CCTV Guard AI Privacy Policy
Last updated: 6 August 2026
PT Indo Smart Media ("We") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use CCTV Guard AI.
1. Information We Collect
a. Personal Information
- Full name
- Email address
- Phone/WhatsApp number
- Company name and location type
- Profile photo (avatar), if you upload one
b. Camera and Recording Information
- CCTV camera configuration (RTSP address, name, location)
- Snapshots and video clips generated when alerts are detected
- Anomaly detection logs and security events
- Tunnel Box device data (device identity, firmware version, connection status)
c. Biometric Data (Face Recognition)
If you enable the Face Recognition feature, we process:
- Face photos that you register
- A mathematical representation of the face (face embedding) derived from those photos for matching purposes
Biometric data is a specific category of personal data. We only process it when you deliberately enable this feature. You are responsible for obtaining consent from every person whose face you register. Biometric data can be deleted at any time by removing the relevant face profile from the app.
d. Location Data
- GPS coordinates are collected only when you press the SOS button, and are sent along with the emergency signal to the emergency contacts you registered
- We do not continuously track your location in the background
e. Technical Information
- IP address and general location
- Device type and operating system
- App usage logs and account activity audit trail
- Push notification token (FCM)
2. How We Use Information
- Providing the Service: CCTV monitoring, AI-based anomaly detection, and security notification delivery
- Communication: Sending security alerts via push notification, WhatsApp, and email
- Reporting: Generating daily security reports with analysis
- Account Security: Recording an audit trail of significant activity (login, camera changes, evidence locking, SOS, payments) to detect misuse
- Billing: Processing subscription payments and issuing invoices
- Customer Support: Responding to questions and technical assistance requests
- Legal Compliance: Meeting applicable legal obligations
3. How Long Data Is Retained
| Data Type | Retention Period |
|---|---|
| Evidence locked in the Evidence Locker | Never deleted automatically — retained until you unlock it |
| Alert snapshots & video clips | Per plan: 7 days (Lite & Custom), 30 days (Pro), 90 days (Enterprise) |
| Monitoring frames that never became alerts | 2 days |
| Biometric data (face photos & embeddings) | Until you delete the face profile |
| Account data after service termination | 30 days, then permanently deleted |
Recommendation: lock important events in the Evidence Locker before your plan's history period elapses. Once past, the files cannot be recovered.
4. Data Security
- SSL/TLS encryption for all data transfers
- CCTV recordings, evidence, face photos, and avatars are protected by digitally signed links valid for only 6 hours — a leaked link expires by itself and cannot be opened by others
- JWT authentication with a limit on concurrent active sessions per account
- Passwords are stored hashed (bcrypt), never in plain form
- Audit trail for significant account activity
- Firewall and server security monitoring
- Regular encrypted data backups
5. Sharing Data with Third Parties
We do not sell your personal data. Data is shared only as necessary with the following service providers:
| Party | Data Shared | Purpose |
|---|---|---|
| AI Vision provider | Camera image frames for analysis | Anomaly detection |
| Firebase Cloud Messaging (Google) | Device token and brief notification content | Push notifications |
| WhatsApp Cloud API (Meta) | WhatsApp number and alert message content | WhatsApp notifications |
| Winpay (payment gateway) | Name, email, and transaction amount | Payment processing |
| Server hosting provider | All service data (encrypted in transit) | Infrastructure |
Data may also be shared when required by law, court order, or valid legal process; and where necessary to protect the rights, property, or safety of our users.
Face recognition is processed on our own servers and is not sent to third-party providers.
6. Your Rights
You have the right to:
- Access the personal data we hold about you
- Update or correct inaccurate information
- Delete biometric data by removing face profiles from the app
- Request deletion of your account and related data
- Withdraw consent to data use at any time
- Download copies of your evidence using the Download button in the app
Account deletion can be performed directly from the app (Settings → Delete Account) or by contacting us.
7. Your Responsibilities as the Camera Operator
Where your cameras record other people (employees, guests, customers), you act as the data controller for that footage. You are responsible for:
- Displaying notice that the area is under CCTV surveillance
- Not installing cameras in private spaces (bathrooms, changing rooms)
- Obtaining consent before registering a person's face into the Face Recognition feature
- Ensuring your use of the footage complies with applicable regulations
8. Cookies and Tracking Technologies
- Keeping your login session active
- Storing language and display theme preferences
- Analysing website usage anonymously
9. Children's Data
Our service is not intended for children under 18. We do not knowingly collect data from children.
10. Policy Changes
We may update this Privacy Policy from time to time. Significant changes will be notified via email or in-app notification.
11. Contact Us
If you have questions about this Privacy Policy, contact us:
- PT Indo Smart Media
- Address: Jl Crusher No. 26 Kota Bandung
- Phone: 08119629391
- Email: rizal.ihsan@indosmartmedia.com