Privacy Policy

This Privacy Policy governs the collection, processing, and protection of personal data by Optruss Systems Inc. and its affiliated regional entities (collectively referred to as “Optruss”, “we”, “our”, or “us”), headquartered in Riyadh, Kingdom of Saudi Arabia (Olaya District, Riyadh 12213).

Scope of Applicability:

• Users of the Optruss Mobile Application: Field maintenance engineers, reliability technicians, plant supervisors, and inspectors utilizing our iOS and Android mobile applications for on-site machine diagnostics, work order tracking, and AI-assisted troubleshooting.

• Users of the Optruss Web Platform: Authorized corporate operators, asset managers, and IT administrators accessing our cloud consoles and operational web dashboards.

• Public Website Visitors & Inbound Contacts: Individuals browsing optruss.com, requesting technical product demonstrations, downloading whitepapers, or submitting enterprise evaluation inquiries.

Enterprise Processing Framework: Relationship to Customer Operational Data:

When an enterprise customer deploys Optruss across industrial plants, utility grids, or healthcare facilities, the customer acts as the Data Controller for its operational asset data, machine telemetry, and work orders. Optruss processes such industrial telemetry strictly as a Data Processor pursuant to our signed Data Processing Agreement (DPA). This Privacy Policy applies to personal information for which Optruss acts as a Data Controller, as well as our commitments to end users operating our software interfaces.

We collect personal information directly from users, automatically through device and platform interactions, and from authorized enterprise customer administrators:

A. Data Provided Directly by Users:

• Identity & Account Registration: Full name, professional corporate email address, telephone number, job title, departmental role, employer name, login credentials, and user profile preferences.

• Mobile Field Notes & Technician Observations: Troubleshooting descriptions, equipment condition comments, failure logs, and maintenance observations typed or dictated into the mobile application.

• Voluntary Technical Media Uploads: Photographs of machinery nameplates, component wear images, thermal or visual snapshots, and schematic documentation captured or attached via the mobile app.

• Commercial Inbound Submissions: Details provided via demo request forms, whitepaper downloads, conference engagements, and direct email communications with our technical team.

B. Data Created Automatically During Service Use:

• Mobile App Telemetry & Diagnostics: Mobile device model, operating system version, Optruss app release version, connection protocol, IP address, and application performance metrics.

• Operational & Audit Logs: Timestamps of work order creations, approval actions, diagnostic query histories, session durations, and user activity trails recorded for enterprise accountability.

• Technical Browsing Data: Browser type, language preferences, referring URLs, screen resolution, and navigation patterns on optruss.com.

C. Data Collected from Other Sources:

• Enterprise Customer Administrators: Authorized administrators may create user profiles and assign asset access roles to maintenance technicians within their organization.

• Integrated Industrial Platforms: Bi-directional synchronization of work order IDs, technician assignments, and spare parts ledgers from enterprise ERP/CMMS systems (such as SAP PM, IBM Maximo, or Oracle EAM).

Optruss processes personal data only where an applicable lawful basis exists under the Saudi Personal Data Protection Law (PDPL) and international privacy frameworks:

• Providing Core Platform & Mobile CMMS Capabilities: Configuring user accounts, enabling secure sign-in, synchronizing field work orders, processing sensor telemetry, and alerting technicians to machine trip boundaries.

• Operational Safety & Critical Asset Protection: Delivering immediate push alerts for hazardous machinery thresholds, enabling field teams to isolate failing equipment before catastrophic breakdowns occur.

• Customer Support & Field Engineering Assistance: Investigating technical bug reports, verifying edge hardware telemetry ingestion, and resolving user software inquiries.

• Research, Engineering & Algorithmic Optimization: Analyzing aggregated, de-identified operational patterns to refine physics-informed vibration analysis models, bearing defect detection algorithms, and user experience.

• Security, Authentication & Fraud Prevention: Enforcing multi-factor authentication, auditing privileged user actions, preventing unauthorized access, and maintaining SOC 2 compliance.

• Legal & Regulatory Compliance: Fulfilling statutory recordkeeping, tax obligations, and formal directives issued by competent regulatory authorities in Saudi Arabia (including SDAIA).

