Privacy Policy

Scope and controller

Smartionix Group (“Smartionix,” “we,” “us”) is responsible for the Martion products described in this policy. Smartionix is based in India. This policy covers Martion’s iPhone, Android and Apple TV apps, Martion Mac including its optional paired experience and activated specialist modes, Mac Police Vision, Invisible Shield and ATM Security, the SOS gateway and responder functions, and our Martion website pages.

Authorised hospitals, police, fire or professional responder organisations that operate a Martion Responder installation are also responsible for how their personnel use alert and camera-review information within their organisation and under applicable law.

Police Mode

Police Mode is separate from police tracking of a user’s SOS. When the user says “Activate Police Mode,” Martion sends an approval request containing the configured SOS identity and current location to the nearest eligible police responder. Police Mode becomes active only if that responder accepts.

While it remains active, the phone stores and refreshes a pseudonymous mobile-responder record containing its user identifier, available SOS-identity name, accepting station, current coordinates, accuracy, geohash, status and an access-capability hash. This allows the service to send nearby Martion SOS notifications within the supported radius. Tapping one of those notices loads directions to the SOS and reports the responding officer name from the user’s SOS identity to the responder screen. The police responder may show that name together with the assigned alert number in its assignment banner and Assigned Officer card.

Saying “Deactivate Police Mode” makes the record inactive and deletes its current coordinates, geohash and capability. Police Mode does not give its user access to unrelated Martion device locations and does not allow police to start SOS live tracking for an arbitrary phone.

How we approach privacy

• Purpose limitation: data is used for the feature the user or authorised responder selected, for security, or to meet legal obligations—not for unrelated advertising.
• Permission and notice: Martion requests Apple or Android system permission before accessing protected data such as location, microphone, camera, motion, Calendar, Reminders or local-network devices.
• Data minimisation: Martion is designed to process motion, camera, face-detection and depth signals on-device where practical and to send only the information needed for a requested connected feature.
• No sale or cross-app tracking: we do not sell personal data and Martion does not use advertising SDKs to track users across other companies’ apps or websites.

Information, purpose and processing

What Martion handles depends on the features you choose, the permissions you grant, whether you use Martion Mac, connect a companion device, activate a specialist mode or start an SOS alert.

Blood group is entered manually as optional SOS context. Martion does not read blood group or other information from Apple Health, HealthKit, Android Health Connect or body-sensor permissions.

The Android app does not offer user account creation. It uses a pseudonymous installation identifier to protect requests, route status and support push delivery. Martion also uses Apple’s UserDefaults API for ordinary settings and app-state preferences, with the required privacy-manifest reason. Martion’s current Apple privacy manifests state that the apps do not track users.

Martion Mac data and workspaces

Local context and memory

Martion Mac can keep categorised context for supported projects, meetings, preferences, habits, news, market research and command learning in files under the Mac user account. This local memory is used only when relevant to a requested answer or workflow. It is not represented as end-to-end encrypted storage, and anyone with authorised access to that Mac user account may be able to access locally stored files.

Professional and financial files

When the user activates Work Mode, Business Analysis or AI Bookkeeper, Martion may create managed local or iCloud Drive folders and place user-selected source files, editable outputs, financial workbooks, imported statements, learned classifications and portable Martion files there. AI Investigator copies supplied case sources into its local case workspace, records source hashes and can create reports and annexures. Users remain responsible for obtaining authority to process business, financial and investigation material and for reviewing generated outputs.

Configured intelligence providers

General answers, document generation, approved-source analysis, news summaries and meeting summaries may send a bounded prompt or relevant excerpt to OpenAI when that provider is configured. Martion does not send an entire local memory store by default. A user-requested online search or research connector receives only the query and context needed for that action. Financial records and investigation material should be used only with the user’s or organisation’s authority.

Connected devices and credentials

Martion can discover supported devices on the local network and use user-configured vendor credentials, local keys, pairing tokens, device names and addresses to perform requested actions. Availability depends on the device, network and vendor interface. Sensitive credentials are intended for protected local storage such as macOS Keychain where supported; users can remove an integration or its credentials to stop it.

