1. Consent Principles
Where consent is required, VMATIC Shield will seek it through a clear, affirmative action after presenting understandable information about the data categories, purpose, key consequences and method for withdrawing consent. Consent will not be inferred solely from silence, pre-ticked controls or continued browsing where affirmative consent is required.
Consent for a purpose should be separate from unrelated terms where appropriate. Refusal of optional processing should not prevent access to unrelated core features unless the feature genuinely depends on that processing.
2. Just-in-Time Permission Notices
Before requesting an Android permission or special access, the app should explain: the feature that needs it; the signal or information involved; why it is useful for fraud-risk awareness; whether information leaves the device; how long it may be retained; and how to revoke access. The system permission prompt should follow this explanation.
Examples may include notification access to evaluate selected notification-based fraud indicators, usage access to identify relevant app-state patterns, or accessibility access only if a documented and permitted feature genuinely requires it. These are examples, not confirmation that all such permissions are currently required. Permissions must not be used to collect unrelated content.
3. Permission Register and Review
Product and engineering owners should maintain a current permission register identifying each permission, feature, data signal, processing location, retention, lawful basis, user-facing explanation and responsible owner. Permissions that are unused, redundant or no longer necessary should be removed. Each release should be tested against the register and Google Play policies.
4. Consent Records
Where appropriate and proportionate, records should capture the notice version, purpose, affirmative action, timestamp and withdrawal status. Consent records should not contain unnecessary sensitive content and must themselves be protected against unauthorised access or alteration.
5. Withdrawal and Revocation
Users should be able to withdraw consent through a channel that is reasonably accessible and no more difficult than providing it, subject to applicable law. Users may also revoke Android permissions through device Settings. The app should explain which functions stop working after withdrawal and avoid dark patterns or repeated coercive prompts.
6. Security Controls
Personal data and security signals should be protected using access restrictions, secure transmission, controlled retention, secure development, logging and incident response appropriate to the risk. Access to data should be limited to personnel and providers who need it for authorised work. Security measures must be reviewed when data flows or threat conditions change.
7. Transparency About Limitations
Permission approval does not mean VMATIC Shield can guarantee fraud prevention or observe every threat. Android platform controls, device settings, user choices and app version affect detection. The product must accurately distinguish between a signal that is available, an inference generated from that signal, and an event that is confirmed.
8. Complaints and Requests
Users may ask questions, withdraw consent or raise a concern by contacting business@vmatic.in with the subject “VMATIC Shield Consent and Security”. Do not send passwords, PINs or OTPs.
Contact
Vmatic Global Technologies Private Limited
Product: VMATIC Shield
Website: vmaticshield.com
Privacy and policy queries: business@vmatic.in — please use the relevant policy name in the email subject.
↑ Back to top