting any sensitive permission:

4. Accessibility Service API Policy Disclosure

Google Play requires an explicit, prominent disclosure regarding the use of the Android Accessibility Service API (`AccessibilityService`). MonitorMate complies fully with the Google Play Accessibility API User Data Policy:

5. How We Use Collected Information

We use collected user and device data solely for legitimate, authorized purposes:

• Delivering Monitoring Services: Presenting location trails, communication logs, call histories, and screen time analytics inside your password-authenticated web console.
• Safety & Geofence Alerts: Triggering real-time email or dashboard notifications when a monitored device exits or enters a configured safety perimeter.
• Account Administration: Authenticating users, processing subscriptions, verifying account active status, and providing technical customer support.
• Security & Abuse Prevention: Detecting fraudulent account creation, unauthorized access attempts, and protecting the integrity of our infrastructure.

6. Data Sharing & Third-Party Services

We share data only with trusted infrastructure and service providers bound by strict confidentiality and data protection agreements:

• Cloud Infrastructure Providers: Telemetry is hosted on secure, SOC-2 Type II compliant cloud hosting environments with physical and network security safeguards.
• Payment Processors: We partner with certified payment service providers (Paystack, IntaSend, Safaricom M-Pesa) solely to process subscription payments. Payment processors receive billing identifiers only; they never have access to device telemetry, GPS logs, SMS messages, or call records.
• Legal Disclosures: We will only disclose customer information if compelled by a lawful, binding court order, valid subpoena, or applicable regulatory requirement, and only to the extent strictly required by law.

7. Security & Encryption Architecture

We implement bank-grade administrative, technical, and physical safeguards to prevent unauthorized access, alteration, or disclosure of user data:

• Encryption in Transit: All data transmitted between the Android mobile client, cloud servers, and web dashboard is encrypted using Transport Layer Security (TLS 1.3 / HTTPS) with modern cryptographic ciphers (ECDHE-X25519, AES-256-GCM).
• Encryption at Rest: All stored telemetry (messages, coordinates, call records) is stored in zero-knowledge encrypted database vaults using AES-256 encryption.
• Zero-Knowledge Access: Decryption keys are derived on the authenticated user's client session. MonitorMate staff and database administrators cannot read or inspect your private plaintext telemetry records.

8. Data Retention & User Account Deletion Policy

In strict compliance with Google Play's Account and Data Deletion Policy, we provide all users with transparent data retention windows and direct self-service mechanisms to permanently delete their account and associated data:

A. Data Retention Timeline

• Active Telemetry: Device logs (GPS coordinates, calls, SMS, app usage) are retained only while your subscription remains active, or on a rolling 30-day window based on plan limits.
• Account Records: Account registration metadata (email address, billing history) is retained for the duration of the account plus statutory accounting requirements (up to 7 years for financial records).

B. Account & Data Deletion Mechanism (Google Play Mandatory)

You have the absolute right to delete your account, remove paired devices, and permanently wipe all telemetry data at any time through the following methods:

9. Children's Privacy (COPPA & GDPR-K Compliance)

MonitorMate complies with the Children's Online Privacy Protection Act (COPPA) in the United States and Article 8 of the GDPR in the European Union:

• The Application is marketed and intended for purchase and administration solely by adults aged 18 or older (parents, legal guardians, or authorized employers).
• When the Application is installed on a device utilized by a minor child under 13 (or under 16 in the EU), it must be installed directly by that child's legal parent or guardian possessing lawful parental authority.
• We do not knowingly collect personal data directly from children without parental authorization. Parents have the full right to review, export, or delete any data gathered from their child's device at any time.

10. User Rights & Regulatory Compliance

Depending on your geographic location, you possess specific statutory rights regarding your personal information:

• Right of Access & Portability (GDPR Art. 15 / CCPA): You have the right to request a copy of the personal data we hold about you in a structured, machine-readable format.
• Right to Rectification (GDPR Art. 16): You may correct inaccurate or incomplete account information directly in your user profile.
• Right to Erasure / Right to be Forgotten (GDPR Art. 17): You may request the permanent deletion of your data as detailed in Section 8.
• Right to Withdraw Consent: You may revoke device permissions or disconnect paired devices at any time.
• California Privacy Notice (CCPA/CPRA): We do not “sell” or “share” consumer personal information as defined under California law.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect enhancements to our Application, operational practices, or updates to Google Play Developer Policies and legal regulations. When material changes are made, we will update the “Effective & Last Updated” date at the top of this page and notify active subscribers via email or prominent in-dashboard notice prior to the change taking effect.

12. Developer Contact Information

If you have questions, feedback, data subject requests, or inquiries regarding this Privacy Policy or our data handling practices, please contact our dedicated Data Protection Officer: