Privacy Policy

1. Roles and Definitions

GijiSpot is operated by GijiTech Software Ltd. (“GijiTech”, “we”). Our customers (the businesses, properties, and organizations that deploy GijiSpot edge devices on their premises) are referred to as tenants. Persons appearing on a tenant's cameras are data subjects.

Under PIPEDA, tenants are the data controller for the surveillance footage captured on their premises and any analytics derived from it. GijiTech is the data processor, acting on each tenant's instructions and under contract.

2. Information We Collect

From tenant administrators when creating an account: name, email, organization name, role, and billing information processed by Stripe.

Video data: GijiSpot edge devices process video locally on the tenant's premises. Raw video footage is never transmitted to or stored by GijiTech. The following is sent to our cloud platform for the tenant's account:

• AI-generated events (detections, classifications, timestamps, bounding-box coordinates, confidence scores)
• Small thumbnail snapshots attached to events as evidence
• Aggregated counts and metrics (people counts, dwell times, vehicle counts)
• Persistent track identifiers and, when the tenant has activated facial recognition, face embeddings (see §4)

3. Person Detection and Tracking

GijiSpot detects persons on every connected camera as part of its core service. Detected persons are assigned an ephemeral numeric track identifier (e.g. “Person 17”) that persists for the duration of a tracking session on a single device. Track identifiers do not by themselves identify a named individual, but combined with footage they constitute personal information under PIPEDA.

Tenants who deploy GijiSpot must post visible notice that camera surveillance is in operation and the purposes for which footage is collected, in compliance with PIPEDA Principle 4.3 (Consent) and any applicable provincial law.

4. Biometric Data (Facial Recognition)

Facial recognition is an opt-in feature that a tenant administrator must explicitly activate on a tenant-by-tenant basis. The administrator must acknowledge a written consent record before activation; the acknowledgement is recorded with name, timestamp, and user ID.

When facial recognition is active for a tenant:

• The edge device computes a 512-dimension numeric vector (a face embedding) for each detected face. The original face image is not transmitted.
• Face embeddings are stored in the tenant's private database and are not shared across tenants.
• Tenant administrators can label embeddings with a person's name to produce human-readable alerts.
• Embeddings are deleted automatically when the tenant's configured retention period elapses with no further match (see §5).

Face embeddings are biometric data regulated under PIPEDA, GDPR Article 9, CCPA, BIPA (Illinois), and similar laws. Tenants are solely responsible for obtaining the lawful basis (typically explicit consent, posted notice, or both) required in the jurisdictions where they operate.

5. Data Retention

PIPEDA Principle 4.5 requires that personal information not be retained beyond what is necessary. Each tenant has a configured retention window (default 7 days for Free, 30 days for Pro; configurable per plan). A nightly automated process deletes:

• Events (including snapshot thumbnails and metadata) older than the tenant's retention window
• Aggregated analytics snapshots older than the retention window
• Face embeddings whose last sighting is older than the retention window (or whose enrollment is older if never matched)

Tenant administrators may request immediate deletion of an account or any subset of personal information by contacting [email protected]. Data subjects appearing on a tenant's cameras should direct access and deletion requests to the tenant first; we will assist tenants in fulfilling those requests.

6. Data Storage and Security

Cloud data is stored on managed infrastructure in Canadian and US data centers with encryption at rest and in transit. All edge-to-cloud communication is encrypted. Access credentials are hashed; API keys are stored as hashes only. Tenant data is logically isolated per tenant, with row-level filters on every query.

7. How We Use Information

• To provide the AI surveillance analytics service the tenant has subscribed to
• To deliver real-time alerts the tenant has configured (email, SMS)
• To process billing and manage subscriptions
• To improve the platform using aggregated, anonymized usage metrics
• To respond to support requests
• To communicate service updates and security notices

GijiTech does not use tenant surveillance data to train models for use across other tenants. Model improvements are based on aggregated platform performance metrics only.

8. Third-Party Processors

We work with vetted sub-processors for payment processing (Stripe), email delivery, SMS notifications, and cloud hosting. Sub-processors are contractually bound to PIPEDA-equivalent protections and use data only as instructed. We do not sell personal information.

9. Your Rights

You have the right to:

• Access the personal information we or your tenant hold about you
• Request correction of inaccurate information
• Request deletion of your information
• Export your information in a portable format
• Withdraw consent for biometric processing at any time
• File a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca)

Email [email protected] to exercise any of these rights. Where the tenant is the data controller, we will route the request to the tenant and assist with fulfillment.

10. Cookies

We use essential cookies to maintain your dashboard session. We do not use third-party tracking cookies.

11. Breach Notification

If a breach of security safeguards involving personal information creates a real risk of significant harm, we will notify affected tenants and (where applicable) the Office of the Privacy Commissioner of Canada in accordance with PIPEDA breach-reporting requirements.

12. Changes to This Policy

We may update this Privacy Policy. Material changes are notified by email and through the dashboard. Continued use after changes take effect constitutes acceptance.

13. Contact

Privacy inquiries: [email protected]

Mail: GijiTech Software Ltd., Toronto, Ontario, Canada.