Skip to content
A Alarm Management

Privacy Policy

Draft — not yet in effect

This policy is in preparation and pending legal review. Bracketed items (shown as [PLACEHOLDER]) are placeholders to be completed before launch. This document does not yet take effect and should not be relied upon.

[LEGAL ENTITY NAME] · Alarm Management AI platform (alarm-management.ai)

Effective date: [EFFECTIVE DATE] · Last updated: [LAST UPDATED DATE]

Introduction and Scope

This Privacy Policy explains how [LEGAL ENTITY NAME] ("Company," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with the Alarm Management AI platform and related websites, applications, and services (collectively, the "Service").

The Service is a software-as-a-service platform that ingests alarms and events — which may include security alarms (including edge-based AI video analytics), industrial or process alarms (such as SCADA, IoT, and process events), and general events — filters and prioritizes them into actionable items, and routes those items as "work items" to a customer's workforce to be actioned. The Service may also be used more generally as a work and workflow management system.

This Policy applies to two distinct relationships, which carry different roles under data-protection law:

  1. Our customers and visitors. Businesses and individuals who establish an account, evaluate, purchase, or administer the Service, and visitors to our marketing websites. With respect to this information we generally act as a controller (we decide why and how it is processed).
  2. Data processed on behalf of customers. Alarm, event, telemetry, and related content that flows through the Service at a customer's direction, including any personal information contained in it. With respect to this information we generally act as a processor (or, under U.S. state law, a "service provider") acting on the customer's instructions. The customer is the controller of that data.

This Policy does not change any data processing agreement ("DPA") or other contract between us and a customer. Where this Policy conflicts with a signed DPA or master agreement governing data we process on a customer's behalf, that agreement controls for that data.

Our Role: Controller vs. Processor

When we are a controller

We act as a controller for personal information we collect for our own purposes, including:

  • account registration, administration, and authentication data;
  • billing, payment, and tax information;
  • communications with us (support requests, sales inquiries, email);
  • website and product usage information we use to operate, secure, and improve the Service; and
  • marketing and event information for prospects and contacts.

For this information, this Policy is our primary disclosure and we are responsible for the choices described here.

When we are a processor / service provider

We act as a processor (GDPR) and a "service provider" or "processor" (under applicable U.S. state privacy laws) for the content data that customers and their authorized users submit to, generate within, or route through the Service. This includes alarm and event payloads, work items, case and audit records, configuration, and any personal information contained in them.

For this content data:

  • the customer is the controller and determines the purposes and means of processing;
  • we process it only to provide, secure, support, and maintain the Service, and only on documented instructions from the customer (including those expressed through the Service's configuration), or as required by law;
  • we do not sell it, share it for cross-context behavioral advertising, or use it for our own independent purposes; and
  • individuals whose personal information appears in content data (for example, people captured in security-related events, named contacts, or members of a customer's workforce) should direct privacy requests to the relevant customer as controller. We will assist the customer in responding as required by our DPA and applicable law.

Categories of Information We Process

We process the following categories of information. Whether a given category is controller data or processor data depends on the relationship described above.

Account and contact data

Name, business email address, phone number, employer or organization, job role, username, password and other authentication credentials, and account preferences.

Billing and transaction data

Billing contact and address, plan and subscription details, usage volumes used to calculate charges, invoices, and payment-method or transaction identifiers. Card and bank details are handled by our payment processor; we do not store full payment-card numbers.

Usage, device, and telemetry data

Log data, IP address, browser and device characteristics, pages and features used, timestamps, diagnostic and performance metrics, and platform telemetry used to operate, secure, troubleshoot, meter, and improve the Service.

Alarm, event, and work-item content (processor data)

The substantive data customers route through the Service, which may include:

  • security alarm and event data, including metadata and alerts produced by edge AI video analytics. For security video, the platform's architecture is designed so that inference and filtering occur at the customer's site and only filtered alarm events — not raw video — are sent to the cloud Service. Raw video need not leave the customer's premises;
  • industrial and process alarm data, such as SCADA, IoT, sensor, and process events and their associated telemetry;
  • general events and work items, including case records, assignments, resolution codes, notes, and audit-trail entries; and
  • personal information that a customer chooses to include in any of the above — for example, identifiers of individuals associated with an event, contact details, location or site information, and identifiers of the customer's own workforce who action work items.

Support and communications data

The content of support tickets, emails, and other communications with us, and related metadata.

We currently do not use cookies for advertising or third-party analytics on the Service. See "Cookies and Analytics" below.

How We Use Information and Why

Controller purposes (account, billing, usage, marketing)

As a controller we use information to:

  • create, administer, authenticate, and secure accounts;
  • provide, operate, maintain, and support the Service;
  • meter usage and data volume, calculate charges, invoice, and collect payment;
  • monitor, detect, prevent, and investigate fraud, abuse, security incidents, and violations of our terms;
  • diagnose problems, and develop and improve the Service and its features;
  • communicate with customers and contacts about the Service, including service, security, and transactional notices; and where permitted, relevant product and marketing communications, which a recipient may opt out of; and
  • comply with legal obligations and enforce our agreements.

Processor purposes (content data)

As a processor we process content data only to deliver the contracted Service — ingesting, filtering, prioritizing, routing, storing, and presenting alarms, events, and work items, and producing audit records — strictly on the customer's instructions and as set out in the applicable DPA, and to secure and support that processing.

