Privacy Policy

1. Scope and Data-Controller Roles

Which Watchful entity acts as the controller (or equivalent role under applicable law) of your personal information depends on where you are located and which entity you contract with:

• Watchful Systems, LLC — controller for individuals in the United States and all other jurisdictions except New Zealand and Australia.
• Watchful Limited — controller for individuals in New Zealand and Australia.

When our customers ("Subscribers") use the Platform to process video or audio captured by their own cameras, Watchful acts as a processor (or "service provider" under US state privacy laws) on behalf of that Subscriber. The Subscriber's own privacy policy governs the collection and use of recordings from their premises. If you have questions about how a Subscriber handles footage from its premises, please contact that Subscriber directly.

2. Information We Collect

2.1 Information You Provide

• Account & profile data — name, email address, phone number, job title, company name, and login credentials.
• Payment information — billing address and payment-card or bank-account details (processed by our PCI-compliant payment processors; we do not store full card numbers).
• Communications — messages you send us via email, chat, phone, support tickets, or forms on our Sites.
• Event & marketing data — information you provide when attending a webinar, trade show, or registering for a demo.

2.2 Information Collected Automatically

• Device & browser data — IP address, device type, operating system, browser type and version, language preference, and unique device identifiers.
• Usage data — pages viewed, links clicked, time spent, referral URLs, search queries, and feature-usage patterns.
• Log data — server logs that record access times, error codes, and requested URLs.
• Cookies & similar technologies — see Section 9 below.

2.3 Video, Audio, and Sensor Data (Platform)

When Subscribers connect their cameras or sensors to the Platform, we may process:

• Video and image data — live and recorded video streams, still images, and thumbnails.
• Audio data — ambient audio captured by camera microphones, and two-way voice communication via Quill Voice.
• Metadata — timestamps, geolocation of cameras, camera identifiers, resolution, and encoding format.
• AI-derived analytics — object-detection results, event classifications, anomaly scores, occupancy counts, and natural-language incident summaries generated by our AI systems (including Quill).

Watchful processes this data on behalf of Subscribers. We do not use Subscriber video or audio data for purposes unrelated to providing or improving the Services, except where required by law.

2.4 Information from Third Parties

• Business partners & resellers — referral details, company information, and contact data shared by integration partners or authorized resellers.
• Public sources — business contact information from publicly available directories, company websites, and social-media profiles.
• Identity-verification providers — where applicable, confirmation of identity or business credentials.

3. How We Use Your Information

We use personal information for the following purposes:

Where we rely on "legitimate interests," we have conducted a balancing test to ensure our interests do not override your fundamental rights and freedoms.

4. AI and Automated Processing

Watchful uses artificial intelligence and machine-learning models to:

• detect and classify security-relevant events in real time;
• generate natural-language incident summaries and voice talkdowns;
• prioritize alerts to reduce false-positive fatigue;
• produce aggregated analytics, heat maps, and occupancy data; and
• improve model accuracy through training on properly authorized data sets.

Our AI systems do not make decisions that produce legal effects or similarly significant effects on individuals without human review. Alert escalation to human monitoring operators is a core part of the Watchful workflow.

4.1 No Biometric Processing

Watchful does not use facial recognition, gait analysis, or any other biometric-identification technology. Our AI models detect and classify events and objects (e.g., "person in area," "vehicle stopped," "motion after hours") — they do not identify, profile, or catalogue individuals. No biometric templates, faceprints, voiceprints, or gait signatures are ever created, stored, or transmitted.

4.2 Incident-Scoped Tracking Only

During an active security incident, our Platform may enable a monitoring operator to follow a person or vehicle across the Subscriber's own camera network in real time to support an appropriate response. This tracking is:

• limited to the live incident — it is not retained, replayed, or used to build historical movement profiles;
• confined to a single Subscriber's cameras — it is architecturally impossible to track any person or vehicle across different Subscribers' camera networks; and
• never shared between Subscribers — each Subscriber's video, audio, and analytics are fully isolated from every other Subscriber's data at all times.

