Privacy Policy

1. Who we are

Rasd Vision, a company established in the Arab Republic of Egypt ("Rasd", "we"), operates the Rasd platform (rasdvision.ai, the app at app.rasdvision.ai, and the mobile app). When a customer (the owner of a chain or venue) runs our platform on their cameras, the customer is the "controller" of the data inside their branches and we act as the "processor" on their behalf under this policy and the service agreement.

2. What we never store

• Images, frames, video clips or crops of people. The engine reads a frame in memory and outputs numbers only.
• Faces, biometric templates, or any identification of a specific person.
• Visitor names or details; a visitor is a pseudonymous number that changes daily.
• Audio recordings.

3. What we process and keep

Everything stored is numbers and identifiers, never media:

• Camera events (line crossings, zone entries, group formation, queue length): numbers, timestamps and pseudonymous track IDs — kept for 13 months so that year-over-year comparison works, then deleted automatically.
• Temporary tracking samples produced by the perception device (positions and measurements, no images): deleted after 7 days.
• Staff uniform signature, if the customer enables it to exclude staff from counts: 96 numbers describing torso and leg colours with no head, no image, no face; erased when disabled.
• User account data: name, mobile or email, role, permitted branches, and a sign-in log (contact and masked IP address) for 90 days.
• Camera configuration: the stream address and its password, encrypted with a key our own staff cannot read.
• Technical system logs with passwords and tokens automatically masked, for 30 days, plus encrypted database backups.

4. Live preview

The account owner can request a live preview of a camera to verify setup and draw zones. The preview streams to their browser in real time, is never recorded or stored, and every preview request is written to the audit log. In the on-premise mode, video never leaves the customer's site except for this preview, on explicit request.

5. The customer's responsibility toward people on camera

The customer owns and operates the cameras in their premises and is responsible for the lawfulness of filming under local law (for example Egypt's Personal Data Protection Law No. 151 of 2020, and the Personal Data Protection Law in Saudi Arabia for customers there), including camera notices and informing their staff. Rasd designs the system so that no identifying data about visitors is created in the first place, which reduces this responsibility to a minimum but does not remove it.

6. Who sees what

• The account owner sees everything in their account and manages their users and branches.
• Branch managers and supervisors see only their permitted branches, each according to their role.
• Rasd staff see aggregated numbers and masked identifiers for operations and support. Any support access to a customer account ("enter as customer") is logged and reported to the owner, and never reveals camera passwords.
• Each customer's data is isolated at the database level itself (Row-Level Security), not only in application code.

7. Sub-processors and data location

We rely on providers to run the service. We do not sell data or share it for advertising:

• Hosting and databases: Oracle Cloud Infrastructure — Jeddah region, Saudi Arabia.
• Email (sign-in codes and reports): Resend.
• Sign-in codes on WhatsApp: WhatsApp Business Platform by Meta — only the code is sent.
• Mobile push notifications: Expo Push (device token and notification text, no personal content).
• Internal operational alerts for the Rasd team: Telegram (outages and offline devices, no personal data).

8. Security

TLS on every connection, encryption of camera passwords and secrets at rest, role-based permissions, sign-in rate limits, an audit log for sensitive actions, and daily backups. No system is absolutely secure; if an incident affects your data we will notify you without undue delay and as required by law.

9. Cookies

The dashboard uses session cookies only (sign-in and language preference). No advertising tracking and no third-party tracking tools.

10. Retention and deletion

Events are deleted automatically after 13 months, samples after 7 days, sign-in logs after 90 days and system logs after 30 days. On termination the owner may request an export of the account's numbers; account data is then deleted within 30 days except what the law requires us to keep (such as invoices).

11. Your rights

Account users (owners, managers, supervisors) can access and correct their data and delete their account through the account owner or by contacting us. For people recorded by cameras: we hold no data that identifies them, so no number can be linked to a specific person.

12. Children

The service is intended for businesses and their adult users. We do not knowingly collect children's data.

13. Changes and contact

We may update this policy; material changes are communicated to account owners by email or inside the dashboard before they take effect. Questions: privacy@rasdvision.ai. This document is governed by the laws of the Arab Republic of Egypt, and the Egyptian courts have jurisdiction over any dispute arising from it.