Draft Privacy Policy
This draft describes data handled by the current trial and planned managed Edge. The legal operator, address, privacy contact, service regions, and actual subprocessors must be added and reviewed by counsel before commercial release.
1. Scope
This policy covers website accounts, site device configuration, video-analysis keyframes, AI results, events, notifications, and security logs. The customer organization operating the camera system determines monitoring purposes, camera coverage, and authorized users.
2. Data we process
The system processes names, email addresses, password hashes, 2FA settings, encrypted KVM and SMTP credentials, device addresses, NVR images, object boxes and labels, rule results, event evidence, delivery records, IP addresses, sessions, and audit logs.
3. Why we process it
We use this data only to authenticate and authorize users, connect customer-designated devices, perform video analytics, provide search, run rules, send configured alerts, troubleshoot, secure the service, and meet applicable legal obligations.
4. Location and transfers
We do not copy continuous recordings from the NVR. The managed Edge processes short-lived analysis frames and keeps deduplicated keyframes and full event evidence. By default, the public console receives device health, event metadata, and annotated thumbnails. Email alerts send selected images and event text to the configured recipient.
5. AI and model training
Detection and search can be wrong and should not be the sole basis for a significant adverse decision about a person. We currently do not use customer images, labels, or embeddings to train general-purpose models. Any future training requires a separate, explicit, revocable opt-in.
6. Retention
Historical keyframes, thumbnails, event evidence and metadata follow the retention policy shown for your account, not a universal 30-day or 365-day guarantee. Device and notification credentials remain until replaced or the related device or account is deleted.
7. Sharing and access
Data is disclosed only to explicitly authorized users, customer-selected recipients, providers actually needed to operate the infrastructure, and recipients required by law. We do not sell customer video or use it for third-party advertising profiles.
8. Customer responsibilities
Customers must establish a lawful and necessary monitoring purpose, avoid highly private areas, provide clear on-site notice, handle any required employee or visitor consent or other legal basis, and review whether monitoring remains necessary. Audio is disabled by default.
9. Security, rights, and contact
The system uses encrypted credentials, least privilege, view-level authorization, customer Edge network isolation, and access auditing, but no system can promise absolute security. Formal access, deletion, export, complaint, and contact procedures will be published when operator details are finalized.