Privacy policy

1. Who is responsible

Agentinosaurus Labs is the controller of account, billing, website security and support information for its own service operations. For personal data in camera settings, instructions, observations and alerts processed on a business customer’s behalf, that customer determines the purposes and is normally the controller; we act as processor under the data processing addendum. If you are filmed by a customer, contact that camera operator about the monitoring. We can help route a request when we can identify the relevant operator.

2. Footage, frames and AI providers

When you choose Local model for detection, Station processes the masked frames with an optional model on that computer, without sending them to a cloud AI provider. Assessment results, incident information, usage counts and device health still reach our API. Model downloads contact the selected upstream download hosts. Setup paths are encrypted for the Station; our API stores the encrypted commands and model status, not plaintext paths. Local detection has no AI provider token charge but uses your hardware and electricity. It still requires an active Agentinosaurus account and API connection. Camera Chat is separate and continues to send its images and questions to OpenAI when used.

With a cloud AI provider, Station reads your camera stream on your network, selects frames and sends them directly to the AI provider selected for that camera (OpenAI or TypeSafe AI) using your API key, together with Event instructions and relevant assessment history. Those frames do not pass through our application API. This is external AI processing, not analysis confined to your home or business. The selected provider receives images that may show people, surroundings, documents and other personal or sensitive information.

Our API receives the resulting assessments, incident descriptions, timestamps, identifiers, camera health and usage information. Descriptions can reveal personal information even without an image. We also exchange connection information to enable direct Station-to-browser viewing and snapshots; that connection information can contain network addresses.

If you select TypeSafe AI, Station sends the same categories of selected frames and instructions directly to TypeSafe AI using your key. Review its current terms, privacy policy, processing locations and retention settings before selecting it. OpenAI-specific data controls described below do not apply to TypeSafe AI. Its image API is experimental and may change or become unavailable. We do not automatically switch providers if a request fails.

Your OpenAI contract, project settings and applicable policies govern its handling of your inputs and results. OpenAI states that API data is not used for model training by default unless you opt in. Its default abuse-monitoring retention can be up to 30 days, with exceptions and additional retention for some features or legal and safety purposes. Zero Data Retention requires eligibility and configuration and is not supplied merely by using Agentinosaurus. Review OpenAI’s current data controls before monitoring personal or sensitive information.

When you use Camera Chat, Station captures three fresh frames, or uses the retained incident snapshot when you ask about an incident, and sends them with your question and recent answers directly to OpenAI using your key. Questions and answers pass through our API in transit to reach your browser; we do not store a chat transcript. Station keeps the last three questions and answers in memory for follow-up questions and forgets them when the conversation closes. We record usage, such as token counts and estimated cost, without questions, answers or images.

Context you add to a camera, such as a description of the place and the names, descriptions and positions of areas, is stored encrypted with the camera and sent to your AI provider with assessments. Hidden areas are painted black on Station before motion filtering, buffering, snapshots and any request, and their names are never sent. The still image you use to draw areas travels directly from Station to your browser and is not saved by our API.

3. Information we receive

Account information includes your email, protected password hash when you set a password, verification and session records, accepted terms version and date, the language you used, support communications and billing references. We send account and billing emails in that language. Stripe handles payment details; our application does not collect or store your full payment-card number.

If you use Google sign-in, when it is offered, Google supplies your verified email and a stable account identifier so we can create or connect your account. Google receives the sign-in request and related browser metadata under its own privacy policy. We do not request access to your Gmail, contacts, Drive or camera footage through Google sign-in, and do not retain Google access or refresh tokens.

When you subscribe, we record the plan and camera slots you ordered, when you asked for the service to start immediately and which terms version was shown, the contract confirmation we sent you and any withdrawal statement, including your name, account email, the time we received it and the refund made.

Workspace information includes camera and Station names, connection settings, pairing and authorization records, Event instructions, schedules, saved provider credentials, AI observations, incidents, Messages, notification preferences and webhook configuration and delivery records. Names, URLs, instructions and support material may themselves contain personal data.

Technical information includes IP addresses and request metadata available to our hosting and network providers, device or software versions, timestamps, errors, health and usage counters needed for security, troubleshooting and service operation. Do not send passwords, API keys or unnecessary footage in support messages.

4. Purposes and legal bases

We use account and service information to perform our contract with you (GDPR Article 6(1)(b)); accounting and other legally required records to meet legal obligations (Article 6(1)(c)); and proportionate security, abuse prevention, troubleshooting, business contact and legal-claims processing for our legitimate interests (Article 6(1)(f)), balanced against your rights. We keep purchase, immediate-start and withdrawal records to perform the contract, to meet consumer and accounting obligations and to establish or defend legal claims. Where consent is legally required for an optional activity, we obtain it separately and you may withdraw it without affecting earlier lawful processing.

Required account information is necessary to provide access; without it we cannot create or operate your account. Optional features such as push and Webhooks need the information required for their delivery. Browser permission to receive push is a technical choice, not a lawful basis for all camera monitoring. The camera operator must establish its own lawful basis, including any additional condition for sensitive data.

5. Recipients and your choices

Authorized personnel and the service providers listed in section 6 process information as necessary to operate, secure or support the service. Each receives only what its function requires; for example, Resend receives the recipient address and content of the emails it delivers, and Cloudflare receives request metadata such as IP addresses when traffic reaches it.

If you enable push, your browser or operating-system push provider receives a subscription endpoint and encrypted notification delivery. Our push content is a generic notice rather than a scene description. If you enable Webhooks, incident information is delivered to the endpoint you choose; its operator can retain and further process it. Your recipients and your AI provider are services selected by you, not automatically our subprocessors for footage.

