QUEXLO PTT Privacy Policy

1. Scope

This Privacy Policy applies to the QUEXLO PTT Android app, Command Center and public product pages operated by Hawsabah. It explains what data the current service handles, why it is handled, who can receive it and the choices available to you.

QUEXLO PTT is a managed communications service for authorized teams. The organization that provisions your account may control your channel assignments and decide which operational features are required. That organization may provide an additional privacy notice that applies to its use of your data.

2. Data QUEXLO PTT handles

3. How data moves through the service

Internet-mode voice, messages, files, positions, alerts and camera uplinks pass through the authenticated QUEXLO PTT service. Authorized members receive live channel content, and authorized Command Center users can access the operational archives and live views available to their role. The service can process and present this content; it is not an end-to-end encrypted system in which Hawsabah or Command Center is technically unable to read the data.

Optional local-network mode also discovers and exchanges live traffic with devices on the same local network. Operational talks remain recordable: the speaking device uploads a local-network talk recording to the managed service after the floor is released.

4. Who can receive data

Hawsabah does not sell personal or sensitive data or use it for targeted advertising. Data may be disclosed to:

• Your organization, channel members and Command Center users: according to their assignments, roles and the operational features described above.
• Hosting and infrastructure providers: providers used to host the API, database, blob storage, backups or public website may process data to supply those services.
• Email delivery providers: when an administrator resets a password or a user requests self-service recovery, the configured mail service processes the recipient address, display name and either a temporary credential or a short-lived single-use reset link to deliver the message.
• Map providers: opening a map or location preview may send your IP address, browser/device information and the coordinates being viewed to Google Maps or OpenStreetMap.
• Public-page resource providers: the Principles page currently loads fonts from Google and code resources from jsDelivr, which can receive ordinary request information such as IP address and browser details.
• Google Play: Google processes store, installation, device and account information under its own policies when you obtain or update the app through Google Play.
• Authorities or transaction parties: when required by law, needed to protect rights or safety, or as part of a corporate transaction subject to appropriate safeguards.

5. Permissions

Android controls these permissions and settings. QUEXLO PTT uses them as follows:

• Microphone and audio settings: transmit push-to-talk audio and create voice notes.
• Camera: capture media you choose to share and run an accepted or user-started camera uplink.
• Precise, approximate and background location: report operational positions while enabled, including while the app is not visible when background reporting is active.
• Nearby Wi-Fi, network state and internet: discover local peers and connect to the configured QUEXLO PTT service.
• Notifications, full-screen alerts, Do Not Disturb access and vibration: present service status and command alerts according to their priority and your settings.
• Foreground services and wake lock: keep active microphone, playback, location, camera and synchronization work running when Android requires a foreground service.
• Bluetooth: use connected audio devices for calls and playback.
• Biometrics or device credential: unlock the optional app lock. Android performs the check; QUEXLO PTT receives the result and does not receive your fingerprint or face template.
• User-selected files: read a photo, video, audio item or document you select for upload. The app does not request broad Android storage access.

6. Device storage, retention and deletion

• On the device: account display data, access state, the configured server, channel selections and settings remain until changed, cleared, signed out where applicable, or removed by clearing app storage/uninstalling. Refresh credentials and an optional app PIN are stored using the device's encrypted storage.
• Recordings: authorized Command Center users can permanently delete completed talk recordings and stopped camera recordings from the active archive. Deletion removes the associated operational blob; limited metadata may remain in audit records or backups.
• Accounts: Command Center account deletion disables access and replaces direct identifiers in the live account record. Historical operational and audit records are retained so existing records remain attributable to an internal identifier, and some audit records may preserve earlier account values.
• Other operational records: messages, shared files, locations, alerts, acknowledgements, channel history, device records and audit records do not currently share one published automatic deletion period. Deleting an account or channel does not automatically erase all of those records.
• Backups and security records: removed data may persist through the applicable backup lifecycle or in logs and records needed for security, dispute resolution or legal compliance.

Retention can also depend on the deployment agreement and your organization's legal or operational requirements. To request access, correction or deletion, contact your account administrator or [email protected]. Hawsabah will assess the request subject to identity verification, applicable law and records that must be retained.

7. Security

QUEXLO PTT uses authenticated access controls, role and channel authorization, password hashing, token revocation and Android app sandboxing. Refresh credentials and an optional app-lock PIN use Android-backed encrypted storage; other session and preference data can be held in the app's WebView storage. The Android app requires encrypted HTTPS/WSS transport to its configured service. The server encrypts selected database fields and supports AES-256-GCM encryption for stored operational blobs when the deployment storage key is configured.

Storage encryption is deployment-dependent, and no system can guarantee absolute security. Because the managed service must relay, archive and present operational data, server-side administrators with appropriate access may be able to read it. Protect your device and credentials, and report suspected unauthorized access promptly.

8. Public website

The public QUEXLO PTT pages do not use advertising or analytics scripts. They store a light/dark theme preference in your browser. The hosting provider may create ordinary server logs containing information such as IP address, browser type, requested page, timestamp and response status. External resources and links are covered by their providers' policies.

9. Children

QUEXLO PTT is an authorized workforce and team-communications service and is not directed to children. If you believe a child has provided data through an account without proper authorization, contact us so the account and applicable records can be reviewed.

10. Changes and contact

Hawsabah may update this policy when QUEXLO PTT changes how it handles data. Material changes will be reflected on this page with a revised effective date.

Privacy contact: [email protected]. Include "PTT" and package "qptt.hawsabah.sa" in your message.