Privacy Policy

Effective Date:October 14, 2026 

 VistaTec Inc. (the “Company,” “we,” “us,” or “our”) provides iHub APP (the “App”) and related smart home services. This Privacy Policy applies to both the iOS and Android versions of the App and explains how we access, collect, process, use, and protect your data.

1. Data We Process and Why

Depending on the features you use, we process the following data as necessary: 

1.1. Account information: The name, email address, gender, date of birth, country, region, and profile photo provided during registration, as well as the email address and password authentication data used to sign in, for account creation, authentication, account management, customer support, and profile display. 

1.2. Device information: Gateway MAC addresses, device identifiers, account-to-device associations, device names, device types, device models, and firmware versions, for device setup, authorization, management, and control. 

1.3. Network configuration information: Wi-Fi network names (SSIDs), Wi-Fi passwords, Gateway local IP addresses, and necessary local network connection information, for Gateway Wi-Fi configuration, device discovery on the local network, Gateway connection verification, and establishing connections to the Gateway via MQTT to control smart home devices and query their status. 

1.4. Device status and event data: Device connection status, device on/off status, device control commands, and information returned by devices, for device control, status display, and device management.

1.5. Push notification information: Device events, abnormal condition alerts, and related notification information, for delivering event notifications to your phone.

1.6. Technical and security records: System operation and processing logs, device operation logs, and related timestamps, for service operation, security management, and troubleshooting. Data items that are not used are excluded from our collection practices. If a new purpose requires additional consent, we will explain the purpose and obtain the required consent first.

2. Phone Permissions and Related Data Processing

2.1 Location-Related Permissions and Wi-Fi Information During Gateway pairing or network configuration, the App may read the name of the currently connected Wi-Fi network (SSID) to verify the network connection. Certain operating system versions or Wi-Fi access methods may require location-related permissions. Our actual handling of location and Wi-Fi information is as follows: Geographic coordinates: The App does not actively collect users’ geographic coordinates. During Gateway connection and network configuration only, it obtains the permissions required by the phone’s operating system to read the Wi-Fi network name (SSID) and verify the network connection status of the phone and Gateway. Background location: None. SSID transmission and storage: The SSID is transmitted to the Gateway only during pairing to configure its network connection. Wi-Fi passwords: The password is transmitted to the Gateway only during pairing to configure its network connection. Denying the required permission may affect Wi-Fi network identification and Gateway configuration. 

 2.2 Camera The App uses your phone’s camera to scan QR codes to identify Gateway MAC addresses and unique smart device identifiers for device identification, pairing, and management. Scan images are analyzed only on the phone and are not stored or uploaded. When registering an account or editing a profile, you may use the camera to take a profile photo or select a profile photo. These images are uploaded to the backend server for profile display and account management. If you deny camera access, camera scanning and photo capture will be unavailable. Other features that do not require the camera will not be affected.

2.3 Notifications The App uses notification permissions and push notification services to deliver device events, abnormal condition alerts, and important service messages. To deliver notifications, we and our push notification service providers process device event information and related notification content. You may manage or disable relevant notifications in your phone’s system settings or in the App’s settings for individual devices. If notifications are disabled, you may not receive the relevant alerts in your phone’s notification center. 

2.4 Nearby Devices and Local Network Access When discovering, connecting to, or pairing a Gateway, the App uses permissions appropriate to the platform and communication method, such as Android nearby Wi-Fi devices permissions or iOS local network access. During discovery, the App processes Gateway identification information, Wi-Fi network names (SSIDs), and necessary network connection information. It exchanges data with the Gateway over the local network to establish device connections and configure the network. This information is used only as necessary for device pairing and network configuration. You may deny or revoke these permissions, but related discovery and pairing features may be limited.