TrueDepth and Face Data

Information accessed and derived

On supported iPhones, and only while Martion Speed is open, Martion accesses ARKit’s numeric eyeBlinkLeft, eyeBlinkRight, jawOpen and mouthFunnel blend-shape values, whether the face anchor is tracked, and the face-anchor transform used to calculate temporary head pitch, yaw, roll and movement. Martion derives short-lived numeric eye-closure, blink, mouth-open/yawn and head-pose samples and an Awake or Sleeping state. Martion does not capture or retain a facial identity, Face ID enrollment, faceprint or biometric template.

Purpose and planned uses

This information is used only to provide the on-screen driver-awareness state and local wake or rest alerts. It is not used for Face ID, authentication, identifying a person, advertising, marketing, user profiling, eligibility decisions, or data mining. It is not combined with a user profile or reused for another purpose.

Processing, storage, retention and deletion

TrueDepth and derived driver-awareness values are processed only in volatile memory on the iPhone. Rolling derived samples are kept for no more than approximately 60 seconds so the classifier can distinguish a sustained pattern from an ordinary blink. ARFaceAnchor objects, raw front-camera images and facial geometry are not written to app storage, protected records, calibration reports or any persistent file. The in-memory samples are automatically cleared when Martion Speed closes or its awareness session resets; because Smartionix does not receive or retain this information, there is no server-side face-data record to delete.

Sharing and transmission

Martion does not transmit or share raw or derived TrueDepth/face data with Smartionix servers, Firebase, Google, OpenAI, Cloudflare, a paired Mac, analytics providers, advertisers, data brokers, responders, or any other third party. No third party stores this information for Martion.

User control

The user can stop processing by closing Martion Speed and can revoke Camera access at any time in iOS Settings. Revoking access prevents the camera, TrueDepth driver-awareness and road-sign features from operating but does not create or preserve any face-data record.

Android camera and face signals

Information accessed and purpose

Only while Martion Speed is open on a supported Android device, Martion may analyse a low-rate front-camera stream with bundled on-device ML Kit face detection. It derives temporary eye-open probabilities, eye-closure and blink timing, yawn indicators, head yaw, roll and movement, and an Awake or Sleeping state. The rear camera may also be analysed with bundled on-device text recognition for supported road signs.

No identity, upload or persistent record

These features do not identify the user, create a faceprint, perform facial recognition, or use Android biometric authentication. Camera frames are closed after analysis. Derived awareness samples remain in volatile memory for no more than approximately 60 seconds and are cleared when Martion Speed closes or resets. Frames, face geometry, detected road-sign results and derived awareness values are not written to protected records, uploaded to Smartionix, sent to Firebase or shared with responders or advertisers. Revoking Camera permission or closing Martion Speed stops the processing.

Android Martion

On supported Android devices, Martion provides user-started voice interaction through tap the orb to talk; it does not use a wake-word mechanism. Supported interactions are available through English, Hindi, Telugu and Dogri language modes. Android also provides Martion Speed, optional weather, Google Maps Platform place and route utilities, Calendar and Clock actions, notifications, user-initiated SOS, doctor requests, ambulance dispatch and emergency-corridor notices. After SOS identity setup, Martion explains and requests the location access required to keep an eligible user-initiated police SOS trackable while the app is backgrounded. Android requires foreground location to be granted first and, on recent versions, requires the user to select background access in the app’s system Settings.

Speed, motion fusion, calibration, temporary driver-awareness signals and road-sign analysis are processed on the device. When you request weather, current coordinates are sent directly to Open-Meteo. When you request a destination or route, the query or required origin, destination and location bias are sent directly to Google Maps Platform using an Android app-restricted credential. An assigned ambulance driver’s route and current dispatch location are sent to the Martion gateway only after the driver taps Start Directions. Outbound route sharing closes when the patient location is reached; limited location updates continue only to detect the ambulance’s return to the assigning hospital, then stop. We do not deliberately store ordinary weather, address or unrelated route request bodies in the Martion application database.