Aggregated and de-identified data

We may create aggregated or de-identified statistics and operational metrics (for example, platform performance, capacity planning, and reliability metrics) that do not identify any individual or customer. We use such data to operate and improve the Service. We do not attempt to re-identify de-identified data.

Legal Bases for Processing (GDPR / UK GDPR)

Where the EU or UK GDPR applies and we act as a controller, we rely on the following legal bases under Article 6(1):

  • Performance of a contract — to provide the Service to a customer and administer the account, billing, and support relationship;
  • Legitimate interests — to secure, operate, troubleshoot, meter, and improve the Service, prevent fraud and abuse, and conduct limited B2B marketing, where those interests are not overridden by your rights. We carry out balancing assessments for these uses;
  • Legal obligation — to comply with tax, accounting, and other legal requirements; and
  • Consent — where we ask for it (for example, certain marketing in some jurisdictions), which you may withdraw at any time.

Where we act as a processor, the customer (as controller) is responsible for establishing a legal basis for the processing it instructs us to carry out, including any required notices to or consents from data subjects.

Disclosure of Information and Sub-processors

We do not sell personal information and do not share it for cross-context behavioral advertising. We disclose information only as follows.

Service providers and sub-processors

We use third-party providers to deliver the Service, including cloud infrastructure and hosting, data storage, communications and email, payment processing, error monitoring, and customer support tooling. When these providers process content data on our behalf, they act as our sub-processors under written terms consistent with Article 28 GDPR and our customer DPAs, and are restricted to processing the data only to provide their services to us. A current list of sub-processors (provider, purpose, location) is available at [PLACEHOLDER: sub-processor list location / contact].

Enterprise and bring-your-own-infrastructure deployments

For enterprise customers, the Service may be deployed into the customer's own infrastructure or cloud environment, and/or configured to read from and write to the customer's own cloud storage or databases. In those deployments, the customer's chosen infrastructure and storage providers are the customer's vendors, not our sub-processors, and the customer is responsible for that environment. We process only the data necessary to deliver and support the Service as configured.

Business and legal disclosures

We may disclose information: (i) to comply with law, legal process, or enforceable governmental requests; (ii) to enforce our agreements and protect the rights, safety, and security of the Company, our customers, or others; and (iii) in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality and, for content data, the applicable DPA.

International Data Transfers and Data Residency

We and our sub-processors may process information in countries other than the one in which you are located, including [PLACEHOLDER: list primary hosting regions / countries]. Where we transfer personal information out of the European Economic Area, the United Kingdom, or other regions with transfer restrictions, we rely on a lawful transfer mechanism, such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with any supplementary measures required.

For customers with data-residency requirements, the Service offers [PLACEHOLDER: describe available data-residency / regional hosting options, if any] and the enterprise deployment options described above, which allow data to remain within the customer's chosen environment or region.

Data Retention

As a controller, we retain account, billing, and related data for as long as the account is active and afterward as needed to meet legal, tax, accounting, and legitimate business requirements, after which we delete or de-identify it.

As a processor, we retain content data for the duration of the customer's subscription and in accordance with the customer's configuration and the applicable DPA. On termination, we make content data available for export for a limited period and then delete it as described in the customer agreement, except where retention is required by law. Specific retention periods (for example, for logs, backups, and the post-termination export window) are [PLACEHOLDER: retention schedule].

Security

We maintain administrative, technical, and organizational measures designed to protect information appropriate to the risk, which may include encryption in transit, access controls, tenant isolation, and logging. For security video, the platform is designed so raw video stays on-site and only filtered alarm events reach the cloud, reducing the data exposed to the Service.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your Privacy Rights

EEA / UK (GDPR) rights

Subject to conditions and exceptions in the GDPR, individuals have the right to access, rectify, erase, restrict, and object to processing of their personal data, to data portability, and to withdraw consent. You also have the right to lodge a complaint with a supervisory authority.

U.S. state privacy rights (CCPA/CPRA and similar laws)

Depending on your state of residence, you may have the right to know or access the personal information we have collected, to request deletion, to correct inaccurate information, to opt out of any "sale" or "sharing" of personal information and of certain targeted advertising and profiling, and to be free from discrimination for exercising these rights. We do not sell or share personal information as those terms are defined under these laws. We do not use or disclose sensitive personal information for purposes that would trigger a right to limit its use.

How to exercise rights

Where we are the controller, submit requests to [PLACEHOLDER: privacy contact email] and we will verify and respond within the timeframes required by law. You may use an authorized agent where the law permits.

Where the request concerns content data for which a customer is the controller (for example, data about events, contacts, or a customer's workforce), we will refer the request to, or act on the instructions of, the relevant customer, and we will assist that customer as required by our DPA and applicable law.

Cookies and Analytics

Our marketing website and the Service use only the cookies and similar technologies necessary to provide core functionality, such as authentication and session management and security. We currently do not use third-party advertising cookies or third-party analytics or tracking technologies on the Service.

Children's Privacy

The Service is a business product intended for organizations and is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, where required, provide additional notice. Your continued use of the Service after an update takes effect constitutes acceptance of the revised Policy, to the extent permitted by law.

Contact Us

For questions about this Policy or our privacy practices, or to exercise your rights, contact:

[LEGAL ENTITY NAME]
[PLACEHOLDER: registered business address]
Email: [PLACEHOLDER: privacy contact email]
Data Protection Officer / Privacy contact: [PLACEHOLDER: DPO or privacy officer name/email, if appointed]