Plain-English Summary: This policy explains what data SpyHuman collects, how we protect it, and your rights regarding that data. We build our tools primarily for parental control and authorized employee management.
At SpyHuman ("we," "our," or "us"), we prioritize your privacy and data security. This Privacy Policy outlines our practices regarding the collection, storage, processing, and deletion of personal data when you use our website, mobile applications, and cloud dashboard (collectively, the "Services").
SpyHuman acts primarily as a Data Processor on behalf of our users (the Account Administrators), who act as the Data Controllers or Data Fiduciaries. Administrators are solely responsible for ensuring they have the legal right and explicit consent to monitor the Target Device.
Plain-English Summary: We collect your account details to manage your subscription, and we collect device data (like GPS, texts, and app usage) strictly based on how you configure the monitoring software.
We collect two primary categories of information:
Plain-English Summary: We use the collected data strictly to deliver the monitoring services you requested. We never sell your data to advertisers.
We process the collected information solely to provide, maintain, and improve the Services. Specific uses include:
Strict Prohibition: SpyHuman does not and will never sell, rent, or monetize Target Device Data or Account Information for targeted advertising or third-party marketing purposes.
Plain-English Summary: To protect your privacy, we automatically and permanently delete all monitored device data from our servers after 90 days. You must download any data you wish to keep before this deadline.
In strict adherence to global data minimization principles (including the GDPR and the DPDP Act), SpyHuman enforces a rigorous automated deletion protocol.
Payload Data: All Target Device Data (including GPS logs, messages, and media) transmitted to our servers is retained for a maximum of ninety (90) days. Upon expiration of this period, the data is automatically, irreversibly, and permanently expunged from all active databases and cloud storage environments. The Provider assumes no liability for data lost due to this automated retention cycle.
Audit Logs: Basic system audit logs (such as account login timestamps and IP addresses) may be retained for up to one (1) year to comply with forensic, legal, and statutory investigation requirements.
Plain-English Summary: We use bank-level encryption to secure your data while it is being transferred and while it is stored on our servers.
SpyHuman has implemented a Privacy-by-Design architecture aligned with ISO/IEC 27018 standards for the protection of Personally Identifiable Information (PII) in public clouds.
Plain-English Summary: We only share data with essential service providers (like payment processors) or when legally forced to by a valid court order.
We do not share your personal data with third parties, except in the following limited circumstances:
Plain-English Summary: Depending on where you live, you have specific legal rights to access, delete, or manage your data.
If you are located in the EEA or UK, you have the right to access, rectify, or erase your personal data (Right to be Forgotten), restrict processing, and request data portability. Account Administrators must establish a lawful basis (e.g., explicit consent or legitimate interest via an LIA) before processing a Monitored User's data. To execute a Data Subject Access Request (DSAR), please contact our DPO.
Under the California Privacy Rights Act, residents (including employees monitored on corporate devices) possess the right to know what personal information is collected, the right to delete such information, and the right to opt-out of data sharing. Notice at Collection: The categories of data we collect and our retention periods are explicitly detailed in Sections 2 and 4 of this Policy.
In compliance with the Digital Personal Data Protection Act, 2023, the processing of data relies on the explicit, itemized, and verifiable consent of the Data Principal (or their lawful guardian, in the case of minors). SpyHuman does not track minors for behavioral advertising. Data Principals have the right to grievance redressal, with a mandated response window of 90 days.
Plain-English Summary: If you have privacy concerns, want to delete your data, or need to report abuse, you can contact our privacy team directly.
For questions regarding this Privacy Policy, to exercise your data subject rights, or to report unauthorized tracking (stalkerware abuse), please contact our privacy team:
Grievance Officer (India): Pursuant to the DPDP Act 2023, users in India may direct complaints to our designated Grievance Officer at [email protected]. We will acknowledge and resolve valid requests within the statutory timeframe.