How NorbiTracka handles your data

1. Who we are

NorbiTracka (Lagos, Nigeria) operates NorbiTracka, a device security, anti-theft, family safety, and recovery service.

Privacy questions: info@norbitracka.com.

2. Data we collect

• Account: name, email, phone (optional), password hash, MFA secrets, plan tier, billing references.
• Device: model, OS, IMEI or hardware identifiers you provide, SIM fingerprint, battery, integrity signals (root/emulator/mock location), last-known location, location history while tracking is on.
• Security & recovery: lock PIN hashes, panic codes, protection settings, remote command logs, incident records, SOS dispatches, evidence artifacts (photos/audio hashes), BLE recovery tokens (no precise helper GPS).
• Usage: crash reports, audit logs (sign-in, device enrolment, command delivery), support tickets.
• Payments: subscription status and Paystack references — card numbers are processed by Paystack, not stored on our servers.

3. Why we use data

• Provide lock, locate, ring, wipe, and SOS features you enable.
• Detect theft, tampering, SIM changes, and suspicious sign-ins.
• Operate optional Device Administrator protection on Android when you opt in.
• Deliver SMS/push/email alerts to you and emergency contacts you configure.
• Bill subscriptions, enforce plan limits, and respond to support requests.
• Comply with law and prevent abuse of the platform.

4. Mobile permissions

The Android app requests sensitive permissions only to deliver features you turn on. A detailed permission list is published at /permissions/.

Background location is used for anti-theft tracking and SOS when you enable tracking on a enrolled device.

Camera and microphone may be used for intruder evidence or SOS only after you grant OS permission and enable those modules.

5. Device Administrator (Android, optional)

If you opt in, NorbiTracka uses Device Administrator privileges for owner-authorized anti-theft protection, remote locking, tamper resistance, and recovery on devices you voluntarily enroll.

You can enable, disable, or unenroll at any time from in-app Settings with your Lock PIN or fingerprint, then sign out and uninstall. See /device-admin/ for full disclosure.

6. Who we share data with

• Emergency contacts and family members you add — only the alerts and location sharing you trigger.
• Infrastructure providers (hosting, email, SMS, push, maps, Paystack) under contract and only to operate the service.
• Recovery helpers — privacy-preserving BLE tokens only; helpers never receive your precise GPS.
• Law enforcement — only when required by valid legal process or to prevent imminent harm.
• We do not sell personal data to advertisers or data brokers.

7. Retention

Location history and evidence follow your plan retention limits and active incident status.

Account deletion is available from the portal; see /delete-account/. Deletion is scheduled after a 14-day grace period unless blocked by an open incident or legal hold.

Backups may persist up to 30 days after deletion before overwrite.

8. Security

• TLS in transit; encrypted storage for credentials and sensitive fields at rest.
• HMAC-signed API requests from mobile clients.
• Staff access is role-based, MFA-enforced, and audited.
• Evidence artifacts are stored with cryptographic hashes for integrity.

9. Your rights

• Access and export your data from the portal where available.
• Correct account details in Settings.
• Withdraw consent by disabling modules, turning off tracking, or deleting your account.
• Lodge a complaint with Nigeria Data Protection Commission (NDPC) if you believe we mishandled personal data.

10. Children and families

NorbiTracka includes family and missing-child features for guardians protecting their household devices. See /child-safety/.

Accounts must be created by an adult guardian. Do not create an account on behalf of a child under 13 without parental authority where required by law.

11. International transfers

Primary processing occurs on infrastructure serving African users. Where subprocessors process data outside your country, we use appropriate safeguards.

12. Changes

We may update this policy. Material changes will be posted on this page with a new effective date. Continued use after changes means you accept the updated policy.