Privacy Policy

1. Who we are

Illusion Labs (Al-Sulaymanyia Co.), Erbil, Iraq, operates the retail-execution platform at illusionlabs.io and the iField mobile app for Android and iOS. Contact: hello@illusionlabs.iq. The platform is a business tool: company accounts belong to your employer, who is the data controller for field data; we process it on their behalf.

2. Data we collect

Account data: name, phone, email, username, role, assigned cities and pay settings — provided by your employer or entered at sign-in.

Location data: GPS fixes at store check-in, visit photos stamps, and live route pings while the app is open. If you accept background location, the app also records your work route between stores while closed or backgrounded so supervisors see the route actually taken on the live-tracking map.

Photos and visit evidence: shelf photos, before/after activation photos, issue evidence, and their GPS stamps.

Field records: visits, audits, tasks, issues, reports, attendance and device metadata (device label, app version).

Website: the marketing site sets no tracking cookies and runs no analytics by default.

3. Why we collect it (use)

To verify store visits by GPS, draw work routes for supervision, compute coverage/KPI/payroll reports for your employer, keep photo evidence of shelf and activation work, and keep the apps secure and working. We do not sell personal data and do not use field data for advertising.

4. Background location — your choice

Background route recording is optional. The app shows a prominent in-app disclosure before ever asking the system permission, explaining what is recorded, why, and how long it is kept. Declining only disables background route recording: store check-ins and all other features keep working with the app open. You can revoke it anytime in system Settings (Location → iField → deny background access) or by signing out, which also stops all pings.

5. Sharing

Field data is visible to your employer’s supervisors and managers inside the portal (live tracking, visits, reports, payroll). We share data with infrastructure providers only as needed to run the service (hosting, push delivery via Expo). We disclose data to authorities only when legally required.

6. Retention and deletion

GPS pings are auto-deleted after the configured retention window (default 30 days, minimum 7 — LOCATION_PING_RETENTION_DAYS). Visit, photo and report records are kept while your employer’s account is active and on request thereafter. Demo accounts are deactivated on production start. To request export or deletion of your data, email hello@illusionlabs.iq or ask your company admin; deletion requests are honored within 30 days unless the law requires longer retention.

7. Security

Sessions are signed httpOnly cookies (web) or bearer tokens (mobile) over HTTPS, passwords are bcrypt-hashed, secrets are server-side only, and uploads are access-controlled. No method is 100% secure, but we apply industry-standard safeguards and review access on role change or offboarding.

8. Children

The platform is a workforce tool for employees and contractors aged 18+. We do not knowingly collect data from children.

9. Changes

We will post material changes here and update the date below. Continued use after a change takes effect means you accept the updated policy.