Privacy Policy

1. Information We Process

a) Information You Provide

Your password is transmitted to your organisation's EPSPolicy server to verify your identity and is not retained by the app afterwards.

b) Information Returned by Your Organisation's Service

After a successful sign-in, the service returns and the app stores locally: administrator display name, email address, corporate identifier (Corp ID), role type, company name, mobile number, and an authentication token used to authorise subsequent requests.

c) Endpoint (Managed Computer) Information

To perform its function the app retrieves and caches information about the computers your organisation manages. This is organisational data about company-managed assets, not information about the app's user:

• Machine name and license identifier
• Local IP address
• Operating system name
• Name of the user signed in to that computer
• Assigned security policy, group, and applied/pending status
• Last update, last setting and last client-activity timestamps
• Administrator comments recorded against the machine

d) Temporary Access Requests

When you raise a temporary access request, the app stores the request's state on the device so it survives the app being closed and reopened: the affected computer's identifier and IP address, the associated user name, the request's start and expiry timestamps, and the latest status message returned by the server.

e) What We Do Not Collect

The app contains no analytics, advertising, crash-reporting or tracking SDKs. It does not collect device identifiers or advertising IDs, does not access your location, contacts, camera, microphone, photos, files, call logs or SMS, and does not build user profiles. No data is sold or shared with third parties for advertising.

2. Where Your Information Is Stored and Sent

• On your device: all locally held information is written to the app's private storage area (Android SharedPreferences), accessible only to this app. It is removed when you sign out or uninstall the app.
• Over the network: the app communicates only with your organisation's EPSPolicy service at epsandroid.npav.net. No data is transmitted to any other destination.
• Transport security: all communication between the app and the EPSPolicy service is encrypted in transit using HTTPS (TLS). This includes your credentials at sign-in, your authentication token, and all managed-computer information.

The app does not permit unencrypted (cleartext HTTP) connections at all: cleartext traffic is disabled at the application level, so a downgrade to an unencrypted connection fails rather than silently proceeding.

3. Permissions the App Requests

The foreground service runs only when you explicitly tap "Continue in Background" on an active temporary access request, and stops automatically once the request is resolved or cleared. It performs no background activity at any other time, and collects nothing beyond the status of the request you started.

4. How Long Information Is Kept

• You sign out — all stored account information, cached machine records, policy lists and any temporary access state are deleted from the device.
• You uninstall the app — Android removes the app's private storage entirely.

Information held on your organisation's EPSPolicy service is governed by your organisation's own retention practices and administrator agreement, not by this policy.

5. Deleting Your Data

To delete all information the app has stored on your device, either sign out from within the app, or uninstall it. Both remove the app's locally stored data.

Requests concerning data held on the EPSPolicy service itself — including account deletion — should be directed to your organisation's administrator or to us at info@sec-matrix.com.

6. Children

EPSPolicy is a workplace administration tool. It is not directed at children, and we do not knowingly collect information from anyone under the age of 16.

7. Security

Locally stored information is held in the app's private storage, which other applications on a non-rooted device cannot read. Access to the app requires valid administrator credentials, and sessions expire — when your authentication token is no longer valid you are signed out and must sign in again. All network communication is encrypted using HTTPS (TLS), as described in section 2.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by a new "Last Updated" date at the top of this page, and where appropriate communicated through your organisation's administrator.

9. Contact Us

Questions or requests about this policy or your data: