PRIVACY
/ App Privacy /
VAULT
SpinetiX Find & Monitor — Privacy Policy
Effective Date: 19 August 2026
1. Scope
This policy explains how Media La Vista FZCO handles personal data in the mobile and desktop application SpinetiX Find & Monitor for iOS, iPadOS, macOS and Android (the “App”). It covers the App only. Our website is covered by the separate Media La Vista privacy policy.
The App discovers SpinetiX digital signage players on the network you are connected to, keeps a list of the players you choose to save, and — for subscribers — monitors those players from our own cloud service and sends alerts when one goes offline or reports a fault.
The App discovers SpinetiX digital signage players on the network you are connected to, keeps a list of the players you choose to save, and — for subscribers — monitors those players from our own cloud service and sends alerts when one goes offline or reports a fault.
2. Who is responsible for your data
The data controller is:
Media La Vista FZCO
Dubai Silicon Oasis, IFZA Properties, A1, DSO-IFZA
Dubai, United Arab Emirates
Email: welcome@medialavista.ae
Phone: +971 55 581 01 49
For privacy questions, write to welcome@medialavista.ae with “SpinetiX Find & Monitor” in the subject line.
Media La Vista FZCO
Dubai Silicon Oasis, IFZA Properties, A1, DSO-IFZA
Dubai, United Arab Emirates
Email: welcome@medialavista.ae
Phone: +971 55 581 01 49
For privacy questions, write to welcome@medialavista.ae with “SpinetiX Find & Monitor” in the subject line.
3. What the App collects, and why
Account data. If you create an account, we process your email address and the account identifier issued by Firebase Authentication. Sign-in is by email and password, Google Sign-In, or Sign in with Apple. When you use Sign in with Apple with a private relay address, we only ever see the relay address. Account data exists so that your saved player list follows you between devices and so that we can attach a subscription and monitoring alerts to the right account. An account is optional for local discovery.
Your saved player list. When you add a player to your list by hand, the App stores that entry under your account identifier in Cloud Firestore so it is available on your other devices. An entry holds eight fields and no more: the name you give the player, its address on your network, its model, its firmware version, its control-centre address, an optional location label, a flag recording that you added it manually, and the time it was first seen. Players that the App merely discovered on the network are held on that device only and are not synchronised.
Player administrator credentials are never uploaded. Any username and password you enter to administer a player is written to the platform secure store on that device — Keychain on Apple platforms, encrypted Keystore storage on Android. Those credentials are not synchronised, are not transmitted to us or to any third party, and are not part of any backup we hold.
Cloud monitoring data (paid feature only). Cloud monitoring is off until you turn it on. When you enrol a player, that player reports its own operating readings directly to our monitoring service over an encrypted connection. We hold, per enrolled player: the name you gave it, its serial number, model, firmware version and screen resolution; and a time series of temperature, storage used and total storage, processor and graphics load, uptime, and whether the player has fallen into safe mode. We also hold the alerts raised against it and the maintenance commands you issue from the App. We do not store your players' network addresses on our servers. To deliver alerts to your phone we hold a push notification token, the platform it belongs to, and the App version that registered it.
Purchase and subscription status. Payment is taken by Apple or Google. We never see your card details. Purchase receipts are validated through RevenueCat, which returns the entitlement status the App uses to unlock paid features. The App does not pass your account identifier or email address to RevenueCat; entitlements are held against an anonymous identifier that RevenueCat generates on the device.
Crash diagnostics. Crash reports are collected through Firebase Crashlytics so that faults can be reproduced and fixed. A report contains the fault trace, the device model, and the operating-system and App version. Crash reporting is switched off in development builds.
Configuration. The App asks Firebase Remote Config for the current released version number and the store links used by the update prompt. That request reaches Google servers and, like any web request, discloses your network address and client details to Google. It does not carry your account identifier or anything about your players. The interface typeface ships inside the App: no font is fetched while the App runs, and the App makes no request to Google Fonts.
What stays on your device. Network discovery — SSDP, mDNS and direct probing of addresses on the private network you are connected to — runs entirely on your device, and only against private address ranges. The results of a scan are shown to you and then discarded. Nothing from a scan reaches us unless you deliberately add a player to your list or enrol it in monitoring. Local background monitoring, where the App itself checks players on your network and raises a notification, likewise sends nothing off the device. The App does not collect your location, contacts, photos, calendar, browsing history or advertising identifiers, and it does not track you across other apps or websites.
Your saved player list. When you add a player to your list by hand, the App stores that entry under your account identifier in Cloud Firestore so it is available on your other devices. An entry holds eight fields and no more: the name you give the player, its address on your network, its model, its firmware version, its control-centre address, an optional location label, a flag recording that you added it manually, and the time it was first seen. Players that the App merely discovered on the network are held on that device only and are not synchronised.
Player administrator credentials are never uploaded. Any username and password you enter to administer a player is written to the platform secure store on that device — Keychain on Apple platforms, encrypted Keystore storage on Android. Those credentials are not synchronised, are not transmitted to us or to any third party, and are not part of any backup we hold.
Cloud monitoring data (paid feature only). Cloud monitoring is off until you turn it on. When you enrol a player, that player reports its own operating readings directly to our monitoring service over an encrypted connection. We hold, per enrolled player: the name you gave it, its serial number, model, firmware version and screen resolution; and a time series of temperature, storage used and total storage, processor and graphics load, uptime, and whether the player has fallen into safe mode. We also hold the alerts raised against it and the maintenance commands you issue from the App. We do not store your players' network addresses on our servers. To deliver alerts to your phone we hold a push notification token, the platform it belongs to, and the App version that registered it.
Purchase and subscription status. Payment is taken by Apple or Google. We never see your card details. Purchase receipts are validated through RevenueCat, which returns the entitlement status the App uses to unlock paid features. The App does not pass your account identifier or email address to RevenueCat; entitlements are held against an anonymous identifier that RevenueCat generates on the device.
Crash diagnostics. Crash reports are collected through Firebase Crashlytics so that faults can be reproduced and fixed. A report contains the fault trace, the device model, and the operating-system and App version. Crash reporting is switched off in development builds.
Configuration. The App asks Firebase Remote Config for the current released version number and the store links used by the update prompt. That request reaches Google servers and, like any web request, discloses your network address and client details to Google. It does not carry your account identifier or anything about your players. The interface typeface ships inside the App: no font is fetched while the App runs, and the App makes no request to Google Fonts.
What stays on your device. Network discovery — SSDP, mDNS and direct probing of addresses on the private network you are connected to — runs entirely on your device, and only against private address ranges. The results of a scan are shown to you and then discarded. Nothing from a scan reaches us unless you deliberately add a player to your list or enrol it in monitoring. Local background monitoring, where the App itself checks players on your network and raises a notification, likewise sends nothing off the device. The App does not collect your location, contacts, photos, calendar, browsing history or advertising identifiers, and it does not track you across other apps or websites.
4. Legal bases for processing
Where the GDPR applies, we rely on the following grounds:
- Performance of a contract — account creation and sign-in, synchronising your saved player list, delivering cloud monitoring and alerts, and confirming your subscription entitlement.
- Consent — push notifications, which you grant at the operating-system level and can withdraw at any time in system settings.
- Legitimate interests — crash diagnostics and service security, so that the App remains stable and protected against abuse. We keep this data to the minimum needed and it is not used to profile you.
- Legal obligation — retention of transaction records where tax or accounting law requires it.
5. Where your data is processed
- Our monitoring service — operated by Media La Vista on servers hosted by Hetzner Online GmbH in Helsinki, Finland (European Union). Cloud monitoring readings, alert history and push notification tokens are held here, in a database reachable only over TLS, and backed up daily.
- Google Firebase (Google Ireland Limited / Google LLC) — Firebase Authentication for accounts, Cloud Firestore for your saved player list, Firebase Cloud Messaging for alert delivery, Firebase Crashlytics for crash reports, and Firebase Remote Config for update notices. Google operates a global infrastructure and may process this data outside the EU and the UAE.
- RevenueCat, Inc. (United States) — subscription receipt validation and entitlement status.
- Apple Inc. and Google LLC — payment processing, billing and refunds for in-app purchases, under their own privacy policies. We receive confirmation of entitlement, not payment details.
We are established in the United Arab Emirates, so personal data reaching us is processed outside the European Economic Area. Where we transfer personal data out of the EEA, we rely on the European Commission's standard contractual clauses concluded with our processors, together with the technical measures described in section 7.
