Service Privacy Policy

This notice covers the Home Intelligence Service and the Business Intelligence Service.

1. Who this notice is for

This Service Privacy Policy explains how Smart City Operating System Limited ("scOS", "we", "us") handles personal data when you use, or are recorded by, our property-security service in England and Wales.

It applies to:

• Home Intelligence Service customers (residential account holders and their households);
• Business Intelligence Service customers (organisations and the people who run their account);
• anyone whose image or behaviour is processed because they came into view of a camera connected to an scOS Intelligence Hub, including visitors, neighbours, couriers, household staff, and employees or contractors on a business customer's premises.

You do not need to be a customer to use the rights and complaints routes in this notice.

This notice sits with:

• the Website Privacy Policy: scos.co.uk only;
• the App Privacy Policy: the iOS and Android apps;
• the data-protection complaints procedure.

Where those notices and this one overlap on the security service, this notice governs.

This notice is given under the UK GDPR and the Data Protection Act 2018. We offer the service in England and Wales. We do not target the service at people in the EU as a separate market. The Information Commissioner's Office (ICO) is our supervisory authority.

2. Who we are

Controller: Smart City Operating System Limited, trading as scOS.

We have not appointed a Data Protection Officer. The person responsible for data protection is the sole director, Flynn Robinson, as the controller's representative.

Use the registered office for formal legal notices. Use the London correspondence address for ordinary mail and postal complaints. The London address is not the registered office. Hub returns use the Caddington address, as set out in the Service Agreement.

3. What the service is, and what it is not

The service is an automated property-security product. An Intelligence Hub that we own and loan to you sits at the property. It connects to cameras you own, or cameras a third-party installer has supplied under a separate contract with that installer. The Hub ingests those camera feeds and can send output actions to connected devices (for example a spoken warning). All behavioural detection runs in our cloud, not on the Hub. Alerts appear in the app and web console when the cloud system detects activity that may need your attention.

The service is not an alarm receiving centre and we do not dispatch anyone. Alerts go to the account holder. Staff do not routinely watch the property live. We do not send police, guards or keyholders. If there is an emergency, call 999.

Today we do not use facial recognition. We do not uniquely identify who a person is. We do not match faces or people against a database, a watchlist or a "known persons" list. We assess activity at the property and may raise an alert. We do not identify who a person is.

We may later add a household or site identity feature (for example so the service can tell authorised people from strangers, for the customer's security only). That would not be part of the service until we have updated this notice, completed a data-protection impact assessment, and put the extra legal steps in place. This paragraph is not consent.

There is no live white-label monitoring partner. If that ever changes, we will update this notice and say who is responsible for what.

4. Who is responsible for your data

Responsibility is split by what is being done, not by marketing labels.

You (the customer) are the controller of:

• the cameras at the property and how they are pointed;
• the recordings stored on the Intelligence Hub;
• telling people at the property, where the law requires it, that cameras (and, on the Business service, workplace monitoring) are in use.

scOS is the controller of:

• your account, login and support records;
• billing records we hold;
• the detection we run, the alerts we generate, and any short still that still sits with an alert;
• automated voice announcements we cause to be played;
• optional Training Contributions, if you switch them on.

We are independent controllers for those purposes, not your processor, and not (today) a joint controller with another security company.

GoCardless Ltd is an independent controller for Direct Debit collection, not our processor. Their notice is at gocardless.com/privacy.

If you are a visitor, neighbour, courier, nanny, cleaner or employee, two controllers may hold data about you: the person or business that operates the cameras, and scOS for the detection and cloud records described above. Section 11 explains how to exercise rights against each of us.

5. Information we process

Today we do not process biometric data for the purpose of uniquely identifying someone. We do not build a face template or an identity profile. If we add identity features later, this notice will change first.

6. Where footage lives

Event footage stays on the Intelligence Hub at the property. If you have opted for an external hard disk attached to the Hub, 24/7 recording is also stored on that disk at the property. Those recordings are encrypted with a key for that account. Older recordings are overwritten as the disk fills (like a domestic recorder). How many days that represents depends on the disk and how much activity there is. The Hub is compatible with most NVRs. There is no central library of that Hub archive at scOS.

