Privacy Policy

• Account details: your name, email address and password. Passwords are stored securely by our sign-in provider, and we never see them in plain text.
• Profile photo: if you add one. Profile photos are stored at a public web address so they can be shown in the app.
• Billing details: your plan, payment history and billing address. Card details are handled by Stripe, and we never receive your full card number.
• Your content: the photos and videos you upload or import from cloud storage you connect, the prompts and reference images you give us, and the results we produce.
• Live monitoring (Enterprise): short video clips that our monitoring agent captures from the cameras you connect and sends to us, your monitor settings and alert rules, and the email addresses, webhooks or Slack channels you ask us to send alerts to.
• Analytics results: what we find in your content, such as counts, line crossings, dwell times and the file names they relate to.
• Usage information: the jobs you run, credits used, processing times and error logs.
• Integrations you set up: cloud storage connections (we encrypt the credentials with AES-256 before storing them) and webhook addresses.
• Messages you send us, by email or through the contact page.
• Technical data: IP address, browser type and request logs kept by our hosting providers for security and troubleshooting.

• To provide the Service and your account: processing your content, running your monitors and alerts, tracking credits and taking payment. Basis: performing our contract with you.
• To keep the Service secure and working: preventing fraud and abuse, fixing problems and improving performance. Basis: our legitimate interests.
• To keep financial records required for tax and accounting. Basis: legal obligation.
• To email you about your account, billing, finished jobs, alerts you set up and important changes. We do not send marketing emails without your consent.

We do not sell your data, we do not use your content to train AI models, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

When you ask the analytics assistant a question, we send your question and a text summary of your batches to Google's Gemini service so it can answer. The summary includes batch names, prompts, file names, counts and dwell times. It never includes your images or video. If you would rather not share this, simply don't use the assistant; the rest of the Service works without it.

If the photos, videos or camera feeds you upload or connect show other people, you decide why and how that footage is processed. That makes you the data controller for it, and we act as your processor. We process it only to provide the Service to you, keep it confidential, and delete it as described in section 7. You are responsible for having a lawful basis to collect it and for telling people where the law requires it (for example, CCTV signs). Enterprise customers can ask us for a data processing agreement.

When you share a result, anyone with its link can view it, and it may appear in our public showcase. Only share results you are happy to make public. You can stop sharing at any time, and the link stops working when the result file is deleted.

We use trusted providers to run the Service. They process data only on our instructions, under contracts that require them to protect it:

If you set up a webhook, we send job updates (the job ID, its type and your user ID) to the address you give us, and alerts go to the email addresses, webhooks or Slack channels you choose. We may also disclose data if the law requires it, or to a buyer if the business is sold, in which case this policy continues to apply.

Deleted data can remain in our providers' encrypted backups for a short time before it is overwritten.

Some of these providers process data outside the UK, mainly in the USA. Where they do, the transfer is protected by UK-approved safeguards, such as the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum to standard contractual clauses.

You can ask us for a copy of your data, or to correct it, delete it, restrict or object to how we use it, or transfer it to another service. Email enquiries@cipherspace.co.uk and we will reply within one month. To close your account, use the delete option in your account settings or email us. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put things right first.

We only use cookies that are strictly necessary to keep you signed in and the Service secure. Your browser also stores the progress of large uploads, so an interrupted upload can resume. We do not use advertising or analytics cookies, so we do not ask for cookie consent. If that changes, we will update this policy and ask you first.

Data is encrypted in transit and at rest. Your files are stored privately and opened through short-lived links that expire within 24 hours; the only exceptions are profile photos and results you choose to share. Access to data is restricted, and stored credentials are encrypted. No system is perfectly secure, but if a breach puts your data at risk, we will tell you and the ICO without undue delay.

The Service is not intended for anyone under 18, and we do not knowingly collect their data.

We will post any changes here and update the date at the top. For significant changes, we will email you as well.

Questions or requests: enquiries@cipherspace.co.uk, or write to Cipher Space (operated by Vishal Khistariya), 165 Birstall Meadow Road, Birstall, LE4 3EY, United Kingdom. See also our Terms of Service.