How it works, in enough detail to check.

This is the page to read if you are reviewing us for an operator, or if you simply want the mechanism rather than the pitch. It is written by the people who wrote the software. It is not legal advice, and it is deliberately specific so that your own counsel can test the claims against something real.

Inputs and outputs

What is collected, and what is never acquired.

Per camera, at a few frames per second, from existing CCTV.

Video frames: Acquired, then immediately reduced: nominated regions filled in solid, faces blurred. The reduced frame is what everything downstream sees.
Audio: Never acquired. Refused where the stream is opened, so the camera is not asked for it. Not captured then discarded — not requested.
Faces: Detected only in order to destroy them. No template, no embedding, no matching, no gallery. Nothing about a face is stored or transmitted.
Names, badge numbers, staff records: Never collected. We are not connected to your rota, your POS or your HR system.
Person references: A short-lived internal token, so the software can tell “one person for twenty minutes” from “eight people for five”. Derived with the calendar date folded in, so the same individual on two days yields two unrelated tokens. The key exists in one process's memory and is never written anywhere.
Zone occupancy and dwell: Kept. This is the product: how many people were in a polygon, and how long each stayed. No imagery.
Evidence clips: Short blurred, redacted clips, only around a flagged event, and only once compliance detection is live for you. Shortest retention of anything we hold.

Where the processing happens

Both destructive steps are on your premises. Analysis, today, is not.

We would rather be precise about this than let a diagram imply something flattering. There are two things happening in two places and the split is moving.

On the box in your kitchen, today: the frame is decoded, the regions you declared are filled in, faces are blurred, and only then is it written or sent. That order is the point. Redaction runs before blurring, because redaction destroys pixels outright and nothing downstream — not even the face blurrer — should hold the contents of a ticket rail.

On our servers, today: detection, tracking, the zone arithmetic, the baseline and the dashboard. The frames that reach us are already redacted and blurred. Your raw frames do not leave the building.

Where it is going: detection moves onto the box in your kitchen, so that only counts and events cross the network at all. That is planned and costed, and it is a packaging change rather than a redesign, because the boundary was built as a seam from the start. Until it lands, the sentence above is what is true, and we are not going to put the future version on a marketing page as if it shipped.

One case where the first paragraph would not be true: a camera streamed straight to us with no box on site. The software supports it and the same two destructive steps still run — but they run on arrival rather than in your building, which is a materially weaker promise. We do not propose that arrangement for a pilot, and if it ever came up we would say so in writing rather than let this page cover it.

One component stays central by design: the second-opinion model that double-checks a flagged frame. It runs on the small number of frames already flagged, so centralising it costs almost no bandwidth, and fifteen copies of it sitting in restaurant back offices would be worse in every respect.

Controls

Each of these is asserted by a test, not by a policy.

A privacy claim that nobody can check is a marketing claim. Each row below has an automated test behind it that fails our build if the behaviour changes — including tests that assert the ordering of destruction relative to storage, which is the specific thing that went wrong for us twice and would not have been caught by testing blur quality alone.

No audio: Refused at the stream layer. Verified by a test that inspects what is asked of the camera.
Regions destroyed before storage: Verified against the bytes actually written to disk, not against an array in memory. On the direct path and the on-premises path, which are pinned pixel-for-pixel to each other.
Faces blurred before storage: Same standard, same two paths. The test asserts the ordering specifically.
Person references un-linkable across days: The date is inside the derivation. There is no per-employee history to accumulate, by construction.
Storage refuses a non-pseudonymous reference: Writing a raw tracker id is an error, not a lapse.
No insight mentions a person: A test rejects any generated sentence that refers to an individual, and another rejects causal claims about quantities we do not measure.
Per-person accounts, split permissions: Reading a report and opening footage are separate permissions. A manager role cannot open a clip at all.
Tamper-evident access log: Access to personal data and every failed login are hash-chained, per customer, so one customer's log can be handed over without exposing or invalidating anyone else's.
One customer cannot reach another's data: Enforced at a single chokepoint that raises rather than answering when a query arrives without a customer scope, so a forgotten scope is a loud failure instead of a silent cross-customer read.
Encrypted transport, no exceptions: Plaintext HTTP is refused outright rather than redirected, because credentials travel on every request.
Camera credentials never in source control: Placeholders only, resolved from the environment.