The Hub archive stays on the Hub. We have no staff player for it. We cannot search or retrieve it from our offices.

Detection is different. All behavioural analysis runs in our cloud. The Hub forwards video needed for that analysis. Short frames used for classification are processed and then discarded. Alert records and classifications held in the cloud are not alert video recordings. They are labels, short descriptions, and sometimes a still image. Event video stays on the Hub. It is not stored as a cloud footage library.

We can access, and our staff may see when they need to support the service:

• your account and billing data;
• alert records and classifications (and any short still that still sits with an alert, kept for up to 30 days);
• support tickets and emails you send us.

On the Home Intelligence Service and the Business Intelligence Service we hold camera administrator credentials. We need them so the video streams can be played from the camera securely, and so we can apply privacy masks and operational settings (NTP, streams) when you have asked us to. Those credentials can also open the camera's own live view. That is a residual access path.

scOS staff do not have access to your live view. That path is blocked in the infrastructure, except where you have asked us to apply privacy masking and the cameras are under our management. That access is logged and is permitted only with your explicit consent.

Live view that you start runs directly to the Hub over your local network. It does not stream through AWS. If you are away from the property, AWS is used only to negotiate the connection. AWS does not see the frames. We do not keep that live view as a recording.

If you save a clip to your phone's photo library, that copy is yours. It may sync to Apple iCloud or Google Photos under those companies' terms. We cannot delete those copies.

7. How detection works

The Hub ingests the camera feeds and forwards video to our cloud. Cloud systems assess what appears to be happening, not who someone is. If the activity may need your attention, it raises an alert to you. The Hub can then send output actions to connected devices (for example a spoken warning).

We do not decide that someone is guilty of a crime. A classification is a machine assessment to help the account holder decide what to do. It is not a conviction, a police report or a finding of fact.

8. Classifications about possible unlawful acts

UK data-protection law treats information about suspected or alleged offences as a special kind of personal data (criminal-offence data under Article 10 of the UK GDPR, read with section 11(2) of the Data Protection Act 2018).

When our system generates a classification that someone at the property may be committing, attempting or preparing an unlawful act, that output is criminal-offence data. We process it because it is necessary to prevent or detect unlawful acts, without seeking that person's consent (asking would defeat the purpose). We keep an internal policy document that describes how we handle this category of data.

In plain terms: we may record that the system flagged possible criminal or suspicious behaviour. We do not decide guilt. We do not automatically tell the police. The account holder sees the alert and decides what, if anything, to do.

We do not put those crime or suspicion classifications into our model-training pipeline unless the material has first been irreversibly anonymised so that no one can reasonably be identified.

9. Automated voice announcements

Where speakers are connected, the service may automatically play a spoken warning at the property (LiveGuard / tannoy). You should know:

• The voice is synthetic (generated by a computer). It is not a person on a microphone.
• No one at scOS listens, watches live, or approves the words before they play.
• The words are a general warning that the area is private and that the person should leave.
• The words will not claim we know who someone is, accuse them of a crime, use a name, or threaten harm.
• A voice announcement does not send anyone to the property and does not report anyone to the police. It is a deterrent, nothing more.
• The account holder cannot turn this off in the app today. If the account holder wants voice announcements paused or disabled at their property, they ask us via Contact Us or their scOS Architect. We will do that for the account holder. A request from anyone else does not switch the feature off for the property.

If you, or anyone who was spoken to, thinks an announcement was wrong or unfair:

• complain using /privacy/complaints/ or Contact Us;
• a human will review the classification and the announcement within 14 days;
• if the same kind of disputed announcement is likely to happen again for the same person or situation (for example a resident, a regular carer or a neighbour), we will pause that situation while we review, unless we have a compelling reason not to (for example an active incident). We will tell you what we decided. We do not switch the whole property off because someone complained.

10. Training Contributions (optional)

To improve detection we may use footage only if you opt in, camera by camera.

