MoboCheck ("MoboCheck", "we", "us" or "our") provides software for phone diagnostics, grading and ADISA-certified data erasure. This Privacy Policy explains how we protect the personal data we process for our clients, our website visitors, and our staff and business contacts: what we collect, why, who we share it with, how long we keep it, and the rights people have.
1. Who this policy covers
This policy covers the MoboCheck platform (the desktop station software for Windows and macOS, the iPhone and Android apps, the cloud services, the API and the back office), the mobocheck.com website, devices in MoboCheck's custody, and MoboCheck's own records about staff, applicants, clients and suppliers. It applies to all MoboCheck employees, contractors and providers that process personal data for us.
For client data in the MoboCheck platform, the client decides why and how the data is used and is the controller. We process that data only on the client's documented instructions, as processor. For website visitors, staff and business contacts, we are the controller.
2. Definitions
Personal data: any information about an identified or identifiable person. In MoboCheck, device identifiers (IMEI, serial number, UDID and Wi-Fi MAC address) are treated as personal data because they can be linked to a device owner.
Controller: the party that decides why and how personal data is processed.
Processor: the party that processes personal data on behalf of a controller.
Sub-processor: a provider engaged by MoboCheck that processes client personal data.
Privacy incident: actual or suspected unauthorised access, disclosure, loss, alteration or destruction of personal data.
3. Personal data we process
Category | Data | Purpose |
|---|---|---|
Tester accounts (client staff) | First and last name, email address, username, role and station. Passwords are stored only as bcrypt hashes. | Sign-in, access control and linking test records to the tester |
Device records | IMEI, serial number, UDID, Wi-Fi MAC address, model, colour, storage, carrier, lock and device-management status, battery health, part serials, test results, grade and erase record | Diagnostics, grading, erase evidence and client reports |
Device and station logs | Diagnostic logs read from phones; station logs that testers upload for support | Troubleshooting and support |
Website visitors | Name, company, email address and phone number you send when you request a demo or contact us; pages visited, browser and device type, and referring address | Answering your request, and running, securing and improving the website |
MoboCheck staff and business contacts | Name, job title, work contact details, employment and training records | Employment, contracts and communication |
MoboCheck does not collect device owners' names, phone numbers, addresses or payment data, and does not copy photos, messages or contacts from phones. Personal data left on devices in MoboCheck's custody is not accessed, copied or used, and those devices are wiped with our ADISA-certified data erasure, with each erase verified and recorded.
4. How we use personal data
Client data: processed under the client contract and the client's documented instructions. The client is responsible for its lawful basis and for privacy notices to its own customers and staff.
Our own data: processed to perform contracts, meet legal obligations or serve legitimate business needs. We ask for consent where the law requires it.
No other use: we do not sell personal data, we do not use client data for marketing, and we never use production client data for development or testing.
New purposes or data: any new purpose or data field is approved by our Data Privacy Lead after a privacy impact assessment, before release.
5. Sharing, sub-processors and international transfers
We share personal data only with the sub-processors below, under contracts with data protection terms. Each is reviewed before use and every year.
Provider | Service | Personal data | Location |
|---|---|---|---|
DigitalOcean | Cloud servers and database | All MoboCheck cloud data | United States (New York, NYC1) |
Cloudflare | Web application firewall and traffic routing | Data passing through, encrypted | Global network |
Amazon Web Services (S3) | File storage | App files, configuration profiles and uploaded logs | United States (Virginia) |
Apple | App licence assignment (volume purchase) | Device serial number | Global network |
SickW | Blacklist, carrier and SIM-lock checks | IMEI | Global network |
Clients are told about a new sub-processor at least 30 days before it starts. Personal data stored outside the client's country is transferred only where the applicable law allows it (for Saudi clients, the transfer rules of the Personal Data Protection Law), with contractual safeguards and encryption in transit and at rest.
We may also disclose personal data to authorities where the law or a legal process requires it.
6. Your rights
Client data: if you are a customer or tester of one of our clients, the client controls your data. We pass any request we receive to that client without delay, and help the client answer access, correction and deletion requests within 7 days of its request.
Tester accounts: clients create, change and remove their own tester accounts. On request, we disable an account within one working day.
Data we control: you may ask for access, correction, deletion or a copy of your data, or object to its use, by writing to [email protected]. We answer within 30 days.
Records: we record each request, our answer and the date.
7. How long we keep data
Information | Kept for | Disposal |
|---|---|---|
Station and phone logs on the station computer | 30 days | Deleted automatically by the desktop app |
Cloud server logs | 3 months | Deleted |
Cloud device records and tester accounts | Contract term, or the period the client sets | Deleted within 90 days after the contract ends and the client has exported its data |
Backups | 7 days | Expire on a fixed schedule |
Data a client asks us to delete | Until the request | Deleted within 7 days, and the client is told |
Staff and business contact records | As long as the law requires | Deleted or anonymised when no longer needed |
8. How we protect personal data
Personal data is protected under our Information Security Policy: named, least-privilege access with multi-factor sign-in; HTTPS with TLS 1.2 or later; encryption at rest; bcrypt password hashes; secrets masked in logs; logged support access; and confidentiality agreements and yearly training for everyone with access. Devices processed through MoboCheck are wiped with ADISA-certified data erasure, and each erase is recorded as evidence for the client.
9. Privacy incidents
Anyone can report a suspected privacy incident to [email protected] or [email protected].
Our Data Privacy Lead and Information Security Officer assess which personal data and people are affected, contain the incident and keep evidence.
We tell affected clients within 24 hours of confirming an incident, with what is known, so they can meet their own legal deadlines.
Where MoboCheck is the controller, we notify the regulator and the people affected as the law requires.
We record the cause and the fixes, and management approves the closure.
10. Privacy by design and training
Impact assessments: new features, providers or uses that involve personal data get a privacy impact assessment before work starts.
Minimum data: by default we collect only the data the purpose needs.
People: everyone with access to personal data signs a confidentiality agreement and completes privacy training when they join and every year after.
11. Cookies
We use essential cookies to run the website and sign-in sessions, and may use analytics cookies to understand how the site is used. You can control cookies in your browser settings; turning off essential cookies may stop parts of the site from working.
12. Laws and standards
We follow the Saudi Personal Data Protection Law (PDPL) for Saudi clients, UAE data protection law for our own operations, and the data protection terms of each client contract. MoboCheck's data erasure is ADISA certified. We do not hold an ISO/IEC 27001 or ISO/IEC 27701 certification; our policies use those standards as references.
Related policies: Information Security Policy and Business Continuity Policy.
13. Contact us
For questions about this policy or to use your rights, write to [email protected].
14. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top shows when it last changed, and we tell clients directly about changes that affect their data.