We do not sell personal data, and we do not share it for advertising or any other purpose unrelated to running the App, except where disclosure is required by law.
6. How long we keep it
- Account data and your saved player list — for as long as your account exists. Both are erased immediately when you delete the account.
- Cloud monitoring readings — the time series of temperature, storage, load and uptime is pruned automatically after 30 days.
- Player records and alert history — kept while the player is enrolled in monitoring under your account, and erased when you remove the player or delete your account.
- Push notification tokens — until you disable notifications, uninstall the App, or delete your account. Tokens that the notification service reports as dead are removed automatically.
- Backups of the monitoring service — the fourteen most recent daily snapshots. Data you delete can therefore persist in an offline backup for up to fourteen days before it ages out.
- Crash reports — retained by Firebase Crashlytics under Google's standard retention period for that service.
- Purchase records — retained by Apple, Google and RevenueCat for as long as their own terms and applicable accounting law require, independently of your account with us.
7. Security
All traffic between the App, our monitoring service and Firebase runs over TLS. Access to your saved player list is restricted by security rules that permit reads and writes only under your own account identifier. Player administrator credentials never leave the device secure store. Each enrolled player authenticates to our monitoring service with its own token, of which we store only a one-way hash. Access to production systems is limited to named engineers. No system is completely secure, but we design for the smallest amount of data held for the shortest useful time.
8. Deleting your account and your data
You can delete your account from inside the App at any time: open the Account tab and choose Delete account. The App withdraws your push notification tokens, instructs our monitoring service to erase everything held against your account — enrolled players, readings, alert history, pending commands and tokens — then deletes your synchronised player list, every entry and the profile record that holds it, from Cloud Firestore, and finally deletes the account itself from Firebase Authentication. The erasure is immediate and permanent: once the deletion completes, nothing of your synchronised list or your monitoring data remains in the live service. The action cannot be undone.
Because our monitoring database is backed up daily and the fourteen most recent snapshots are kept, deleted records can survive in an offline backup for up to fourteen days before ageing out. They are not restored to the live service.
If you no longer have the App installed, write to welcome@medialavista.ae from the email address on the account and we will carry out the deletion. We answer erasure requests within 30 days.
Deleting your account does not cancel a subscription. Subscriptions are managed by Apple or Google and must be cancelled in your App Store or Google Play account settings.
Because our monitoring database is backed up daily and the fourteen most recent snapshots are kept, deleted records can survive in an offline backup for up to fourteen days before ageing out. They are not restored to the live service.
If you no longer have the App installed, write to welcome@medialavista.ae from the email address on the account and we will carry out the deletion. We answer erasure requests within 30 days.
Deleting your account does not cancel a subscription. Subscriptions are managed by Apple or Google and must be cancelled in your App Store or Google Play account settings.
9. Your rights
Subject to UAE data protection law and, where it applies, the GDPR, you have the right to:
Write to welcome@medialavista.ae to exercise any of these rights. If you are in the European Economic Area or the United Kingdom and you believe we have handled your data improperly, you may also complain to your national supervisory authority.
- Access — obtain a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — have your data deleted, as described in section 8.
- Restriction — ask us to limit how we process your data.
- Objection — object to processing carried out on the basis of legitimate interests.
- Portability — receive your data in a structured, machine-readable format.
- Withdraw consent — turn off push notifications or cloud monitoring at any time, without affecting processing already carried out.
Write to welcome@medialavista.ae to exercise any of these rights. If you are in the European Economic Area or the United Kingdom and you believe we have handled your data improperly, you may also complain to your national supervisory authority.
10. Children
The App is a professional tool for people who install and maintain digital signage systems. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, write to welcome@medialavista.ae and we will delete it.
11. Changes to this policy
We may update this policy when the App changes or when the law requires it. The current version is always published at this address with a new effective date. Material changes will be announced in the App before they take effect. Continuing to use the App after a change means you accept the updated policy.
12. Contact
Media La Vista FZCO
Dubai Silicon Oasis, IFZA Properties, A1, DSO-IFZA
Dubai, United Arab Emirates
Email: welcome@medialavista.ae
Phone: +971 55 581 01 49
Dubai Silicon Oasis, IFZA Properties, A1, DSO-IFZA
Dubai, United Arab Emirates
Email: welcome@medialavista.ae
Phone: +971 55 581 01 49