• Training Contributions are off by default.
• You switch them on per camera in the app or console, and you can switch them off at any time. Switching them off does not affect the rest of the service.
• For you (the account holder), that choice is consent (Art 6(1)(a)).
• For other people who appear in the footage, we cannot obtain consent. We rely on legitimate interests (Art 6(1)(f)) in improving detection so that fewer people are mis-alerted. We do not use this material to identify anyone.
• Crime and suspicion classifications are not used for training unless they have been irreversibly anonymised so that no one can reasonably be identified.

11. Other people in view: visitors, neighbours, staff

Cameras will record people who are not the account holder. We process their images to provide the security service, on legitimate interests: protecting people and property and preventing crime. We do not use those images to identify who they are.

If you think you were recorded:

• Hub recordings and event footage are held by the customer who operates the property. Ask them. We cannot search or play those recordings.
• Alert records and classifications are held by us. They are not a copy of the event video. Contact us via Contact Us with enough detail (address or approximate time and place) for us to look.

Training Contributions. Whether training is enabled, and for which camera, is the customer's setting. We do not tell other people which cameras have it enabled. Ask the customer.

If you want identifiable training material of you erased, contact us with the place, the approximate time, and a description of what you were doing, so we can look. We do not ask for a photograph and we do not run a face match. If we can find identifiable training material, we erase it and we record that the erasure was made. The customer's choice to enable training does not stop that. We do not send your name, address or description to the customer. If you also want Hub recordings deleted, those are held by the property operator. We cannot delete them. If you ask, we can pass the operator a request that does not name you. The operator may still guess who you are from the time and place. If you do not want the operator told, we limit the work to data we hold.

Home customers. You are responsible for how your cameras are aimed. We do not require a physical sign as a condition of the Home service, and we have no right to put a sign on your house. That is separate from your position under the ICO's Home CCTV guidance: if a camera captures someone else's property, a public area or a communal space, you should let people know, and the ICO's starting point is a sign. If you want suggested wording, including that the system may play an automated spoken warning and, today, does not use facial recognition, ask us via Contact Us.

Using the system to watch a nanny, cleaner, carer or tradesperson who provides a service in the home can bring your own use inside data-protection law even if the camera stays within the boundary. Tell them, and point them at this notice and the complaints page.

Business customers. If cameras capture employees, contractors or other workers, you are responsible for workplace-monitoring transparency: telling workers that monitoring is happening, why, and that automated voice announcements may be played, and for any assessment the ICO's employment-monitoring guidance requires. We do not discharge those duties for you. Workers can still complain to us about our processing.

12. Our lawful bases

Consent is not the basis for crime-prevention detection. We could not obtain genuine consent from every person who walks into view, and asking a person whose conduct is being assessed would undermine detection.

Where we process criminal-offence data (the classifications in §8), we also rely on Schedule 1, paragraph 10 of the Data Protection Act 2018 (preventing or detecting unlawful acts), and we keep an internal policy document for that processing.

You can object to legitimate-interests processing, including detection that affects you. Use Contact Us. We will consider it. We may continue if we have compelling grounds, for example protecting the property from crime or an active incident, and we will tell you. An objection does not switch voice announcements off for the whole property.

13. Who we share service data with

We do not sell personal data. These are the organisations a person in frame, or a customer, reasonably needs to know about:

Police and other authorities. An authority does not have a general right to our records on request. We disclose information when the law requires it (for example a warrant or a production order) or when a data-protection exemption applies and disclosure is necessary to prevent or detect crime. We assess each request. We do not volunteer customer information. What we can provide is limited to what we hold: account details, alert records and classifications. We do not hold the event-video archive. That stays on the Hub with the customer. We may be legally restricted from telling the person that a request was made, where telling them would prejudice the prevention or detection of crime.

14. Where service data is processed (international transfers)

We do not claim that all processing happens in the UK or EEA. The accurate position is:

1. Event footage stays on the Hub. 24/7 recording stays on the Hub if you opted for an external hard disk. Video used for detection is sent to our cloud. Short frames are processed and then discarded. Alert records are stored in AWS Ireland.
2. Primary stores are in the UK and EEA: AWS Ireland and AWS London. The UK recognises the EEA as adequate, so that hosting is not a restricted transfer.
3. Named companies outside the UK process limited data. The transfer tool for each of them is not yet confirmed on the account that runs the work:
   • Modal Labs, Inc.: alert-candidate video frames (see the table above).
   • ElevenLabs, Inc.: text-to-speech for voice announcements. No video.
   • Google: written briefing text. No video.