Android protected records and preferences are stored in app-private storage. You can control permissions in Android Settings, close Martion Speed to stop the live sensing session, clear Android app data or uninstall Martion to remove locally stored app data. Connected SOS, doctor-request, ambulance-dispatch and responder records follow the retention periods described below.

Mac Police Vision and Invisible Shield

Activation and camera sources

Police Vision, Invisible Shield and ATM Security begin only after the Martion Mac user explicitly activates the relevant mode and stop when the user deactivates it or the camera session ends. An activated session may use the built-in Mac camera and deliberately configured compatible local IP/RTSP camera sources. Martion does not automatically connect to every camera on a network.

Local analysis and derived signals

Eligible camera frames are analysed on the authorised Mac for configured candidate events. Depending on the activated workflow, processing may derive visible-person or hand regions, approximate close-camera distance, contour or object evidence, possible-knife scores, text or plate candidates, possible drone or multi-target candidates, motion-track state, glare or exposure adjustments, and optional wanted or missing-person reference-image comparison results. Where an authorised operator places reference images in configured local or iCloud folders, Martion may compare visible faces with those specific references on that Mac. Every output is a candidate for authorised review; it is not proof of identity, intent, ownership or that a crime occurred.

Responder alert and live review

A qualifying event may provide its title, time, activity type, confidence or match context, people or target count, camera source and available location to an authorised Martion Police Responder workflow. The Mac maintains a current compressed review frame and an event-bound session capability. The responder can use that capability to request the available review sequence or live view. Martion does not create a general continuous video archive by default.

Limits and control

Lighting, weather, target size, motion blur, glare, occlusion, object angle, optics, camera placement, video compression and network conditions can delay, miss or incorrectly classify an event. A visual alert does not determine hostile intent or authorise enforcement. The responder must review the available context and apply trained judgement. The user can stop capture by deactivating the relevant Vision mode, quitting Martion Mac or revoking Camera permission in macOS Settings.

Device permissions and controls

Martion requests access only when the related feature is available or selected. Speed-related permission prompts are prepared before the landscape HUD where the platform permits:

• Location: speed, weather context, navigation, address completion, travel assistance, doctor requests, public-safety or emergency-corridor eligibility, user-initiated SOS coordinates and active ambulance dispatch. On iPhone, Martion first requests location access for the active feature. If an assigned police responder later requests tracking for a user-sent SOS and Always access is not granted, Martion can send a time-sensitive request and present Apple’s native location-upgrade journey at the next foreground opportunity iOS permits. iOS controls whether and when that prompt appears, the user decides whether to grant Always access, and a closed app cannot remotely force the native prompt onto the screen. The user can also make the change directly in iOS Settings. On Android, Martion presents its SOS tracking explanation after identity setup; Android first presents foreground choices and, on recent versions, makes “Allow all the time” available only through the app’s system Settings. When an assigned police responder requests tracking for an SOS initiated on that Android installation, Martion runs a visible foreground location service for the time-limited SOS session. For a registered ambulance driver, active dispatch location sharing begins only after the driver taps Start Directions for a specific assignment, continues through the outbound response and limited return-to-hospital detection, and stops after the hospital geofence is reached, the responder resolves the alert or the time-limited capability expires. These permissions do not allow a responder to start tracking an arbitrary device.
• Microphone and speech recognition: user-started voice commands, Speed voice controls and requested meeting transcription. Android ordinary voice requests begin when the user taps the orb; no wake-word mechanism is used.
• Camera: rear-camera HUD and on-device road-sign identification; on supported iPhones, ARKit and TrueDepth; on supported Android devices, bundled on-device driver-awareness and road-sign models; and, on Mac, an explicitly activated Police Vision or Invisible Shield session using the selected built-in or deliberately configured compatible camera source.
• Motion & Fitness or device motion sensors: speed confidence, motorcycle lean, stationary/moving state and HUD calibration.
• Calendar, Reminders and Clock: review or create the user’s requested events, reminders and alarms. Android uses Calendar and Clock rather than an internal cloud calendar.
• Local Network on Apple platforms: discover and connect to the user’s paired Martion Mac.
• Notifications: responder status, confirmed appointment details, ambulance assignment and distance updates, nearby police public-safety broadcasts, emergency-corridor notices and other requested Martion alerts. Public-safety broadcasts use high-priority Android delivery and time-sensitive iPhone delivery where supported, but acceptance by a push gateway is not proof that a handset displayed or a person read the notice.

