Draft v0.1 — under legal review. Not yet binding.

Privacy Policy

Effective date: [[EFFECTIVE_DATE]]

1. Who we are and what this policy covers

[[LEGAL_ENTITY_NAME]] ("Shinrai", "we", "us"), with its registered office at [[REGISTERED_ADDRESS]], provides Shinrai Vision, an AI-assisted alerting service for CCTV cameras used by businesses (the "Service"). The Service has four parts:

Edge software: the Shinrai agent and the Shinrai Agent Admin app. They run on an Apple Mac computer installed at the customer's site (the "edge computer") and connect to the customer's cameras over its local network.
Cloud service: the operator portal at vision.akcs.io (opens in a new tab) and the servers behind it, where alerts are stored and managed.
AI analysis servers: GPU servers that classify short sets of still frames sent by the edge software.
Shinrai Guard: our Android app, which delivers alerts to the customer's staff.

This policy explains what personal data the Service handles, the role we play for each kind of data, why we use it, who else processes it, how long it is kept, how we protect it, and the rights you have under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and other applicable Indian law. It does not cover a customer's own CCTV recorders or other systems that are not part of the Service.

2. Our two roles

The Service is sold to businesses (our "customers"), not to individuals. Our role depends on the kind of data.

Camera-derived data: the customer decides, we process. The customer chooses which cameras to connect, what to detect, who receives alerts and how long alerts are kept. For images and alerts that come from its cameras, the customer is the Data Fiduciary, and Shinrai processes the data on the customer's behalf as its Data Processor, under our contract with the customer.
Account and service data: we decide. For data about the people who use the portal and the apps (usually the customer's staff), and for the technical and security data we need to run and protect the Service, Shinrai is the Data Fiduciary.

If you were captured by a camera at a site that uses the Service, the business that operates that site is responsible for that data. Please contact it using the CCTV notice displayed at the site. If you contact us instead, we will pass your request to that customer and help it respond.

3. How the Service handles camera video

No continuous video leaves the site. The edge software reads the camera streams on the customer's local network. The Service does not record continuous video and does not upload video to us.
On-site activity check. A small object detector on the edge computer looks for people and vehicles. For cameras that watch for hazards such as fire, smoke or flooding, it looks for movement in the picture instead. For most cameras, frames go on to AI analysis only while this check sees activity.
AI analysis. While there is activity, the edge software sends a short set of reduced-size still frames (typically four frames, about 360 pixels on the longest side) over an encrypted connection to our AI analysis servers. The servers return a classification (for example "fence climbing" or "fire"), a risk level and a short machine-generated text description. The frames are processed in memory to produce that result, and our analysis servers are configured not to store them.
Alerts. When an event is found, the edge software creates an alert containing the event type, risk level, time, camera name, the short description and one still image from the analysed frames. The alert is sent to our cloud service so that the customer's authorised users can review it in the portal and in Shinrai Guard, and so that notifications can be sent.
Analysis outages. If AI analysis is unavailable, the edge software may send "unverified activity" alerts when its on-site detector sees a person or a vehicle. These contain the same kinds of data as other alerts, but the AI has not classified what is happening.
Number plates (gate cameras only). A customer can set a camera at a vehicle gate to number-plate mode. The edge computer reads number plates on site and checks them against a list of authorised plates that the customer keeps on the edge computer. That list is never sent to us. If a plate is on the list, nothing is stored. If it is not, an "unauthorised vehicle" alert is created with the plate number as read and a full-resolution still image, and it is handled like any other alert.
No facial recognition. The Service classifies events and behaviour in a scene. It does not recognise faces, does not use biometric identification and does not try to work out who a person is. Number-plate reading is limited to the authorised-list check described above.

4. The personal data we process

Camera-derived data (processed for our customers)

Alert still images, which may show people, vehicles and number plates.
Alert details: event type, risk level, date and time, camera and site names, and the machine-generated description, which may describe what a person is doing or wearing.
The number plates of vehicles that were not on the customer's authorised list, as part of "unauthorised vehicle" alerts.
Incident records that group related alerts, and what the customer's staff did about them: who acknowledged, assigned or resolved an incident and when, the outcome they recorded, and any notes they wrote.

Account data (Shinrai is the Data Fiduciary)

Your email address, organisation, role (owner, admin, operator or viewer) and account status.
Your password, stored only as a one-way cryptographic hash that we cannot read back.
Sign-in records: last sign-in time, failed sign-in attempts and temporary lockouts.
Your notification preferences.
For Shinrai platform administrators only: an encrypted two-factor authentication secret.

Service, device and security data (Shinrai is the Data Fiduciary)

Session records: the IP address and the browser or app identifier (user agent) used to sign in, and session times.
An audit log of significant actions in the Service, such as sign-ins, changes to users, cameras and edge computers, and actions on incidents. It records who acted, when, and from which IP address and user agent. When Shinrai staff access a customer's account, the start and end of that access, and every change made during it, are recorded with the staff member's identity.
Edge computer details: computer name, software version, online status and health reports about cameras and analysis. Health reports do not contain images.
Camera configuration: camera names, settings and stream addresses. A stream address can include the camera's username and password. We store stream addresses encrypted and show them masked in the portal.
Site names and addresses, and map locations if a customer enters them.
Push notification tokens for installations of Shinrai Guard, linked to the account that signed in on that phone.
Records of the emails we send: recipient, type of email and delivery status.
Server logs: IP addresses, request times and the parts of the Service requested.

5. Why we use personal data

To provide the Service: to analyse frames, create and deliver alerts, and show them in the portal and in Shinrai Guard.
To send notifications: push notifications to Shinrai Guard and, where enabled, alert emails; and service messages such as invitations, password resets, notices that an edge computer or AI analysis is offline, and licence reminders.
To manage accounts and keep the Service secure: sign-in, lockouts, two-factor authentication for platform administrators, audit logging, and detecting and preventing misuse.
To provide support: to diagnose problems with edge computers, cameras and analysis. When this is needed for support, security or legal reasons, an authorised Shinrai platform administrator can access a customer's account. The start and end of that access, and every change made during it, are recorded in the audit log.
To manage licences: to apply the limits and dates in the customer's order and send related reminders.
To run and maintain the Service: for example, to monitor the health of edge computers and AI analysis servers.
To comply with law: and to respond to lawful requests from authorities.

We do not sell personal data and we do not use it for advertising. We do not use camera images or alerts to train AI models unless the customer has agreed to this in writing.

6. Legal basis

Camera-derived data: the customer, as Data Fiduciary, is responsible for having a lawful basis under the DPDP Act and for giving notice to people at its sites. We provide a CCTV notice template to help.
Account and service data: we process it on the basis of the consent you give when you accept an invitation and use the Service, or where the DPDP Act allows processing without consent, for example for a purpose for which you voluntarily provided the data, or to comply with law.

Where we rely on your consent, you can withdraw it at any time (see section 13). Withdrawal does not affect processing already carried out. Because an account is needed to use the Service, withdrawing consent means that your account will be closed.

7. Who processes data with us

We use the following service providers (sub-processors). Each one processes data only to provide its service to us.

Amazon Web Services (AWS): hosts the portal, our application servers, the database, alert images and logs, and sends our emails (Amazon Simple Email Service). Location: the AWS Asia Pacific (Hyderabad) region in India. If email sending is not available in that region, emails are sent through the AWS Asia Pacific (Mumbai) region in India.
E2E Networks Limited: GPU servers in India that run the AI analysis of frames described in section 3.
Google (Firebase Cloud Messaging): delivers push notifications to Shinrai Guard on Android. Google receives the app's push token and the content of each notification: the alert type, risk level, camera name, time and internal reference numbers or, for status notifications, the name of the edge computer. Notifications do not contain images or alert descriptions. Google may process this data outside India.

We also share data:

with the customer's own authorised users, according to their role;
with destinations a customer sets up itself, such as a webhook configured on its edge computer, which are under the customer's control;
with authorities, where the law requires it;
with a successor if our business is reorganised or sold, subject to this policy.

8. Where data is stored

Our cloud service and AI analysis servers are located in India. Data held by the edge software stays on the edge computer at the customer's site until it is sent to us as described above. Apart from the push notification content handled by Google (section 7), and emails that reach each recipient through their own email provider, the Service does not transfer personal data outside India. The DPDP Act allows transfers outside India except to countries that the Central Government restricts, and we will follow any such restriction.