The Optruss Mobile Application incorporates optional AI-assisted technical diagnosis features to help reliability engineers troubleshoot mechanical anomalies, generate root-cause analyses, and draft structured work orders. In compliance with Apple App Store Review Guidelines and data protection mandates, we maintain rigorous safeguards:

1. Prior User Permission & Explicit Consent:

The Optruss Mobile Application does NOT automatically collect, monitor, or transmit audio, field notes, or diagnostic inputs to third-party AI services in the background. We strictly ask for and require your explicit, affirmative manual action (such as tapping an "Analyze with AI" button, confirming an AI troubleshooting query, or submitting an inspection report for automated drafting) before any data is sent from the mobile application to our AI infrastructure. You may choose not to use AI features and continue using all standard manual CMMS workflows without limitation. Furthermore, you can grant, decline, or revoke AI permissions at any time within the mobile application settings.

2. What Data Is Sent from the Mobile App to the AI:

When you explicitly initiate an AI-assisted diagnostic action, only the technical information strictly necessary to formulate an engineering response is transmitted:

• User-Entered Prompts & Inquiries: Textual descriptions of equipment symptoms, mechanical noise observations, technician notes, and troubleshooting queries entered into the app.

• Equipment Metadata & Telemetry Context: Machine identification (asset class, equipment tag, vibration or temperature sensor metrics, operating RPM, and standard ISO failure codes) necessary to contextualize the diagnostic request.

• Voluntarily Attached Technical Photos: Photographs of equipment nameplates, visible component wear, or schematic diagrams that you capture with your device camera or attach from your library for visual defect recognition.

3. What Data Is NOT Sent to the AI:

We do NOT send your device contacts, personal photo library, biometric data (Face ID / Touch ID), background location coordinates, financial details, or unrelated device files to any AI provider.

4. Third-Party AI Service Providers & Purpose of Processing:

To deliver high-speed mechanical diagnostics and work order drafting, Optruss utilizes vetted commercial enterprise third-party AI service providers (including Anthropic and OpenAI). Data shared with these third-party providers is transmitted solely to generate the immediate diagnostic output requested by the user.

5. Zero Model Training on Customer or User Data:

Under our binding commercial enterprise agreements with our third-party AI providers, customer data, prompts, machine parameters, and inspection photos submitted through the Optruss Mobile App are NEVER used to train, retrain, or improve public or foundation AI/LLM models.

6. Encryption in Transit & Ephemeral Retention:

All communications between the mobile application, Optruss backend APIs, and third-party AI endpoints are encrypted in transit using industry-standard TLS 1.3. Third-party AI providers process inputs ephemerally to generate completions and retain query logs only for transient abuse prevention and legal compliance in accordance with strict zero-data-retention or short-term retention policies, after which records are automatically deleted.

Optruss does not sell, rent, lease, or trade personal data to third-party data brokers, marketing intermediaries, or advertising networks under any circumstances. We share personal information only under the following defined circumstances:

• With Your Employing Enterprise Customer: Technician inspection records, work order sign-offs, and field diagnostic entries are shared with the designated enterprise administrators and supervisors managing the customer's industrial facility.

• With Authorized Subprocessors & Service Providers: We partner with trusted infrastructure vendors that perform specialized services on our behalf (such as cloud hosting, enterprise database management, and transactional email/SMS delivery). All subprocessors operate under signed data protection agreements requiring strict confidentiality and security.

• For Legal Protection & Regulatory Mandates: We may disclose personal data if required to do so by applicable laws, judicial proceedings, court orders, or lawful requests by competent public authorities in the Kingdom of Saudi Arabia.

• Corporate Reorganization: In the event of a merger, acquisition, corporate reorganization, or asset transfer, personal data will continue to be governed by the commitments set forth in this Privacy Policy.

We utilize essential cookies, local storage tokens, and secure SDKs to deliver our digital services:

• Strictly Necessary & Authentication Tokens: Essential session tokens, JWT authenticators, and CSRF protection tokens required to maintain authenticated sessions and protect account security.

• Preference & Localization Settings: Local storage keys that remember your preferred language (English or Arabic), active plant site selection, and UI display density.

• Aggregated Performance Telemetry: Anonymous page load diagnostics and error logs that help our engineering team resolve latency bottlenecks and software faults.

Managing Cookie Preferences: You can review and customize your non-essential cookie choices at any time through our interactive Cookie Policy & Preferences Hub.

We believe in providing users with clear, accessible controls over their personal data and device features:

• Camera Permission (Mobile App): Requested only when you choose to photograph an equipment nameplate, capture mechanical wear, or scan an asset QR/barcode. Camera access is never activated in the background.