You may deny or later revoke a system permission. The related feature or SOS setup may remain unavailable or incomplete, but unrelated features remain available where technically possible. Manage these choices in iOS, tvOS or Android Settings. Android users can also clear Martion’s app data or uninstall Martion to remove local app data.

SOS, responders and drivers

User-initiated SOS

When you start an SOS alert, Martion creates an event containing a pseudonymous user identifier, event identifier, mode, incident type, source and timestamps. If location permission and a location fix are available, Martion adds precise coordinates, accuracy and approximate area. Optional profile details—name, phone number, gender and blood group—are included only when configured for this purpose. An announced “Call Police” request may also include the concern described by the user.

The gateway uses the incident type, responder category, station presence and distance to route the alert. Eligible station inboxes may display the data needed to assess and respond to the event. Claim, status, assignment and resolution actions are recorded. A status push may be sent to your device.

Police confirmation and live tracking

Police live tracking is event-bound and user initiated: it can exist only after the user sends a safety alert and that alert is assigned to the requesting police responder. A responder cannot search for an arbitrary Martion device, force live tracking without an assigned user-sent SOS, or autonomously start a tracking session outside that event. For an assigned alert, the responder may send a limited confirmation question asking whether the user intentionally sent the SOS. The user can answer Yes or No; this is a structured safety exchange, not an open chat.

After the responder requests live tracking for an eligible active SOS, the gateway issues a time-limited, event-specific capability to that user’s device. A supported iPhone or Android phone can then send updated coordinates while the safety session remains active, including while backgrounded when the platform and authorised permissions permit. If the iPhone still needs Always access, Martion can send a time-sensitive request and present Apple’s native location-upgrade journey at the next foreground opportunity iOS permits. iOS decides whether and when to show that system prompt; the user must grant access, and a closed app cannot remotely force it to appear. On Android, an ongoing system notification identifies the active location-sharing service. Tracking stops when the responder resolves the alert, the SOS is dismissed or marked false, the capability expires, or the device can no longer provide authorised location. Pressing Resolve removes the alert from that responder’s active inbox and invalidates that responder’s live-tracking state.

Nearby police public-safety broadcasts

An authorised, located police responder may send a short public-safety notice to opted-in Martion installations within its authorised area, capped at 15 kilometres. The responder may use the station-centred radius or lock a custom centre and radius that remain entirely inside that boundary. Martion keeps one canonical identity per installation and refreshes a protected current-presence coordinate, accuracy and geohash. Presence expires after two hours without a fresh location. The gateway queries fresh canonical records, calculates exact centre-to-device distance and addresses only eligible installations. When a device crosses a state or country boundary, its identity and notification registration move to the new branch and the old subtree is recursively deleted, with a scheduled cleanup retry for interrupted migrations.

The responder composer provides an editable Missing Person preset and a custom text field that authorised police can use for a most-wanted or related public-safety notice. These public broadcasts contain the officer-authored text and routing data required for delivery. They are separate from the operator-activated Mac reference-image workflow described above, which may produce a source-specific candidate alert for authorised responder review.

The responder receives aggregate eligible and queued device counts but no recipient identity list, audience map or individual device coordinates. A queued count reflects acceptance for push delivery and is not proof that every handset displayed or a person read the notice. Broadcast presence cannot be used by a responder to browse or manually track devices and is separate from event-bound SOS live tracking.

Responder installations and appointments

An Apple TV responder installation provides responder type, station location, a stable station/device identifier, authentication information and connection status. A professional doctor registration also provides the selected specialization, doctor name, clinic name and consultation start and end times. This information is saved as installation setup, used to identify and register the professional responder, and included in its secured station record. A doctor appointment request may include the user’s symptoms, selected specialist category and contact details needed to coordinate the appointment. If a doctor declines a pending request, the gateway may forward that request to the next eligible nearby doctor of the same specialty. Personnel must access responder and alert information only for authorised operational purposes.