9. How long data is kept

[[RETENTION_STATEMENT]]

As the Service works today:

Alerts and alert images in our cloud service are kept until an authorised customer administrator deletes them. The Service does not yet delete them automatically after a fixed period.
Incidents in our cloud service, including the actions and notes recorded on them, are kept and cannot yet be deleted by users.
When a customer's account is closed, its data is not yet deleted automatically. It is handled as set out in the retention statement at the start of this section, or on request.
On the edge computer, alert images and the edge software's own rotating log files are deleted automatically after 7 days by default (the customer can change this), or sooner if storage limits are reached. Some service logs on the edge computer, which can contain alert details and number plates, are not yet deleted automatically. Alerts that cannot be delivered because the connection is down are normally kept for up to 72 hours and then discarded. Alerts that our cloud service rejects as invalid are kept on the edge computer for troubleshooting, up to the most recent 1,000.
User accounts are kept until the customer removes the user. Audit log entries are kept as a security record and are not deleted with the account.
Server logs are kept for a limited period for security and troubleshooting.
Backups: data that has been deleted can remain in our encrypted backups until those backups are replaced.

10. Cookies and similar technologies

The portal uses only cookies that are strictly necessary for signing in:

shinrai_session keeps you signed in. Scripts on the page cannot read it, it is sent only over encrypted connections, and it expires after 14 days without use and in any case after 30 days.
shinrai_impersonation is used only while a Shinrai platform administrator is assisting a customer account. It expires within one hour.

The portal does not use analytics, advertising or tracking cookies and does not load third-party tracking scripts. Shinrai Guard keeps your sign-in session in the phone's secure storage and does not include analytics or advertising tools.

11. Security

We protect personal data with technical and organisational measures, including:

encrypted connections (TLS) between browsers, apps, edge computers and our servers, and between edge computers and our AI analysis servers;
encryption at rest of our cloud database and storage, and additional encryption of sensitive values such as camera passwords and access keys;
passwords stored only as one-way hashes, and sign-in session tokens stored only in hashed form;
temporary lockout after repeated failed sign-in attempts;
role-based access within each customer account, and separation between customer accounts;
mandatory two-factor authentication for Shinrai platform administrators;
an audit log that cannot be edited through the Service;
access by our personnel only where needed, under confidentiality obligations.

The edge computer is at the customer's site and under the customer's physical control. The customer is responsible for its physical security, as set out in our Terms of Service. No method of storage or transmission is completely secure, but we work to protect the data we hold.

12. Personal data breaches

If we become aware of a personal data breach affecting data we process:

for camera-derived data, we will inform the affected customer without undue delay and give it the information it needs to meet its own obligations;
for data where we are the Data Fiduciary, we will inform the Data Protection Board of India and each affected person as required by the DPDP Act and the rules made under it.

We will also report incidents to CERT-In where Indian law requires it.

13. Your rights

Under the DPDP Act you have the right to:

obtain a summary of your personal data that is being processed and of the processing activities, and the identities of the others with whom it has been shared;
have inaccurate or incomplete data corrected, completed or updated;
have your data erased when it is no longer needed for its purpose or you withdraw consent, unless the law requires it to be kept;
withdraw your consent, where processing relies on consent;
nominate another person to exercise your rights in the event of your death or incapacity;
have your grievances addressed by us and, if you are not satisfied, complain to the Data Protection Board of India.

How to exercise these rights:

If you appear in camera images, contact the business that operates the site. We will forward any request we receive to that customer and help it respond.
If you have a user account, your organisation's administrators can change your role or remove your account. For anything else, write to [[SUPPORT_EMAIL]] or to our Grievance Officer (section 14).

We may need to verify your identity before acting on a request. The DPDP Act also places duties on individuals, for example not to file false or frivolous complaints.

14. Grievance Officer

Name: [[GRIEVANCE_OFFICER_NAME]]
Email: [[GRIEVANCE_EMAIL]]
Postal address: [[REGISTERED_ADDRESS]]

We will acknowledge your grievance promptly and respond within one month of receiving it. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

15. Children

The Service is for businesses. Accounts are only for adults authorised by a customer, and we do not knowingly collect children's data through the portal or the apps. Cameras may capture children who are at a customer's site. The Service does not identify them, or anyone else. Some optional detection types relate to child safety, for example a child who appears to be left unattended; these only describe the situation in the scene. Customers whose sites are used by children must assess their own obligations under the DPDP Act, including its rules on children's data.

16. Changes to this policy

We may update this policy. We will publish the new version on this page with a new effective date and, for material changes, tell our customers by email or in the portal before the changes take effect.

17. Contact

For questions about this policy, write to [[SUPPORT_EMAIL]]. For grievances, see section 14. See also our Terms of Service and the CCTV notice template.