Privacy Policy

1. Our Role (Controller vs. Processor)

Under the UK General Data Protection Regulation (UK GDPR):

• We are the Data Controller for your Website Data (newsletter signups) and Account Data (billing details, admin users).
• We are the Data Processor for your Fleet Data (IP addresses, device identifiers, and operational logs generated by your devices). We process this data solely to provide the Service to you, as further detailed in our Data Processing Addendum (DPA).

2. The Data We Collect

We collect different types of data depending on how you interact with us:

A. Website Visitors (Marketing & Sales)

• Contact Information: If you sign up for our notification list or early access programme, we collect your email address.
• Usage Data: Information about how you interact with our website, including pages visited and time spent.
• Technical Data: Browser type, device information, and IP address for functionality and security.

B. Platform Customers (Account Data)

• Identity Data: Name, username, and email address of account holders.
• Financial Data: Billing address and payment card details (processed securely by Stripe; we do not store full card numbers).
• Service Usage: Logs of how you use the dashboard and API.

C. Operational Metadata (Your Devices)

When you install Loc.ai:Link, the software transmits "heartbeat" data to our Control Plane:

• Device Identifiers: Unique Node IDs (UID) and hashed MAC addresses.
• Network Data: Public IP addresses (required for connectivity).
• Health Metrics: CPU/RAM usage and version numbers.

3. The Data We DO NOT Collect ("Zero Egress")

We do not access or process your Inference Content. Unless you explicitly configure the Service to route data to us:

• We do not see the images, video feeds, audio, or text inputs sent to your devices.
• We do not see the raw output or predictions generated by your AI models.
• This data remains local on your Authorized Nodes.

4. How We Use Your Data & Legal Basis

5. Sharing Your Data

We do not sell your data. We share data only with:

• Service Providers: Third-party tools that help us operate (e.g., email marketing platforms, analytics tools).
• Infrastructure Sub-processors: Vendors who host our platform (e.g., AWS) or process payments (e.g., Stripe).
• Legal Authorities: If required by law or to protect our rights.

6. Data Retention

• Marketing Data: We retain your email for as long as you remain subscribed. If you unsubscribe, we will delete your data within 30 days.
• Account Data: We retain account data for the duration of your subscription plus 6 years for tax/legal compliance.
• Fleet Data: Operational logs are retained for a limited period (e.g., 30-90 days) to assist with debugging, then deleted.

7. International Transfers

Our primary infrastructure is in the UK/EEA. However, some service providers (e.g., for email marketing or payments) may be based in the USA.

8. Your Rights

Under the UK GDPR, you have the right to:

• Access: Request a copy of your data.
• Correction: Fix inaccurate data.
• Erasure: Request deletion of your data (Right to be Forgotten).
• Withdraw Consent: Unsubscribe from marketing at any time.
• Complaint: Lodge a complaint with the ICO (ico.org.uk) if you believe we have violated your rights.

To exercise these rights, contact us at: privacy@locai.co.uk

9. Cookies

We use cookies to improve your experience.

• Essential Cookies: Required for the dashboard to work (e.g., keeping you logged in).
• Analytics Cookies: Used to track website performance. You can control these via your browser settings.