VZone FormsWho we are
VZone Forms is a field data collection service made up of the VZone Forms apps for Android and iOS and the VZone Forms web app. It is provided by V ZONE INTERNATIONAL L.L.C, Dubai, United Arab Emirates ("we", "us").
VZone Forms is sold to organisations, such as companies, which create accounts for their own staff. If you use VZone Forms, your account was created by your organisation, and your organisation decides which forms you fill in and what those forms ask. For the answers you submit, we process data on your organisation's behalf and under its instructions. This policy explains what we collect, why, who can see it, and how long we keep it.
What we collect
| Data | What it is and when |
|---|---|
| Account details | Your name, email address, role, and organisation, entered by your organisation's administrator. Your password is never stored; we keep only a salted, one-way hash of it. |
| Form entries | The answers you give in a form: text, numbers, dates, choices, signatures, and any photos or files you attach. What a form asks for is decided by your organisation. |
| Precise location | Only when a form has a location field and you tap Capture current location. The app reads your position once, at that moment. It never tracks your location in the background. |
| Photos and files | Only the ones you choose to take or attach to a form. |
| Device information | When you sign in on a phone or tablet, the app registers a random identifier created for that installation, along with the device model, the operating system version, and the app version. Your organisation uses this to see which devices have access, and to revoke one. |
| Activity records | An audit trail of actions in the service, such as who submitted, changed, or exported an entry and when, which your organisation can review. |
| Sign-in and security data | Session and refresh tokens that keep you signed in, and the network address of sign-in attempts, which is held briefly in memory to block repeated password guessing. |
Processed on your device only
- Scanning. When you scan a barcode, a QR code, or text on a document or business card, the recognition happens on your device. The image is not uploaded; only the text you choose to put in a field becomes part of your entry.
- Face ID, Touch ID, and fingerprint unlock are handled by your device's operating system. We never receive biometric data.
- Drafts and entries waiting to sync are kept on your device in an encrypted database until they are sent or you delete them.
Diagnostic data received by Google
The on-device scanning uses Google ML Kit. To measure how it performs, ML Kit sends Google technical information: the device model and operating system version, the app name and version, an identifier for the installation, and timings and error codes. It does not send the images or the text that was read. Google encrypts this in transit and does not pass it to others. See ML Kit's data disclosure.
What we do not collect
VZone Forms shows no advertising and contains no advertising or analytics trackers. It does not follow you across other companies' apps or websites, and it does not read your contacts, messages, or photo library beyond the photos you pick.
How we use it
- To run the service: to sign you in, show you the forms assigned to you, save and sync your entries, and let authorised people in your organisation review and export them.
- To keep the service secure: to detect and block misuse, scan uploaded files for malware, and investigate problems.
- To support you and your organisation when you ask for help.
We do not sell personal data, and we do not use it for advertising or profiling.
Who can see it
- Your organisation. Depending on your role, other users in your organisation can see the entries you submit. Administrators can see all of the organisation's entries, activity records, and registered devices.
- Destinations your organisation sets up. Your organisation may choose to send entries to email recipients, to its own systems through webhooks, or to a Google Sheets spreadsheet. When it does, the entry goes to that destination, and that service's own privacy terms apply.
- Our service providers. The service is hosted by Leaseweb Canada Inc. in Canada, which stores the data for us and may not use it for anything else. This means your data is stored outside the United Arab Emirates. Uploaded files are scanned for malware on our own servers.
- When the law requires it. We disclose data if we are legally required to, or to protect the rights, safety, or security of users and the service.
How we protect it
- All traffic between the apps and our servers is encrypted with HTTPS.
- On your device, drafts, queued entries, and attachments are stored encrypted, with the keys held in the device's secure storage (the iOS Keychain or the Android Keystore).
- Access within an organisation is limited by role. Every access to the service requires a signed-in account.
How long we keep it
- Account details are kept while your account exists.
- Form entries, attachments, and activity records are kept for as long as your organisation keeps them in the service. It can delete them at any time.
- Sessions expire after 12 hours, and the token that keeps you signed in on a device after 30 days, or immediately when you sign out.
- Backups are kept for 30 days, so deleted data leaves our backups within 30 days of being deleted.
- Data on your device is removed when you sign out, delete a draft, or uninstall the app.
Your choices and rights
- You can ask for your account and its data to be deleted, and ask for a copy of your data or for it to be corrected. Your organisation's administrator can also do this for you.
- You can refuse or withdraw camera and location access in your device's settings at any time. Only the fields that need them stop working.
- Depending on where you live, you may have further rights under data protection law, including the right to complain to a data protection authority.
Because your organisation controls your account and its entries, we may pass your request to your organisation and act on its instructions, as data protection law expects.
Children
VZone Forms is a workplace tool for adults. It is not directed at children, and organisations must not create accounts for children.
Changes to this policy
If we change this policy, we will update the effective date above. If a change is significant, we will also tell organisations before it takes effect.
Contact us
For privacy questions or requests, email support@vzoneinternational.com, or write to V ZONE INTERNATIONAL L.L.C, Dubai, United Arab Emirates.