• Push Notifications (Mobile App): Used exclusively to deliver time-critical machinery failure alerts, work order assignments, and critical plant safety notices. You can disable notifications in device settings.

• Local Device Storage (Mobile App): Utilized to cache offline machine schematics, equipment taxonomies, and pending work order entries when working in remote plant zones with limited network connectivity.

• Marketing & Technical Bulletin Opt-Out: You may opt out of non-essential technical newsletters or product updates at any time by clicking the unsubscribe link in our communications.

You can adjust or revoke any mobile device permissions at any time via your device settings (iOS Settings > Optruss, or Android App Settings > Permissions).

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, satisfy customer contractual agreements, and comply with applicable statutory retention requirements:

• Active User Accounts: Retained for the duration of the customer enterprise contract or until the authorized administrator deactivates the user profile.

• Field Inspection Logs & Audit Records: Maintained for compliance with industrial safety audits and statutory accounting periods under Saudi law (typically up to 5 to 10 years depending on the asset class).

• Transient Mobile Telemetry & AI Prompts: Processed ephemerally and purged following the completion of the diagnostic cycle, subject to short-term security anomaly logs.

Mobile Account Deletion: In-App Account Deletion:

In compliance with Apple App Store requirements, mobile app users can request or initiate account deletion directly within the mobile application settings (Settings > Account > Delete Account) or by emailing [email protected]. Upon verified request, personal identifiers are permanently deleted or rendered irreversible anonymized data within thirty (30) days.

Optruss prioritizes national data sovereignty and strict compliance with the Saudi Personal Data Protection Law (PDPL) and National Data Management Office (NDMO) standards:

• In-Kingdom Cloud Residency: Our primary cloud and database infrastructure is hosted in tier-3/tier-4 enterprise data centers located inside the Kingdom of Saudi Arabia and the GCC, ensuring in-country data sovereignty.

• Sovereign On-Premise Air-Gapped Option: For defense, water desalination, petrochemicals, and critical national infrastructure, Optruss deploys completely air-gapped on-premise Atlas-7 clusters that operate entirely disconnected from public internet networks.

• Cross-Border Data Transfers: Any transfer of personal data outside the Kingdom of Saudi Arabia is executed strictly in compliance with Articles 28 and 29 of the Saudi PDPL, utilizing appropriate safeguards including Standard Contractual Clauses (SCCs), adequacy determinations, and technical encryption.

Under the Saudi Personal Data Protection Law (promulgated by Royal Decree No. M/19) and applicable privacy regulations, you are entitled to the following statutory rights:

• Right to be Informed: You have the right to know the legal basis and specific purpose for which your personal data is collected and processed.

• Right of Access: You have the right to access your personal data held by Optruss and review its processing records.

• Right to Obtain a Copy: You have the right to request a copy of your personal data in a readable, common electronic format.

• Right to Rectification & Correction: You have the right to request the correction, completion, or updating of inaccurate or outdated personal data.

• Right to Destruction / Erasure: You have the right to request the destruction of your personal data when it is no longer necessary for the purposes for which it was gathered.

Exercising Your Rights: To exercise any of these statutory rights, please submit a written request to our Data Protection Officer at [email protected]. We verify the identity of the requester and respond within thirty (30) days without undue delay.

Right to Lodge a Regulatory Complaint: If you believe your personal data rights have been infringed or our processing does not conform with applicable regulations, you have the statutory right to file a complaint with the Saudi Data & AI Authority (SDAIA), the competent supervisory authority for data protection in the Kingdom of Saudi Arabia (sdaia.gov.sa).

We may update this Privacy Policy periodically to reflect changes in our legal obligations, mobile app features, third-party AI integrations, or operational practices. When material updates occur, we will notify users through our website, mobile application push alerts, or direct email communications:

• Effective Date: October 19, 2026

• Policy Version: Version 5.0 (Global & Saudi PDPL Edition with Mobile AI Disclosures)

• Operating Legal Entity: Optruss Systems Inc. / Optruss KSA

• Headquarters Address: Olaya District, Riyadh 12213, Kingdom of Saudi Arabia

• Data Protection Office: [email protected]

• Legal & Compliance Department: [email protected]

For all inquiries regarding this policy, our third-party AI integrations, or your individual privacy rights, please reach out directly to our Data Protection Officer at [email protected].