Ambulance driver assignment and emergency corridor

A Martion user can send a one-time driver-registration alert to a nearby hospital. If the hospital accepts the driver into its ambulance directory, the record may contain the driver’s name, phone country code and phone number, ambulance number and pseudonymous Martion identifier. A removed driver becomes inactive and is no longer offered for new assignment.

When the hospital assigns that registered driver to a user’s announced SOS or Call Ambulance alert, Martion sends the driver a push notification containing a time-limited, event-specific capability, patient destination and assigning-hospital coordinate. The requesting user is told that the ambulance was dispatched. Tracking does not begin on registration or assignment. It begins only when the assigned driver taps Start Directions. Martion then sends the driver’s current dispatch location and route points to the gateway so the assigning hospital can request the current Apple Maps automobile route, see that outbound route highlighted in translucent red, follow the rotating ambulance beacon and calculate remaining distance. The requester receives distance notifications approximately every five minutes while the outbound dispatch remains active and a current driver location is available.

When the ambulance reaches the patient location, the emergency corridor closes and route-area notifications do not continue for the return trip. Limited driver coordinates remain event-bound only so the gateway can determine when the ambulance is within approximately 120 metres of the assigning hospital. The hospital alert card remains hidden during dispatch and returns with a Resolve action after that server-calculated hospital geofence is reached. Driver sharing then stops. The hospital cannot set or override the driver’s return state from the TV screen.

Starting directions declares the outbound emergency corridor for that dispatch. Phones subscribe directly through Firebase Cloud Messaging to anonymous fine-area topics derived locally from their location. The gateway addresses topics along the submitted outbound route, and supported phones can check their distance to that route locally before showing the request to move aside. The hospital and driver do not receive a list of Martion users in the corridor, their identities or their device coordinates. A hospital cannot use this feature to search for or track unrelated Martion devices.

Health and medical limits

Martion is not a medical device and does not diagnose, treat, cure or prevent any disease or condition. “Find Doctor” is a convenience feature that maps a user-described symptom phrase to a practitioner category and, only after the user continues, sends an appointment request to an eligible professional responder. Routing may be incomplete or incorrect and does not establish urgency.

Before Android collects the symptom description for this flow, Martion states that the symptom description, requested specialty, contact profile and current location when available will be sent through the Smartionix service for the appointment request. Users should confirm medical decisions with a qualified healthcare professional. For urgent or life-threatening symptoms, contact local emergency services directly and do not rely on Martion.

When information is shared

We disclose information only to operate the selected feature, protect the service, comply with law, or with the user’s direction. Relevant providers may include:

• Apple: iOS/tvOS permissions, WeatherKit, Speech, Maps-related features, Calendar, Reminders, StoreKit, Apple Push Notification service and platform security.
• Android and Google platform services: Android permissions, the user-selected Speech service, Calendar, Clock, notification delivery and Play Integrity. A speech provider may process command audio under the provider’s settings when on-device recognition is unavailable.
• Google Firebase and Google Cloud: Firestore event and active ambulance-dispatch storage, Cloud Functions, responder authentication and inboxes, Firebase Cloud Messaging for direct and anonymous-region notifications, Firebase App Check with Play Integrity on Android, and Firebase Crashlytics for production crash and non-fatal diagnostic reports. Firebase services may process data on global Google infrastructure. Crashlytics is used only for reliability, not advertising, tracking or medical profiling.
• Google Maps Platform: Android place search, navigation routes, map links and QR directions. Depending on the selected feature, Google receives a destination query, location bias, origin/destination points and technical request data. Martion does not deliberately save ordinary place or unrelated route request bodies in the Martion application database.
• Open-Meteo: Android Martion Speed sends current coordinates directly to Open-Meteo when refreshing the selected location’s weather conditions. Martion does not deliberately save the weather request body in its application database.
• Google ML Kit: bundled Android face-detection and text-recognition models run on the device. Martion does not send their camera input or recognition output to Google servers.
• Cloudflare: website delivery, network security and related technical logs for smartionix.com.
• OpenAI: when a user enables paired-Mac intelligence features, selected prompts, transcript excerpts, meeting context or document instructions may be sent to produce the requested answer, summary or document. Martion does not send this content to OpenAI for advertising.
• User-configured connected services: optional SerpAPI, RapidAPI rail services, EIA or similar connectors receive the query and context needed for the user-requested search, travel or information action.