You may request information about the logic involved in automated processing that materially affects you by opening a privacy request.

5. Sharing and Disclosure

We do not sell your personal information. We may share personal information with the following categories of recipients:

• Affiliated entities — between Watchful Systems, LLC and Watchful Limited for internal administration, support, and service delivery.
• Service providers — hosting providers (e.g., AWS), payment processors, email-delivery platforms, CRM systems, analytics services, and customer-support tools, each under contractual data-protection obligations.
• Monitoring partners — third-party monitoring stations or alarm-receiving centres where required by the Subscriber's service configuration.
• Professional advisers — lawyers, auditors, and insurers, where necessary for legal, compliance, or insurance purposes.
• Law enforcement and regulators — when required by law, subpoena, court order, or governmental request, or when we reasonably believe disclosure is necessary to protect life, safety, or property.
• Business transactions — in connection with a merger, acquisition, divestiture, reorganization, or sale of assets, subject to confidentiality obligations and with prior notice where practicable.

We require all third parties to respect the security of your personal information and to process it in accordance with applicable law.

6. International Data Transfers

Because Watchful operates across the United States and New Zealand, personal information may be transferred to—and processed in—countries other than the one in which it was collected. We ensure such transfers comply with applicable data-protection laws by relying on:

• Standard contractual clauses (or equivalent mechanisms) approved by relevant authorities;
• the adequacy decisions or frameworks recognized in the relevant jurisdiction;
• binding corporate rules where applicable; and
• your explicit consent where no other mechanism is available.

For more information about international transfers, please contact our privacy team.

7. Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, including to meet legal, regulatory, accounting, or reporting requirements. Retention periods depend on the type of data:

• Account data — retained for the duration of your account and a reasonable wind-down period thereafter, or for any longer period or periods required under applicable legislation.
• Video and audio recordings — retention periods are configured by Subscribers in accordance with their own policies. Default platform retention is 30 days; Subscribers may adjust this.
• AI-derived analytics and incident logs — retained in accordance with the Subscriber's configured retention period and our obligations under applicable law.
• Marketing data — retained until you withdraw consent or opt out, plus a short suppression period to honor your preference.
• Billing records — retained for the period required by applicable tax and financial-reporting regulations (typically seven years).

When personal information is no longer needed, we securely delete or anonymize it in accordance with our data-disposal procedures.

8. Data Security

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, destruction, or alteration, including:

• encryption of data in transit (TLS 1.2+) and at rest (AES-256);
• role-based access controls and multi-factor authentication for internal systems;
• regular vulnerability assessments and penetration testing;
• employee training on data-protection and information-security practices;
• incident-response procedures, including breach-notification processes compliant with applicable laws; and
• infrastructure hosted in SOC 2-compliant data centres.

While we strive to protect your personal information, no method of transmission or storage is 100% secure. If you become aware of any unauthorized access or security incident involving your account, please notify our security team immediately.

9. Cookies and Tracking Technologies

We use cookies and similar technologies (pixels, local storage, and device fingerprinting) for the following purposes:

• Strictly necessary — essential for site navigation, authentication, and security (e.g., session cookies). Cannot be disabled.
• Functional — remember your preferences and settings (e.g., language, region).
• Analytics & performance — help us understand how visitors interact with our Sites and Platform so we can improve them (e.g., Google Analytics, Amplitude).
• Marketing & advertising — enable targeted advertising and measure campaign effectiveness (e.g., LinkedIn Insight, Meta Pixel).

You can manage your cookie preferences through your browser settings or by using our cookie-consent tool (where displayed). Disabling certain cookies may limit functionality.

Do Not Track. Our Sites do not currently respond to browser "Do Not Track" signals. We will update this Policy if that changes.

10. Your Privacy Rights

Depending on your jurisdiction, you may have some or all of the following rights regarding your personal information:

10.1 Rights Under the New Zealand Privacy Act 2020

If you are located in New Zealand, you have the right to:

• request access to the personal information we hold about you (Information Privacy Principle 6);
• request correction of inaccurate or misleading personal information (Information Privacy Principle 7); and
• complain to the Office of the Privacy Commissioner if you believe we have breached the Privacy Act 2020.