Criminal-offence data is not forbidden from leaving the United Kingdom. It may be transferred if a lawful transfer tool is in place. We do not use the UK-US Data Bridge for crime or suspicion information, or for the frames from which that information is produced. The Data Bridge is an adequacy decision for certified US organisations. It does not itself give criminal-offence data the specific protection UK law requires. For that data we will use the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, once those tools are in place for the account that actually runs the work. Until then we do not claim that those tools are in force.

Apple and Google may handle push tokens on global networks. That is limited technical data for delivery, not video.

15. How long we keep service data

When deletion happens. For alert records and short-lived processing images, each period above is when the data becomes due for deletion. Deletion is then automatic. Amazon Web Services carries it out as a routine background process, which usually finishes within a few days of the end of the period.

Logs. Application logs and the log groups we define are set to expire automatically within the periods in the table (30 days, or 14 days for some groups).

If we must keep an alert or classification longer for a legal claim or a police matter, we will limit what we keep and record why. We cannot keep or delete the property operator's recordings; those stay with our customer.

16. Your rights

You can ask us to:

• give you a copy of the personal data we hold (access);
• correct inaccurate data;
• delete data, where the law allows;
• restrict or object to certain processing;
• move account data you gave us, where portability applies;
• withdraw consent for Training Contributions.

Use Contact Us or /privacy/complaints/. We will respond within one month, or tell you if we are entitled to take longer.

Hub recordings. Event footage and any 24/7 recordings stay on the Hub with the property operator (our customer). We do not have access to them. Requests to keep or delete those recordings must go to the operator. We can search alert records and classifications we hold, if you give us enough to find them.

We may refuse or limit a request where the law allows, for example tax records, or a narrow case where complying would be likely to prejudice the prevention or detection of crime. We do not use that as a blanket refusal.

If you were the subject of an automated voice announcement or an AI classification, you can also use the 14-day human review in §9 and on the complaints page.

17. Children

Account holders must be 18 or over. The service is not directed at children, and we do not offer a children's service.

A camera may show a child. We do not try to work out who is a child, and we do not single children out. Crime and security detection is the purpose, and everyone in view is processed under the same rules. We do not use images for marketing. If we are told that data we hold is about a child and the law requires us to delete or restrict it, we will. A parent or guardian can use Contact Us.

18. How we protect data

We use encryption in transit and at rest, a separate encryption key for each account's Hub recordings, access controls and multi-factor authentication for staff administration, and isolation between customers.

No security is perfect. If you think an account or Hub has been compromised, contact us immediately.

19. Complaints

You can complain to us about how we handle personal data. You do not need to be a customer.

• Online: /privacy/complaints/
• Other electronic and telephone contact: Contact Us
• Post: Smart City Operating System Limited, 4th Floor, Silverstream House, 45 Fitzroy Street, London W1T 6EB

We acknowledge a data-protection complaint within 30 days and respond without undue delay, keeping you informed of progress (Data Protection Act 2018, section 164A). Disputed AI classifications and voice announcements are reviewed by a human within 14 days. If the same kind of disputed announcement is likely to happen again for the same person or situation, we will pause that situation while we review, unless we have a compelling reason not to (for example an active incident). A complaint does not switch voice announcements off for the whole property.

You can complain to the ICO at any time at https://ico.org.uk/make-a-complaint/ or 0303 123 1113. Complaining to us first is not required. Our ICO registration is ZB346678.

20. Changes

We may update this notice. We will change the "Last updated" date. If a change is material, we will tell customers through the service or by email.

21. How to contact us

Smart City Operating System Limited

Registered office (legal identity): 71 Manor Road, Caddington, Luton, LU1 4EE
Correspondence: 4th Floor, Silverstream House, 45 Fitzroy Street, London W1T 6EB
Email, telephone and other contact methods: Contact Us

Related notices: Website Privacy Policy · App Privacy Policy · Complaints