These companies generally act as service providers for the selected feature, although their own terms and privacy notices also apply. We may also disclose information when required by applicable law, valid legal process or to address an immediate security threat. We do not sell personal information or provide it to data brokers.

Retention and deletion

• iPhone TrueDepth and Android driver-awareness values: retained only in volatile memory for a rolling period of up to approximately 60 seconds and automatically cleared when Martion Speed closes or resets. They are never placed in Smartionix server storage or backups.
• Road-sign analysis: rear-camera analysis frames and detected sign results are transient and discarded as the live session advances; they are not uploaded or retained as a sign history.
• Mac Police Vision, Invisible Shield and ATM Security: analysis frames are transient. The Mac replaces its current compressed review frame as the live session advances rather than building a general video archive. Ordinary activity alerts may remain locally available for approximately two minutes; configured priority events, including possible drone, wanted or missing-person and stolen-vehicle candidates, may remain available for up to approximately 15 minutes so the authorised responder can review them. In-memory alerts, frames and session capabilities are cleared when the responder service stops or the app process ends.
• Weather, address and ordinary route utility requests: used to return the requested result and not deliberately written to the Martion application database; infrastructure and Google provider security logs may follow the provider’s disclosed retention.
• Crash and diagnostic data: Firebase states that Crashlytics crash stack traces, associated diagnostic information and installation identifiers are retained for 90 days before removal from live and backup systems begins.
• On-device records: preferences, protected records, calibration information, the locally cached broadcast/corridor region and local route-check location, and other local content remain until replaced, expired, deleted through available controls, cleared with app data or removed by uninstalling. Android protected records use private no-backup storage; Apple device backups remain controlled by the user.
• Martion Mac memory, work and financial files: local categorised context remains until its files are replaced or deleted. User-selected iCloud or local Work Mode, Business Analysis, Bookkeeper and Investigator files remain under the user’s account until removed through the feature, Finder or the relevant mode lifecycle. Deactivating certain managed modes may delete their managed folders.
• Doctor appointment requests: pending requests are configured to expire after approximately 24 hours. An accepted request may remain through the appointment end so the clinic and user can complete the workflow, after which automated expiry removes the active request.
• Active responder alerts and live tracking: pressing Resolve removes the alert from that responder’s active inbox and marks its event-bound live-tracking state resolved so further coordinates are rejected. For an ambulance dispatch, the outbound corridor closes at the patient location, limited return detection stops at the hospital geofence, and Resolve removes the active driver location, route points and dispatch capability from the event. Unresolved active inbox copies and ambulance capabilities expire after their configured operational periods. Martion does not currently maintain a separate long-term police or ambulance live-tracking history or responder-report archive.
• SOS audit events: the current service may retain the core SOS event, its latest non-route operational fields and limited action records for up to approximately 30 days under automated expiry for incident integrity, security and operational review. This means Resolve removes the active responder copy and ends tracking, but does not promise instantaneous erasure of every non-tracking event field from all infrastructure or backups.
• Police public-safety broadcasts: a protected routing presence expires after two hours without refresh. The broadcast message, station or custom broadcast centre and radius, aggregate eligible, queued and failed counts, and gateway status may be retained for up to approximately 30 days. The record contains no recipient identity list or individual recipient coordinates. Aggregate counts indicate routing or push-queue results, not confirmed handset display or human readership.
• Emergency-corridor delivery: the route is part of the active ambulance assignment and is removed when the responder resolves the event. Firebase may process topic delivery metadata, but Martion does not create a recipient identity, coordinate or audience list for the corridor.
• Pending push delivery: undelivered responder acknowledgement entries expire after approximately one hour; undelivered ambulance-dispatch entries expire after the shorter of their operational expiry or approximately six hours.
• Push, installation and broadcast-routing identifiers: retained while needed to address the installation, prevent abuse and deliver requested status; superseded tokens are replaced, and users can request deletion. Police public-safety broadcasts use a private, administrator-restricted canonical routing index containing the push target, opt-in state and short-lived presence fields needed for exact-area delivery. Emergency-corridor delivery continues to use anonymous Firebase route-area topics.
• Responder and driver records: retained while an installation or driver is active. Deactivated directory records and assignment information are retained only as needed for administration, safety, dispute handling or legal obligations, then deleted or anonymised.
• Support and security records: retained only as long as reasonably necessary to respond, prevent abuse and meet applicable accounting or legal duties.