If you enable notifications in our Android app, Google Firebase Cloud Messaging processes installation identifiers and a delivery token to route a generic notification to your phone. We send only a notification type and language through FCM, never footage, frames, incident descriptions, camera names or AI provider keys. You can turn these notifications off in the app or Android settings. Firebase Analytics is not enabled. See https://firebase.google.com/support/privacy for Firebase processing and retention information.

If you connect Zapier, it receives your account email to label the connection, camera and Event names, incident identifiers, timestamps and links to authenticated workspace pages. Incident summaries are shared only if you allow them when connecting and enable them for that automation. We do not send footage, frames, camera credentials or AI provider keys to Zapier. Zapier and the apps you connect may retain and further process the information under their own terms. Disconnecting stops future access and pending deliveries; it does not delete copies already received by those services.

We may disclose information where legally required, to protect legal rights or security where lawful, or as part of a business reorganization subject to appropriate confidentiality and data protection safeguards. We do not sell personal information or customer footage, or use customer content to train general-purpose AI models.

Website analytics

We use Vercel Web Analytics for aggregate page views and product actions, such as registration requests, Station download clicks and checkout creation. It does not use analytics cookies. We remove URL query parameters and fragments and group private workspace paths before sending them. We do not attach account identifiers, email addresses, camera names, footage, prompts or API keys to analytics events. Vercel receives technical request information needed to provide analytics. See https://vercel.com/docs/analytics/privacy-policy for its processing practices.

6. Service providers and locations

We use the providers below to run the service. When they process personal data on our behalf, they do so under a data processing agreement. Stripe and Google act as independent controllers for their own processing. This list is also the subprocessor schedule under our data processing addendum; we will update it before adding or replacing a provider.

OpenAI and TypeSafe AI are not on this list: you select and contract with your AI provider directly, and Station sends frames using your key, as section 2 explains. Browser push services, such as those run by Apple, Google or Mozilla, depend on your browser or device. Our Android app uses Google Firebase Cloud Messaging, as listed below. Webhook endpoints are chosen by you.

7. International processing

Our application, database and backups are hosted by DigitalOcean in Frankfurt, Germany. Station installers are stored in Cloudflare R2 in Western Europe; that bucket distributes software downloads, not camera footage. These locations do not establish the processing location of every other provider or recipient.

Providers and recipients may process information outside your country, including outside the EEA. An EU company or European hosting does not mean every processing activity stays in the EU. Where we arrange an EEA personal-data transfer, we use an applicable adequacy decision, including the EU-U.S. Data Privacy Framework for certified recipients, or appropriate safeguards such as European Commission Standard Contractual Clauses, with additional measures where required. Contact us for the safeguards applicable to your data. You must assess the location and transfer terms of your selected AI provider project and recipients you independently select.

8. Retention and deletion

Station’s unprocessed frame windows have a five-minute processing deadline. While Station is running, its cleanup removes expired pending frames. Incident snapshots are local JPEG files and are normally removed after seven days, or sooner when the local storage cap is reached. Cleanup cannot run while the computer is off. Independent downloads, backups and copies with your AI provider or your webhook recipients follow their own retention; our deadlines do not delete those copies.

Detailed BYOK assessment records and completed notification or webhook delivery records are generally pruned after 30 days by the service’s cleanup jobs. Workspace incidents, Messages and configuration are separate records: the 30-day diagnostic period does not automatically delete them. They remain for your workspace use until removed or until account deletion is handled. Saved API keys remain until removed or account deletion; deleting them here does not revoke the actual key at your AI provider.

We retain account information while needed to provide the account and handle closure, and accounting, security or legal-claim records for the applicable statutory or justified period. Accounting records are kept for five years from the end of the year they concern; purchase, immediate-start and withdrawal records are kept until claims related to the contract expire. Retention depends on the type of record, legal duty and any dispute or legal hold. Contact us to request deletion or the retention information relevant to a record. After a verified deletion request, we erase information no longer needed, restrict any legally retained records and address backup copies through the applicable backup lifecycle. We do not promise instantaneous erasure from every system.

9. Security and access

Sensitive server-side content and saved AI provider keys are encrypted at rest; passwords are hashed. Operational fields such as identifiers, timestamps, status and counters may remain readable so the service can operate. This is not end-to-end encryption: our authorized systems can decrypt the information needed to provide the service. No security control eliminates every risk.

Paired Stations receive usable provider credentials. Local pending frame storage is protected, but retained snapshot JPEGs rely on device access controls and are not individually encrypted by Station. Use operating-system full-disk encryption, secure accounts and appropriate backup protection. A compromised device or administrator may access images or usable keys.

Please report security vulnerabilities to [email protected]. Our security.txt file at /.well-known/security.txt gives the current contact. Do not access other people’s data, disrupt the service or publish details before we have had a reasonable chance to fix the issue.

10. Your rights

Subject to the GDPR’s conditions, you may request access, correction, erasure, restriction and portability; object to processing based on legitimate interests; and withdraw consent where processing relies on it. Send a request to [email protected]. We may ask for proportionate information to verify identity and normally respond within one month, with any legally permitted extension explained to you.

You may complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), or the competent authority where you live, work or consider an infringement occurred. Where we act as processor, we assist the camera operator in responding rather than independently deciding its monitoring purposes.

11. Children, decisions and updates

Accounts are for adults. Cameras can nevertheless capture children or vulnerable people; the operator must determine whether and how that monitoring is lawful. AI observations assist human review; the service is not intended to make solely automated decisions producing legal or similarly significant effects about individuals.

Our Cookies & local storage notice describes browser storage. We publish dated updates to this policy and give appropriate notice of material changes. A policy update does not itself authorize a new incompatible use of personal data.