Effective date: 25 October 2026
Operator and scope
iTrack is operated by Abu Wisam SLLC, Muscat, Oman, PC 122. Contact privacy@abuwisam.com about privacy or personal-data requests, and support@abuwisam.com for product support. Both addresses forward through Spaceship to the operator’s existing Gmail inbox.
This policy describes the iTrack mobile application and related operational services. Your organization administers your company, site, role and workspace access. Ask your organization about its workplace monitoring instructions and the operational records it controls.
Information we process
Depending on your permissions and the workflows you use, iTrack processes your name, email address, phone number, username, employee and account identifiers; company, site and role assignments; vehicle and driver assignments; journey plans and activity; inspection and checklist answers; fuel entries and receipt details; Stop Cards and safety observations; comments, signatures, acknowledgements and associated dates.
Photographs you capture or select may include receipts, odometer readings, inspection evidence or safety observations. Receipt processing can extract transaction details, fuel-card numbers, station, product, quantity, prices and totals. Submitted records are associated with the relevant account, company, vehicle and operational site.
During an active journey, iTrack can collect precise or approximate location, accuracy, timestamps and movement information. With permission, location updates can continue in the background or while the screen is locked. Authorized operational users can view relevant journey information. Journey planning and maps also use selected work locations.
Support requests include what you submit and relevant app/build, operating-system, workspace or screen information. Push registration associates a notification token, platform and app version with your account. Infrastructure and external map/model services receive network request metadata, such as IP addresses and requested resources.
Purposes and authorized access
We use information for authentication, company and site access, authorized workspaces, administration, journey operations and dispatch, vehicle inspections, fuel reconciliation, safety reporting, operational evidence and PDFs, notifications, support, security and accountability. Access depends on organizational roles and permitted scope. Cached company or site information does not authorize server access.
This release does not use advertising identifiers or advertising-related tracking. Operational journey location collection is distinct from advertising tracking. Optional iTrack product analytics and iTrack crash-reporting integrations are disabled in this release configuration. This does not disable Google ML Kit’s SDK diagnostics and usage information described under On-Device Translation. Support diagnostics are processed separately. Apple may process platform or TestFlight diagnostics according to its own services and settings.
Voice entry and transcription
Current Stop Card voice entry uses supported on-device speech recognition or an installed offline Whisper model. Temporary audio is processed on the phone and removed after successful processing, explicit discard or editor closure; failed transcription may remain locally while you retry. Submitted transcripts and relevant language/provenance information become part of the safety record. Review the transcript and any English translation before submission.
Original Stop Card voice recordings are not retained on the server. Server speech and translation providers are disabled in this release; current voice entry uses the on-device transcription described above. Submitted text can be retained as part of the safety record. Any future original-audio retention requires separate approval, implementation and updated notices and disclosures.
On-Device Translation
iTrack uses Google ML Kit to translate Stop Card text directly on your device.
To enable translation, the required language models must first be downloaded. These downloads connect to Google’s services. Once downloaded, translation can work without an internet connection.
Google ML Kit may collect certain technical and usage information, including device and application details, installation identifiers, language settings, performance information and diagnostic data.
The original text, English translation and translation details are retained as part of the submitted Stop Card record, in accordance with iTrack’s data retention and deletion policies.
Providers and processing
Authorized customer administrators, supervisors, dispatchers and safety/compliance personnel can access records within their permitted roles and scope. iTrack uses Hetzner hosting and Cloudflare R2 object storage. Groq processes receipt and odometer images for extraction; iTrack can retain the images, results and OCR audit information. Groq’s published controls describe possible limited reliability/abuse retention, including up to 30 days in some configurations; we have not established that zero-data-retention is enabled for this account.
Resend provides outbound email delivery; the email-delivery domain is configured in Tokyo, Japan (ap-northeast-1). Privacy and support correspondence sent to the published addresses is forwarded by Spaceship to the operator’s Gmail inbox, where Google also processes it. Expo and Apple push services support notifications. OpenStreetMap tile infrastructure receives map requests, IP metadata and the viewed area. Hugging Face supplies an optional model download; that download does not upload employee audio.
These services involve international providers. Hosting, storage, backup and provider processing locations are not all established by the application source alone. Contact privacy@abuwisam.com for information about the processing arrangements applicable to your organization. An absence of names does not make account identifiers, notification tokens or location anonymous.
Local storage and device choices
iTrack stores account/company context, language and settings, cached data, drafts and queued evidence for offline work. Authentication secrets use device secure storage. Offline evidence remains associated with its originating account and synchronizes when connectivity and authorization permit. Signing out does not necessarily discard unsent evidence. We do not claim that every cached item or photograph is encrypted by the application.
Face ID and Touch ID are handled by the operating system; iTrack does not receive biometric templates. Location, camera, photos, microphone, speech recognition and notification permissions can be managed in device settings. Declining a permission can limit the corresponding workflow.
Retention
The current service has no general automatic expiry for submitted operational records, images, signatures, Stop Cards, fuel/OCR records, support records or audit history. Account deactivation or uninstalling iTrack does not automatically delete submitted records. The GPS retention scheduler is inactive; a source-code default is not an operational deletion schedule. The manual request process assesses whether continued retention is needed for the processing purpose, a specific applicable legal requirement or a valid hold.
Database, evidence and configuration backups are retained separately. Current backup rotation selects seven daily, four weekly and three monthly copies for future backups; existing-copy cleanup and local deletion are not enabled by that policy. These counts do not establish a maximum lifetime for all copies. Historical or local backups may remain, and deleting a live record does not automatically erase its backups.
Access, correction and deletion requests
Email privacy@abuwisam.com to request access, a copy or transfer of your personal data, correction, updating, account deletion or personal-data deletion. You may also ask about withdrawing consent or restricting processing where applicable. Identify your organization and account and describe your request. Do not send passwords, authentication codes or unnecessary identity documents. We may need to verify identity and coordinate with your organization before locating or changing operational records.
Account deactivation preserves history and is distinct from personal-data erasure. Requests require review of the relevant records and backups. If information must be retained for an applicable legal requirement or valid hold, the reason must be specific; being an operational record is not a blanket exemption. The operator will explain the handling of your request and any applicable retention limitation. See Data Deletion for the request process.
Requests are handled manually. The operator will explain the expected handling time, provide the outcome and confirm completed deletion. Applicable legal requirements govern the response and any information that must be retained. You may also raise a personal-data complaint with Oman’s Ministry of Transport, Communications and Information Technology (MTCIT).
Changes and contact
Material changes to collection, original-audio retention, analytics, monitoring or service providers require reassessment of notices and disclosures. Contact Abu Wisam SLLC, Muscat, Oman, PC 122; privacy@abuwisam.com. For product assistance, contact support@abuwisam.com.