10.2 Rights Under US State Privacy Laws

Residents of California, Texas, Virginia, Colorado, Connecticut, and other states with comprehensive privacy legislation may have the right to:

• Know / Access — request the categories and specific pieces of personal information we have collected about you.
• Delete — request deletion of personal information, subject to certain legal exceptions.
• Correct — request correction of inaccurate personal information.
• Opt out of sale or sharing — we do not sell personal information. If we share data for cross-context behavioral advertising, you may opt out.
• Limit use of sensitive data — where applicable, request that we limit the use or disclosure of sensitive personal information.
• Non-discrimination — exercise your privacy rights without receiving discriminatory treatment.

Texas Data Privacy and Security Act (TDPSA). Texas residents may exercise the rights listed above. We will respond to verified requests within 45 days. You may appeal a refusal by contacting us; if your appeal is denied, you may contact the Texas Attorney General.

California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA). California residents may exercise the rights listed above. In the preceding 12 months, we have collected the categories of personal information described in Section 2. We do not sell or share (as defined by the CCPA) personal information.

10.3 Rights Under the EU/UK General Data Protection Regulation

If the GDPR or UK GDPR applies to you, you additionally have the right to:

• request restriction of processing;
• object to processing based on legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time (without affecting the lawfulness of prior processing); and
• lodge a complaint with your local supervisory authority.

10.4 Rights Under the Australian Privacy Act 1988 (Cth)

Watchful does not currently have an Australian entity. We service customers in Australia through Watchful Limited (New Zealand). Where Watchful has an “Australian link” under section 5B of the Privacy Act 1988 (Cth) — including by carrying on business in Australia and collecting or holding personal information in Australia — we are bound by the Act and the Australian Privacy Principles (APPs) in respect of our handling of your personal information.

If you are located in Australia, you have the right to:

• Access the personal information we hold about you (APP 12);
• Correct personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13);
• be informed about the kinds of personal information we collect, why we collect it, and to whom we typically disclose it (APP 1, APP 5);
• ask us to identify the source of personal information we hold about you, where we have collected it from someone other than you (APP 5);
• opt out of the use or disclosure of your personal information for direct-marketing purposes (APP 7);
• request information about, or object to, any disclosure of your personal information to recipients outside Australia (APP 8); and
• make an anonymous or pseudonymous interaction with us where practicable (APP 2).

We will respond to a verified access or correction request within a reasonable period — generally within 30 days — and at no charge. If we decline a request, we will provide written reasons and information on how to make a complaint.

Notifiable Data Breaches. Where an eligible data breach is likely to result in serious harm to an individual whose personal information is involved, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under Part IIIC of the Act.

Complaints. If you believe we have breached the Privacy Act 1988 (Cth) or the Australian Privacy Principles, you can lodge a complaint with our privacy team first. We will investigate and respond within 30 days. If you are not satisfied with our response, you may complain directly to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10.5 Exercising Your Rights

To exercise any of the above rights, please open a privacy rights request. We may need to verify your identity before processing your request. We will respond within the timeframe required by applicable law (generally 20–45 business days depending on jurisdiction).

You may designate an authorized agent to make a request on your behalf. We may require proof of authorization and identity verification from both you and the agent.

11. Children's Privacy

The Sites, Platform, and Services are not directed to individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please let us know and we will promptly delete it.

12. Third-Party Links and Integrations

Our Sites and Platform may contain links to third-party websites, plugins, or integrations (e.g., video-management systems, access control, or alarm panels). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.

13. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make material changes:

• we will update the "Last updated" date at the top of this page;
• we will provide prominent notice on our Sites or via email where required by law; and
• where legally required, we will obtain your consent before applying material changes to data already collected.

14. Contact Us

If you have questions, concerns, or requests regarding this Policy or our privacy practices, open a request and we'll route it to the right team.