RSG ("we," "us," or "our") operates the MBL Guardian mobile application (the "App"), a professional Health, Safety, Security & Environment (HSSE) management system. This Privacy Policy explains how we collect, use, store, share, and protect information in connection with your use of the App.
This Policy applies to all users of the App regardless of geographic location and has been prepared to comply with:
By accessing or using the App, you confirm that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the App immediately.
For privacy-related inquiries, please contact us at info@rsg.one.
MBL Guardian is an enterprise B2B application designed exclusively for use by organizations and their authorized employees, contractors, and representatives for professional HSSE management purposes. The App is not intended for personal use, consumer use, or use by individuals under the age of 18. We do not knowingly collect personal data from minors.
We collect only the minimum data necessary to provide the App's functionality. The categories of data we collect are:
This data is provided by your organization when your account is created, or by you directly during login.
When you create, update, or interact with safety observations, we collect:
This data is work-related and is processed on behalf of your organization.
To verify internet connectivity, the App performs DNS resolution checks against well-known public DNS servers (Google Public DNS at 8.8.8.8 and Cloudflare DNS at 1.1.1.1). These checks are performed locally on your device. No personal data is transmitted during these checks; they involve only standard network requests to verify reachability.
We explicitly do not collect:
| Processing Activity | Legal Basis |
|---|---|
| Account authentication and session management | Performance of contract / Legitimate interests |
| Storing and retrieving safety observation records | Performance of contract with your organization |
| Token refresh and automatic re-authentication | Legitimate interests (security, seamless user experience) |
| Connectivity verification | Legitimate interests (service availability) |
| Technical error and compatibility data | Legitimate interests (app stability and improvement) |
| Compliance with legal obligations | Legal obligation |
Under PDPL, we rely on contractual necessity and legitimate interest as primary bases. Where GDPR applies, the same bases apply under Article 6(1)(b) and 6(1)(f).
We use the information we collect to:
We do not use your data for:
We do not sell, rent, or trade personal data. We may share data only in the following limited circumstances:
Work-related data you create (observations, reports, audit history) is shared with your employer/organization as the primary data controller of such records. Your organization has independent data obligations toward you.
Data is processed on RSG-operated servers at hsse.rsg.one. We may engage trusted sub-processors (e.g., cloud hosting providers) who are contractually bound to process data only per our instructions and with appropriate security measures in place.
We may disclose data where required by applicable law, court order, or government authority, including under Saudi law and SDAIA requests.
In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction, subject to equivalent privacy protections.
| Data Type | Retention Period |
|---|---|
| Authentication tokens | Duration of session (or until logout / token expiry) |
| Observation and project records | As determined by your organization's data retention policy |
| Account data | Duration of your active account |
| Technical logs | Up to 90 days for error diagnosis, then deleted |
When you delete the App from your device, all locally stored tokens are purged automatically by Flutter Secure Storage. Server-side data is retained per your organization's agreement with RSG.
We implement industry-standard security measures including:
Despite these measures, no system is entirely immune to unauthorized access. We encourage users to log out of the App when using shared devices and to report any suspected security issues to info@rsg.one.
The App uses device-level encrypted storage (Flutter Secure Storage) to persist authentication tokens between sessions when the "Remember Me" option is selected. No other personal data is stored locally on the device. When the App is uninstalled, all locally stored data is automatically cleared.
The App does not use browser cookies. Any web content opened via Flutter Custom Tabs is governed by the respective website's own cookie and privacy policy.
MBL Guardian is an enterprise application intended solely for use by individuals who are 18 years of age or older in a professional capacity. We do not knowingly collect personal data from minors. If you believe a minor has used the App, please contact us at info@rsg.one and we will take appropriate action to remove such data.
Our primary servers are operated at hsse.rsg.one. If data is transferred outside the Kingdom of Saudi Arabia, such transfers are conducted in accordance with:
Where your organization is located outside Saudi Arabia, the App may transmit data to RSG's servers in Saudi Arabia. By using the App, your organization acknowledges and consents to such transfer.
To exercise any of these rights, contact us at info@rsg.one. We will respond within the timeframes required by applicable law (30 days under PDPL; 1 month under GDPR).
If you have concerns about how we handle your data, you may:
We may update this Privacy Policy from time to time to reflect changes in the App, legal requirements, or our practices. When we make material changes, we will update the "Last Updated" date at the top of this document. Continued use of the App after any changes constitutes acceptance of the updated Policy. We encourage you to review this Policy periodically.
This Privacy Policy is accessible from the App's login screen and settings.
This Privacy Policy is provided in English. In the event of any conflict between a translated version and the English version, the English version shall prevail.