If an authorised responder organisation or applicable law requires Smartionix to preserve specific incident information for a formal report, investigation or legal obligation, only the required record will be maintained for the applicable period. Smartionix does not currently operate a separate responder-report retention archive; if that product practice changes, this policy and its effective date will be updated. Deletion through automated expiry is not instantaneous. Encrypted backups may retain a limited copy until the backup cycle overwrites it, with access restricted and no restoration for ordinary product use.

Your rights and choices

Depending on where you live, you may ask to access, correct, export or delete personal information; restrict or object to certain processing; or withdraw consent. You may also:

• Change permissions at any time in Apple or Android Settings.
• Stop a voice or meeting-transcription session and avoid starting an SOS or doctor request.
• Deactivate Police Vision, Invisible Shield or ATM Security, remove a configured RTSP/RTSPS camera, or revoke Camera permission to stop the Mac camera session.
• Remove operator-supplied wanted, missing-person or stolen-vehicle reference files from their configured folders.
• Disconnect the Martion Mac bridge and remove pairing credentials.
• Review or delete local Martion Mac memory and workspace files, deactivate optional operational modes, and remove connected-device credentials or pairing.
• Review, export or delete supported protected records in Martion.
• Clear Android app data or uninstall Martion to remove local Android data.
• Disable optional provider integrations or remove their API credentials.
• Ask an authorised hospital to correct or remove a driver directory entry.

To make a privacy request, including deletion of cloud event, appointment, Crashlytics, Firebase or installation-identifier data, email info@smartionix.com. Describe the Martion product and the event, installation, station or driver record involved. Martion Android does not create an end-user account, so there is no separate account-deletion flow. We may need to verify your identity and authority before acting. We will respond within the period required by applicable law and may retain information when a legal, security or incident-integrity obligation requires it.

Security

We use reasonable technical and organisational safeguards appropriate to the information and feature. Measures include Firebase App Check with Apple App Attest on iPhone and Play Integrity on Android, replay protection for SOS creation, durable rate controls using pseudonymised device and network keys, authenticated backend access, station-scoped responder inboxes, encrypted HTTPS transport, restricted public database writes and expiring active records. Android protected records use an app-scoped Android Keystore key and private no-backup storage. The iPhone-to-Mac bridge uses TLS 1.2 with PSK/AES-GCM protection and a pre-shared pairing secret; Apple pairing credentials are designed for Keychain storage.

No method of storage or transmission is completely secure. Users and responder organisations must protect devices, Apple TV access, API credentials, station accounts and registered phone numbers.

Children’s privacy

Martion is not directed to children under 13, or a higher minimum age where local law requires it. We do not knowingly collect a child’s personal information without appropriate authorisation. If you believe a child provided personal information improperly, contact us so we can investigate and delete it where required.

International processing

Smartionix is based in India, and the providers listed above may process information in India, the United States or other countries where they operate. Privacy laws may differ from those in your location. Where required, we use appropriate contractual or legal measures for international transfers.

Policy changes

We may update this policy when Martion features, providers or legal requirements change. We will update the date at the top and provide additional notice in the app or through another appropriate channel when a change materially affects how personal information is used. Where new consent is required, we will ask before using information for the new purpose.

Contact Smartionix

For privacy questions, requests, complaints or general Martion support, contact:

• Email: info@smartionix.com
• Publisher: Smartionix Group, India

If you contact us about an immediate emergency, we may not see or respond to the message in time. Contact the appropriate local emergency service directly.