3. Processing Periods, Locations, Recipients, and Methods 

Data is processed for the periods described in Section 4. Data is processed and stored in Northern Virginia, United States. Where cross-border services are used, the relevant processing locations and purposes are disclosed in this Policy. Authorized Company personnel and the following service providers process data electronically as necessary to provide the service: Amazon Web Services (AWS): Provides cloud computing, data storage, device management, and system monitoring services. Processes account information, device information, event records, and system logs, primarily in the United States. Apple Inc. (Apple Push Notification service): Provides push notification services for iOS. Processes necessary device push notification identifiers and notification content through Apple’s service infrastructure. Google LLC (Firebase): Provides push messaging and application error diagnostics when the relevant features are used in this service. Processes necessary device identification information, push notification data, and error logs. Processing may take place through Google’s global service infrastructure. We do not sell your personal data. Service providers acting on our behalf must process data for the agreed purposes and apply appropriate safeguards. If you use device sharing features, the Gateway administrator may share devices with other members and set each member’s access permissions. Authorized members may view device information and status and use related control features according to the permissions set by the administrator. Access to some device features may be restricted by these permissions. Where disclosure is required by law or a lawful government request, we disclose only the necessary data. If data is transferred as part of a business transfer, we will provide notice of the transfer and subsequent data handling as required by applicable law.

4. Data Retention and Deletion 

We retain data according to the following rules: Account and device association data: Retained while the account is active. After a user requests account deletion, related personal data and device association information are generally deleted within 30 days, unless retention is required by law or necessary for dispute resolution. Device event and control records: Generally retained for 180 days, after which they are deleted in accordance with the system’s data management procedures. Security and diagnostic records: Generally retained for 90 days for system maintenance, troubleshooting, and information security management. Permission or Terms acceptance records: Retained while the account is active and for 3 years after account termination, as necessary to verify consent and resolve disputes. Backup data: The system performs regular data backups. Backup data is generally retained for 30 days, after which it is automatically deleted through the backup rotation process. When the processing purpose no longer applies or the retention period expires, we delete the data or render it anonymous so that it can no longer identify an individual. Where specific data must be retained for legal compliance, security, or dispute resolution, we restrict its use and explain the data categories, reasons, and retention periods.

5. Your Rights and How to Exercise Them 

Subject to applicable law, you may request access to or review of your personal data, copies of your data, corrections or supplements, cessation of collection, processing, or use, and deletion. You may submit a request by contacting Service@vistatec.com.tw. We may perform necessary identity verification and will process and respond to requests in accordance with applicable law. You may manage system permissions in your phone’s settings. Revoking a permission does not delete previously stored data. Please submit a separate request if you wish to have that data deleted. If you do not provide information necessary for account verification, device pairing, or another feature, the relevant feature may be unavailable. Refusing nonessential data collection or uses does not affect other features that can be provided independently.

6. Account Deletion 

You may delete your account yourself using the account deletion feature in the App. Once the deletion process is completed, your account will be deactivated immediately. Data that must be retained by law or for other legitimate reasons is handled in accordance with Section 4. Account deletion affects device associations, shared access, and other users as follows: Devices associated with the deleted account will automatically be unpaired and released from that account. The account’s device management, control, and sharing permissions will also be terminated. Uninstalling the App, signing out, or disabling notifications does not delete your account.

7. Data Security 

We apply appropriate safeguards based on the nature of the data and associated risks, including protection during transmission, access controls, and other security measures. Access to data is limited to authorized personnel with a legitimate business need. If personal data is stolen, disclosed without authorization, or otherwise compromised, we will respond and notify affected users as required by applicable law.

8. Changes to This Policy 

When this Policy is updated, we will display the version and effective date. We will notify you through the App or another appropriate channel of material changes to data uses or your rights. Where additional consent is required, we will obtain it before the relevant processing begins.

9. Contact Us

Service Provider: VISTATEC Inc.

Email contact: Service@vistatec.com.tw 

Mailing Address: Room 201, Research Building 3, No. 31, Gongye 2nd Road, Annan District, Tainan City.

Website:https;://www.vistatec.com.tw