Privacy Policy

Last updated September 2026 · Draft

This policy explains what information Camera Engine — operated by ZennialHub Technologies — collects, why, and how it's handled. It applies to vendors (ISPs/MSPs using the Service) and the end customers they provision.

1. What we collect

From vendors

• Company name, contact name, and contact email, provided at signup;
• A password hash for vendor portal access (never the plaintext password);
• API usage — which endpoints are called, when, and by which key.

From end customers (provisioned by a vendor)

• Name and email, provided by the vendor during provisioning;
• Camera details, including RTSP credentials — stored encrypted, never returned in plaintext by any API response;
• Camera status and stream activity (e.g. when a live session was started).
• If AI face detection is enabled on a camera (an operator-controlled setting, off by default): a count and pixel location of every face present in a periodic snapshot. This never identifies who anyone is — there is no facial recognition or identity matching anywhere in the Service. Only when a face is actually detected, a snapshot image (with the detected face boxed) is saved; an empty scene saves nothing. Snapshots are kept for 7 days, then automatically and permanently deleted.
• If motion-triggered recording is enabled on a camera (also operator-controlled, off by default): a short (~20 second) video clip is saved whenever motion is detected — not continuous or 24/7 recording. Clips are kept for 7 days, then automatically and permanently deleted.

2. How we use it

Data is used to operate the Service: authenticating requests, scoping every camera and customer to the correct vendor, computing usage for billing, and troubleshooting when something goes wrong. We do not use vendor or customer data to train models, and we do not use third-party analytics or advertising trackers on any part of this Service.

3. Data retention

• Database backups are retained for 14 days on a rolling basis.
• Portal and account-activation invite tokens expire after 7 days if unused.
• Deleted vendors, customers, and cameras are soft-deleted (recoverable internally for a period) rather than immediately purged, to protect against accidental deletion.
• Recorded video clips and face-detection snapshot images are retained for 7 days, then automatically and permanently deleted.

4. Data sharing

We do not sell vendor or customer data. Data is not shared with third parties except infrastructure providers necessary to run the Service (e.g. hosting), under obligations consistent with this policy. Recorded clips and face-detection snapshots are stored either on the server itself or, at the operator's configuration, with a third-party object-storage provider (e.g. Amazon S3 or a compatible service) — that provider only ever stores the file and has no access to the rest of the Service.

5. Your rights and choices

Vendors and end customers can request access to, correction of, or deletion of their personal data by contacting us at the address below. End customers should generally direct requests to the vendor that provisioned their account first, who can relay the request to us; you can also contact us directly and we'll route it appropriately. We aim to acknowledge requests within a reasonable time and will let you know if any part of a request can't be fulfilled (e.g. data we're required to retain for billing or legal reasons) and why.

Grievance Officer: name and direct contact — to be specified. If you're not satisfied with how a request or complaint was handled, you can escalate to the Grievance Officer named above.

6. Security

See the Security page for the specific technical measures in place (encryption, tenant isolation, access controls) and their current limitations.

7. Changes to this policy

We may update this policy as the Service evolves. Material changes will be reflected here with an updated date.

8. Contact

Privacy questions or data requests can be sent to info@zennialhub.in.