1. About this Policy
VMATIC Shield is a digital-fraud intelligence and safety product powered and developed by Vmatic Global Technologies Private Limited (“Vmatic”, “we”, “us” or “our”). This Privacy Policy explains how information may be collected, used, disclosed, retained and protected when a person uses the VMATIC Shield app, website, support channels or related services.
This document is a policy framework for the product. The final published version must match the current app build, actual SDK behaviour, backend architecture, third-party SDKs and Google Play Data safety declarations. Where an app feature or data category is not implemented, it must not be represented as collected.
2. Scope and Roles
This Policy applies to end users of the consumer app and visitors to our website. Certain VMATIC Shield capabilities may also be deployed for banks, NBFCs, fintechs or other institutional customers. In an enterprise deployment, the customer organisation may determine the purposes and means of processing certain data, while Vmatic may process it under the relevant contract and documented instructions. The applicable contract and deployment-specific notice should clarify the parties’ roles.
“Personal data” means information about an identified or identifiable individual, as defined by applicable law. Device and application signals may be personal data when they can be linked to an individual or device.
3. Information That May Be Processed
Depending on the enabled features and the permissions affirmatively granted, the app may process: (a) device and app information such as OS version, app version, device integrity indicators and installation or application-risk signals; (b) permission and security-posture indicators, such as whether specified high-risk permissions or accessibility features are enabled; (c) diagnostic, crash, performance and security-event records; (d) user-provided information such as support messages or contact details; and (e) consent, preference and policy-acceptance records.
Some fraud-detection features may require contextual indicators, for example whether a remote-access application is present or active, whether an unknown APK installation source is involved, or whether certain suspicious device behaviours are observed. The exact indicators available depend on Android permissions, platform restrictions and the release. The app must not imply that it can read all messages, listen to calls, determine voice authenticity, inspect every application, or monitor all activity unless that capability is technically implemented, lawful and specifically disclosed.
VMATIC Shield is designed not to request or access banking passwords, PINs, OTPs, payment credentials or account balances as part of its core fraud-intelligence purpose. If a future feature changes this boundary, the notice and consent flow must be updated before release.
4. Permissions and Why They May Be Needed
Android permissions or special access may be requested only when a feature requires them and only after a clear explanation. Depending on the actual release, these may include usage access, notification access, accessibility access, display-over-other-apps, app installation or package visibility, camera, microphone, location or other device capabilities. This list is illustrative, not a statement that every permission is currently used.
Each permission request should identify the relevant feature, the data or signal involved, the purpose, whether processing occurs on-device or on a server, and how access can be revoked. A permission is not a blanket consent to use unrelated data. If a permission is denied, some features may be unavailable, but the app should explain the impact without misleading the user.
5. Purposes and Lawful Basis
We may process relevant information to provide security diagnostics and fraud-risk indicators; detect, assess or explain suspicious app, device or behavioural patterns; generate alerts; maintain and improve reliability; troubleshoot support requests; prevent abuse; protect the service; maintain audit records; comply with legal obligations; and manage user choices and consent.
Where applicable law requires consent, we will request consent through a clear affirmative action and describe the specific purpose. Consent should be as easy to withdraw as it was to provide. Where processing is permitted on another lawful basis, we will document that basis and limit processing to what is necessary.
6. Sharing and Disclosure
We do not sell personal data. Information may be shared with vetted hosting, security, analytics, communications or support providers only where needed for a stated purpose and subject to appropriate contractual and security controls. Data may be disclosed where required by law, valid legal process, to address a security incident, or to protect rights and safety.
In a bank or enterprise deployment, security events may be shared with the institution’s authorised systems or fraud teams according to the configured integration, user notice, applicable law and customer agreement. We do not authorise recipients to use the information for unrelated purposes.
7. Storage, Retention and Deletion
We retain information only for as long as reasonably necessary for the stated purpose, security, dispute resolution, audit, contractual requirements or applicable law. Retention periods should be defined by data category and deployment. When information is no longer required, we will delete it, securely erase it, or irreversibly de-identify it, subject to lawful retention requirements and backup cycles.
Deleting the app may remove local data but may not automatically delete records already transmitted to a server or held by an enterprise customer. Users can request deletion using the process in the User Data Deletion Policy.
8. Security Measures
We use safeguards appropriate to the nature of the information and risks, which may include access controls, least-privilege access, encryption in transit, secure configuration, logging, vulnerability management, backups, staff confidentiality and incident-response procedures. No system can be guaranteed completely secure. Specific safeguards vary by deployment and should be described only to the extent they are implemented.
9. User Choices and Rights
Subject to applicable law, users may request access to information about their data, correction or updating, deletion, withdrawal of consent, grievance review, or other rights available under applicable data-protection law. Certain requests may be limited where information must be retained for legal, security, fraud-prevention or dispute purposes. We will explain any lawful limitation.
Users can also review and revoke Android permissions through device Settings. Revoking a permission may disable the associated feature.
10. Children
VMATIC Shield is not designed to knowingly collect personal data from children without the approvals or safeguards required by applicable law. If the service is made available to children or is likely to be used by them, age-appropriate notices, parental-consent and other legally required controls must be implemented before such use.
11. Cross-Border Processing and Third Parties
Depending on hosting, support and service-provider arrangements, information may be processed in locations permitted by applicable law. We will apply contractual and organisational safeguards as required. Third-party websites, app stores and services have their own privacy policies; users should review them separately.
12. Changes and Contact
We may update this Policy when features, legal requirements or processing practices change. The updated version will show its effective date and will be made available through the website or app. Material changes requiring fresh notice or consent will be handled accordingly.
For privacy requests or questions, contact business@vmatic.in with the subject “VMATIC Shield Privacy Request”. Please do not include passwords, OTPs, PINs or other sensitive credentials in your request.
Contact
Vmatic Global Technologies Private Limited
Product: VMATIC Shield
Website: vmaticshield.com
Privacy and policy queries: business@vmatic.in — please use the relevant policy name in the email subject.
↑ Back to top