Privacy Policy
We count silhouettes, not people. No faces. No identities. Video deleted in 30 days — or instantly.
Last updated: July 5, 2026
The one-paragraph version: StreetProof turns street footage into anonymous counts. The pipeline detects moving shapes, follows trajectories and records crossing events — a timestamp, a direction, a broad category. Faces are never needed, never analysed, never extracted. Raw video is deleted within 30 days, or immediately if you ask. For your account we keep the minimum: your email, your studies, your billing history.
1. Who this policy covers, and our two roles
This policy explains how StreetProof (“we”, “us”) handles personal data. We act in two distinct roles:
- As a controller for your account: email address, wallet and billing records, notifications, support conversations, and the technical data described in the Cookie Policy.
- As a processor for the footage you submit: video in which people are recognisable is personal data under the GDPR. When you upload or stream footage, you (our customer) are the data controller and we process it on your documented instructions under the Data Processing Agreement.
2. What StreetProof does with video
StreetProof counts pedestrians crossing a virtual line that you draw on your own footage. Our pipeline normalises the video to reduced resolution, detects moving shapes, follows their trajectories, and records anonymous crossing events: a timestamp, a direction, and a broad category such as adult, child, stroller, wheelchair, bicycle or dog. Audio is stripped on ingest and never processed.
The product is designed around the principle of data minimisation: we count trajectories, not identities. Low-resolution video is sufficient for counting — faces are never needed, never analysed, and never extracted.
3. Our red lines
These are fixed policy, not settings:
- No facial recognition — we never identify, match or search for individuals.
- No biometric categorisation by sensitive attributes such as ethnicity, health or beliefs.
- No emotion recognition of any kind.
Optional age-band estimates (for example an “elderly share” signal) are a beta feature that is switched off by default and will not leave beta before an explicit legal review.
4. What we collect as a controller, and why
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address, optional name, locale | Account sign-in (one-time email codes), notifications about your studies | Contract (Art. 6(1)(b)) |
| Wallet balance, orders, invoices | Billing, tax compliance | Contract; legal obligation (Art. 6(1)(c)) |
| Study metadata (titles, scene setup, timestamps, status) | Running your studies and showing your dashboard | Contract |
| Consent cookie and, only after opt-in, analytics/marketing data | Remembering your cookie choice; understanding product usage; campaign attribution | Consent (Art. 6(1)(a)) for non-essential categories |
| Technical logs (request metadata, error traces) | Security, abuse prevention, debugging | Legitimate interests (Art. 6(1)(f)) |
5. What we store, and for how long
| Data | Retention |
|---|---|
| Raw video | Deleted within 30 days at the latest — or immediately, at your request. Deleting a study removes its footage. |
| Counting results | Anonymous aggregates (counts per 5-minute interval, direction, category) and anonymous trajectories — these contain no personal data and power your reports and our benchmarks. |
| Proof overlay | A short verification clip rendered on low-resolution footage, retained with your report so results stay auditable. |
| Account and billing data | For as long as you have an account, then as required by tax and accounting law. |
6. GDPR (European Union)
- For footage, you are the controller and we are your processor; the DPA applies automatically and forms part of our Terms.
- Where national law requires it, you must inform passers-by about video capture (for example a visible “video surveillance area” notice). We provide a notice template you can use.
- We process footage at reduced resolution and keep raw video only as long as needed to produce your report.
- You can delete any study — and its footage — at any time from the dashboard.
7. EU AI Act
Anonymous people counting is neither a prohibited practice nor biometric identification under the EU AI Act. Our red lines above — no facial recognition, no biometric categorisation by sensitive attributes, no emotion recognition — keep StreetProof clearly outside the Act’s prohibited-practice categories, and we commit to them contractually.
8. United States
State biometric laws such as the Illinois Biometric Information Privacy Act (BIPA) govern biometric identifiers — which we do not extract: no face geometry, no gait signatures, no identifiers of any kind. Regardless, our Acceptable Use Policy explicitly prohibits using StreetProof to identify natural persons. Filming public streets is generally lawful in the United States; responsibility for the lawfulness of the video source rests with the customer, as set out in the Terms. We do not sell or share personal information as those terms are defined in US state privacy laws (including the CCPA/CPRA).
9. Sharing and sub-processors
We do not sell personal data. We share data only with the service providers needed to run StreetProof — cloud hosting and compute, transactional email delivery, and payment processing (our payment provider receives your payment details directly; we never see full card numbers). Sub-processors handling footage are listed in the DPA. We may disclose data where legally compelled, and will challenge overbroad requests.
10. International transfers
Footage and results are hosted in the European Economic Area by default. Where any provider processes personal data outside the EEA, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses.
11. Your rights
Under the GDPR (and similar laws elsewhere) you can:
- access the personal data we hold about you;
- correct it, or have it deleted (“right to erasure”);
- receive your data in a portable format;
- object to, or restrict, certain processing;
- withdraw consent at any time (for cookies, via Cookie settings) without affecting prior processing; and
- complain to a supervisory authority — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados).
For footage submitted by one of our customers, direct your request to that customer (the controller); we assist them in fulfilling it under the DPA.
12. Cookies
Our use of cookies and similar storage — including the consent mechanism and the full inventory — is described in the Cookie Policy. Nothing non-essential loads before you opt in.
13. Children
StreetProof is a business tool and not directed at children. We do not knowingly collect personal data from anyone under 16. Counting categories such as “child” are anonymous silhouette classifications, not data about identifiable children.
14. Changes to this policy
We will announce material changes in the app or by email before they take effect. The “last updated” date above always reflects the current version.
15. Questions and requests
For privacy questions, deletion requests or a copy of the DPA, contact us at privacy@streetproof.app. See also our Terms of Service.