Privacy Policy — Square One Orbit

1. Overview

Square One Orbit is an internal enterprise mobile and web application exclusively designed for Square One Mall's operational staff. It enables structured creation, assignment, tracking, and resolution of operational tasks (tickets) across all departments.

This app is not a public consumer application. Access is restricted to authorized Square One Mall employees only.

2. Who This Policy Applies To

Super Administrators
Administrators
Department Heads (HOD)
Department Managers
Supervisors
Employees

3. Information We Collect

3.1 Account Information

Full name
Email address
Employee grade / designation
Department assignment
Role within the organization
Profile photo (if provided)
Availability status

3.2 Activity Data

Tickets created, assigned, or resolved by you
Subtickets and cross-department task interactions
Feedback submitted on tickets
Login timestamps and session activity
IP address at time of login

3.3 Device & Technical Data

Device token (for push notifications via Firebase Cloud Messaging)
Device type and operating system (for notification delivery)

3.4 Media

Photos and short video clips uploaded as proof of ticket completion (camera-captured only, within the app)

3.5 Audit Log Data

All actions performed within the app (ticket creation, status updates, user management actions) are logged with timestamp, actor identity, and IP address for organizational accountability.

4. How We Use Your Information

Purpose	Data Used
Authenticate your identity	Email, password (hashed), JWT token
Assign and manage tickets	Name, role, department, availability
Send notifications	Device token, email address
Generate performance reports	Ticket history, resolution times, on-time percentages
Audit trail and accountability	All action logs with IP and timestamp
Monthly performance email reports	Name, email, ticket statistics

We do not use your data for advertising, third-party marketing, or any purpose outside of operational management within Square One Mall.

5. Account Creation & Deletion

5.1 Account Creation

Users cannot self-register on this app. All accounts are exclusively created and provisioned by authorized Super Administrators or Administrators within the Square One Mall management team.

This is an invite-only, organization-administered system. No sign-up or registration feature is available to end users.

5.2 Account Deletion

Because accounts are administrator-provisioned (not self-created), individual users do not have a self-service account deletion option. Account deletion is handled exclusively through your organization's administrator.

To request account deletion:

Contact your department's Super Administrator or Administrator
Email: admin-contact@squareonemall.com
All deletion requests will be processed within 7 business days

What happens when an account is deleted:

Account is deactivated (soft-delete — data preserved for audit purposes)
All active sessions are immediately invalidated
Open tickets assigned to the user are automatically transferred to the department head
Deletion is permanently logged in the audit trail

6. Data Sharing

We do not sell, rent, or share your personal data with any third party for commercial purposes. Data may be shared only in the following limited circumstances:

Recipient	What & Why
Firebase (Google)	Device push notification tokens — for delivering in-app notifications
Email delivery service	Your email address — for system notifications and monthly reports
Internal administrators	Your profile, ticket history — for operational management

7. Data Retention

Data Type	Retention Period
Active account data	Retained while employment continues
Deactivated account data	Retained for audit/compliance purposes per organizational policy
Audit logs	Retained indefinitely for accountability
Push notification tokens	Deleted upon account deactivation
Uploaded media (proof photos/videos)	Retained as part of ticket record

8. Data Security

Authentication: JSON Web Tokens (JWT) with expiry and token blocklisting
Passwords: Stored using industry-standard hashing (bcrypt)
Transport Security: All data transmitted over HTTPS/TLS
Session Management: Force-expiry on account deactivation
Access Control: Role-based access control (RBAC)
Audit Trail: All sensitive actions logged with actor identity, timestamp, and IP address

9. Your Rights

As an employee using this app, you have the right to:

Access your personal data held by the system (contact your administrator)
Correct inaccurate personal information (contact your administrator)
Request deletion of your account (see Section 5.2)
Know what data is collected about you (this policy)

10. Push Notifications

The app uses Firebase Cloud Messaging (FCM) to deliver push notifications. Your device token is stored solely for this purpose and is invalidated when you log out or when your account is deactivated.

You may disable push notifications at the device level through your phone's system settings. This will not affect your ability to use the app.

11. Children's Privacy

This app is intended exclusively for employed adults. We do not knowingly collect data from individuals under the age of 18.

12. Changes to This Policy

If this Privacy Policy is updated, users will be notified through the app or via email. Continued use of the app after changes constitutes acceptance of the updated policy.

13. Contact

Square One Mall — IT / App Administration

Email: admin-contact@squareonemall.com

Address: Square One Mall

App Store Review Note

Square One Orbit is a private, invite-only enterprise application for Square One Mall's internal staff. User accounts are provisioned exclusively by organization administrators — end users have no self-registration capability. This is consistent with Apple guideline 5.1.1(v). Account deletion requests are handled through the organization's administrator per Section 5.2 above.