The regime we designed against

California, deliberately, because it is the hardest one we plan to operate in.

CCPA / CPRA: The employee exemption lapsed on 1 January 2023, so kitchen staff hold consumer rights over what is collected. Notice is owed at or before collection. In the pilot structure the operator is the business and we are its service provider — contractually barred from using the data for any purpose other than providing the service, which is also what keeps opt-out handling off the operator's desk.
CIPA, Penal Code §§630–632: California is all-party consent and the exposure is criminal, not merely civil. So audio is refused at acquisition rather than filtered afterwards. There is no configuration that turns it on.
Cal. Const. Art. I §1: California's constitutional privacy right runs against private employers, not only the state. That is why “technically compliant” is a weak posture here, and why the design aims at what a reasonable cook would consider fair rather than at the statutory minimum.
Labor Code §1051: Do not hand employee biometric data to third parties. We collect none, which is the cheapest possible way to comply.
SB 7 and the automated-decision family: Automated decisions about workers are where California regulation is actively heading. The product cannot emit a ranking or an assessment of an individual. Designing that in now is far cheaper than retrofitting it, and it is the reason a manager cannot open footage.
Not BIPA: Illinois, and frequently cited at us by mistake. It does not govern a California pilot — and in any case it attaches to biometric identifiers, which we do not create.

Retention

Different data, different clocks.

Video of staff is not the same risk as a count of how many people stood in a polygon, and treating them identically means either keeping footage too long or deleting the analytics that make the product work. These are the defaults; a pilot can negotiate them.

Blurred evidence clips: 30 days. The only category that is actual footage of people. Long enough to review an incident, short enough to defend.
Per-visit dwell records: 30 days. Pseudonymous and already un-linkable across days, but still the most granular person-level data held. Expires with the clips.
The record that an event happened: 1 year. No imagery. The corroborating clip expires long before the record does, on purpose.
Aggregated occupancy counts: Kept. Not personal information, and the only memory the baseline has. Deleting it returns your kitchen to “still learning”.
Access and failed-login log: 1 year. It is itself a record about people, so it expires too rather than accumulating forever.
Database backups: 14 days. Backups are copies of all of the above, so they expire as well — shorter than the shortest period above, so a restore cannot resurrect much.

A daily sweep enforces it, deletes are confined to the clip directory so an event record can never be turned into a way to read the disk, and what was deleted and when is itself logged.

Honest gaps

What is not finished.

A page like this is worth nothing if it only lists the parts that work.

Bare-hand detection has not cleared its bar. It must be right at least 90% of the time it flags something and catch at least three quarters of what happens, measured on a full held-out shift and sliced across clear gloves, blue gloves, wet hands and a rush. Hairnets are close and will ship first, alone. Until a class clears the bar on your own footage it runs silent.
Detection still runs in our cloud on redacted, blurred frames. Moving it on-premises is the next architectural step, scheduled before our fifth site.
A deletion request for the video analytics cannot be honoured. Person references are un-linkable by design and the key that would identify anyone existed only in memory for one shift. There is nothing to look up. We state that plainly rather than discovering it during a request; it is a strong privacy posture and an awkward compliance answer at the same time.
Signage and notice delivery are obligations no software checks. The redaction declaration is enforced by the software; those two are enforced by the agreement and by whoever signs it. Making them a technical precondition of enabling a camera is on the plan, and until it is built we are telling you it is a human step.
Timestamps are handled in one timezone today. Fine for a California pilot; a real limitation for anyone outside it, and it is being fixed before we take a site elsewhere.
Before signature we run a check on the actual server that will hold your data and report which warranties in the agreement it can verify from inside the machine and which it cannot. Ask for that output. A warranty nobody checks goes quietly false.

Documents

The three documents a pilot needs.

A pilot agreement, signage for the covered areas, and a notice at collection for staff, which the operator gives because the operator is the employer. They were drafted from the code — every factual claim in them comes from what the software actually does — and reviewed by California counsel.

We do not reproduce them on this website, on purpose. A reviewed document with a marketing paraphrase floating beside it is two documents that will eventually disagree, and the paraphrase is the one nobody re-reviews. Ask us and we will send the current text.

Ask us →