Privacy Policy

1. Introduction

Sustainsys Ltd ("Company," "we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how the SustainsysAI mobile application ("App") collects, uses, discloses, and safeguards your information when you use our App.

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our App. By accessing and using the App, you acknowledge that you have read, understood, and agree to be bound by this entire Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly

We collect information that you voluntarily provide when registering and using the App:

• Registration Data: Full name, email address, and organisation/company name when creating your account
• Profile Information: Photos you upload from your device's camera or photo library for your profile
• Learning Progress Data: Your engagement metrics, course completions, quiz results, and learning activity within the App

2.2 Information Collected Automatically

We automatically collect certain information about your device and App usage:

• Device Information: Device type, operating system, unique device identifiers, and device settings
• Usage Analytics: How you interact with the App, features accessed, time spent on sections, and error logs
• Security Tokens: Authentication tokens generated by our secure token storage system for session management
• Notification Preferences: Data related to push notification delivery and engagement

2.3 Permissions and Hardware Access

The App requests access to the following device features:

• Camera: To allow you to take profile photos within the App
• Photo Library: To allow you to upload existing photos for your profile

You can control these permissions through your device's settings at any time. Restricting permissions may limit certain App functionality.

3. How We Use Your Information

We use the collected information for the following purposes:

• To create and manage your user account and provide App functionality
• To deliver personalised learning experiences and track your educational progress
• To send push notifications about your learning activities, achievements, and App updates
• To understand user behaviour and improve App features, performance, and user experience
• To diagnose technical issues and maintain App security and stability
• To comply with legal obligations and enforce our Terms of Service
• To prevent fraud, misuse, and ensure the safety of our users

4. Data Storage and Security

4.1 Secure Token Storage

Authentication tokens and sensitive credentials are stored using the Expo Secure Store system, which provides encrypted storage on your device. This ensures that login credentials and session tokens cannot be accessed by other applications.

4.2 Data Protection Measures

We implement comprehensive security measures to protect your personal data:

• SSL/TLS encryption for all data transmitted between the App and our servers
• Encrypted storage of sensitive information on your device
• Restricted access to personal data by authorised personnel only
• Regular security audits and vulnerability assessments
• Secure authentication mechanisms and password protocols

4.3 Data Location

Your data is stored on secure servers within the European Union, in compliance with data protection regulations including GDPR. We maintain reasonable administrative, technical, and physical safeguards to protect your information against unauthorised access, alteration, disclosure, or destruction.

5. Third-Party Services and Integrations

5.1 Expo Services

The App is built using Expo and utilises the following Expo services:

• Expo Notifications: For push notification delivery. Limited notification metadata may be processed by Expo's servers. Refer to Expo's privacy policy for details.
• Expo Secure Store: For local encrypted storage of authentication tokens on your device.

5.2 Third-Party Providers

We may use third-party service providers to assist with analytics, cloud storage, and technical infrastructure. These providers are contractually obligated to use your data only as necessary to provide services to us and to maintain the confidentiality and security of your information.

5.3 No Data Selling

We do not sell, trade, rent, or otherwise disclose your personal information to third parties for their direct marketing purposes. We only share information with service providers who are contractually bound to use data exclusively for providing services to Sustainsys Ltd.

6. Your Privacy Rights (GDPR and Other Regulations)

6.1 GDPR Rights (EU/EEA Residents)

If you are located in the European Union, European Economic Area, or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access: You have the right to request a copy of the personal data we hold about you
• Right to Rectification: You have the right to request correction of inaccurate or incomplete data
• Right to Erasure: You have the right to request deletion of your personal data (subject to legal exceptions)
• Right to Restrict Processing: You have the right to request restriction of how we process your data
• Right to Data Portability: You have the right to receive your data in a portable format and transmit it to another organisation
• Right to Object: You have the right to object to processing of your data
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local Data Protection Authority

6.2 Exercising Your Rights

To exercise any of these rights, please contact us using the information in Section 9 (Contact Information). We will respond to your request within 30 days, or as required by applicable law.

6.3 Legal Basis for Processing

We process your personal data on the following legal grounds:

• Contract Performance: To provide App services and features you have requested
• Legal Obligation: To comply with applicable laws and regulations
• Legitimate Interests: To improve our App, prevent fraud, and maintain security
• Consent: Where you have explicitly consented to specific processing activities

7. Data Retention

We retain your personal data only for as long as necessary to provide our services and fulfil the purposes outlined in this Privacy Policy. Specific retention periods are as follows:

• Account Information: Retained while your account is active and for 12 months after account deletion for legal compliance and dispute resolution
• Learning Progress Data: Retained for the duration of your learning engagement and for 24 months thereafter for analytics and improvement purposes
• Device and Analytics Data: Retained for up to 90 days for service improvement; aggregated analytics may be retained longer
• Security Tokens: Retained until invalidated or expired; refreshed tokens replace older ones

You may request deletion of your account and associated data at any time by contacting us. We will delete personal data within 30 days of your request, except where retention is required by law.

8. Children's Privacy

The App is not directed to users under the age of 13 years. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected information from a child under 13, we will promptly delete such information and terminate the child's account.

For users ages 13-18 in the EU, we provide additional privacy protections and limit data processing to what is necessary for service delivery.

If you believe we have collected information from a child under 13, please contact us immediately.

9. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy, your personal data, or to exercise your privacy rights, please contact us:

Data Protection Authority: If you are an EU/EEA resident and wish to lodge a complaint with your local Data Protection Authority, you can find their contact information on your country's data protection authority website.

10. Changes to This Privacy Policy

Sustainsys Ltd reserves the right to update or modify this Privacy Policy at any time. Changes will be effective immediately upon posting to the App or our website. We will notify users of significant changes via email or through a prominent notice in the App. Your continued use of the App after such modifications constitutes your acceptance of the updated Privacy Policy.

11. Additional Information

11.1 Compliance Standards

This Privacy Policy is designed to comply with:

• General Data Protection Regulation (GDPR) - EU/EEA
• UK Data Protection Act 2018
• Children's Online Privacy Protection Act (COPPA) - USA
• Apple App Store Review Guidelines
• Google Play Store Policy Requirements

11.2 Cookies and Tracking

The App does not use traditional cookies. However, we may use device identifiers and analytics tools to understand App usage patterns and improve user experience.

11.3 Do Not Track Signals

Some browsers and devices include a "Do Not Track" feature. Currently, industry standards do not mandate how digital services should respond to such signals. We do not modify our data collection practices based on Do Not Track signals.