Privacy Policy

Last updated: 8th November 2026 · StomatoBot Technologies Private Limited (“StomatoBot”, “we”, “us”)

This policy explains how we collect, use, store, and protect information when you use Digital WatchMan (our CCTV video-analytics service) and the stomatobot.com website. It is written to align with India’s
Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the “DPDP law”).

 

1. Roles under the DPDP law

1. StomatoBot is the Data Fiduciary for account, billing, support and website data — the data we collect because you are our customer, or because you asked us to contact you. You are the Data Fiduciary for the video your cameras capture and for every person who appears in it. You chose the cameras, their placement, and the purpose of recording.
2. StomatoBot is your Data Processor for that video and everything derived from it — detections, alerts, evidence snapshots, clips and face templates. We process it under these terms and your instructions, to provide Digital WatchMan to you. We do not decide what your cameras record.
3. The one exception: improving Digital WatchMan. Under item 12 of our Customer Onboarding Terms, which you accept as a condition of the service, we use your verdicts on alerts and the photos and detections attached to alerts to train and test our detection. For that use we decide why the data is used, so for it we act as a Data Fiduciary ourselves.

Practically, this means obligations toward the people your cameras record — notice, signage, lawful basis, and answering their requests — rest with you. We will assist you in meeting them, and section 9 explains how.

2. Information we collect

1. Account data: your name, mobile number and email address (both used for OTP sign-in), and organisation details you provide. If you give staff their own logins, the mobile number and the name you enter for each staff member, and the cameras you let them see.
2. Camera settings: each camera’s stream address, which can include your camera or DVR login (section 10 says how it is protected), your shop hours, and the lines and zones you draw.
3. Camera and video data: video streams from cameras you connect are processed by our detection engine to generate alerts. We store a still photograph at the moment of an alert and, for some alerts, a short clip. If you subscribe to daily summaries, we keep the camera’s video on our servers to build a short summary video of each day.
4. What you add: names, tags, notes and follow-up dates you give to faces, your verdicts on alerts (real, false, dismissed), and your answers to questions the app asks you.
5. Service telemetry: camera health metrics (frame rate, brightness, motion levels, connectivity and counts of people seen) used to learn each camera’s normal behaviour and detect anomalies; and standard website/app usage logs.
6. Security logs: a record of each change made through your account (what was changed, when, its result, the IP address and the app or browser it came from), and our servers’ own logs.
7. App and device data: a notification token so we can send alerts to your phone, and, in the mobile app, crash reports (the error message and where it happened in our code, the device model and an app-install identifier; no alert, face, camera or account data is attached).
8. Payment data: processed by our payment partner (Razorpay). We do not store your card or banking credentials.
9. Enquiries if you ask us to call you through a form on stomatobot.com, the name, mobile number, email, shop name and city, number of cameras and any note you type. A bot-check service on the form checks that a person, not a program, is sending it.

3. Face data — what it is, and how we treat it

Face recognition is optional and off unless you enable it. While it is off, no face templates are created and no face images are stored — for anyone, known or unknown. Because face data is the most sensitive category Digital WatchMan touches, we set it out separately.

1. What we store. When face recognition is on, the system detects faces in your footage and computes a face template — a numeric vector, commonly called an “embedding”, derived from the image of a face. We store the template, a small cropped image of the face, and any name, category, tag or note you assign to it. For an adult it also records when that face was seen, on which camera and for how long, so you can see who came and when.
2. What a template is not. A template is a mathematical representation used for comparison. It cannot be converted back into a photograph of the person. It is nonetheless personal data derived from a person’s face, and we treat it as the most sensitive data in the system.
3. An identity grows over time. When a known person is seen at a new angle, a further template may be added to that person’s identity so recognition improves. This means one named person may be represented by several templates.
4. Strict isolation. Face data is stored separately for each customer. We do not share it between customers. We never sell, rent or share it. The single exception is a binding legal order, set out in section 8a.
5. Children’s faces are blurred. Where the system judges a face to belong to a child, that face is blurred in the stored image and no face template or face picture is kept for it. A face the system estimates to be under 18 is treated as a child — 18 being the age the DPDP law itself uses. Age judged from a camera image is approximate, so a face close to that line may be judged either way. The DPDP law requires verifiable parental consent to process a child’s personal data, and that cannot be obtained from a child walking into a shop; so we do not build an identity for a child on our own.
6. In your People gallery you can mark a person as under 18. For that person we do keep face templates and pictures — more than for an adult — because recognising them is how we know to blur them; their name and pictures are visible only inside your owner account. On cameras with face recognition, we blur a marked minor whenever we recognise them, whatever the age model says. On a camera without face recognition nobody is recognised, so there only the age model’s judgement can blur them. Mark a person under 18 only where you are able to give consent for them as a parent or guardian, or where you are marking them so that they are protected.
7. This runs on every camera, whether or not you subscribe to face recognition. Finding a face in order to blur it is a different thing from recognising whose face it is: the first protects a child and happens for everyone, the second is the paid feature and happens only if you have bought it. On a camera without face recognition no face is ever identified, named or stored as a template — the system looks for faces solely so that a child’s can be blurred before the picture is saved.
8. Blurring is applied to the alert photos and daily summary videos we store. Live view shows your camera’s picture as the camera sends it, without blurring.
9. What this cannot promise. Redaction depends on the child’s face being found in the picture at all. A face turned away from the camera, too small, too dark, or hidden behind something is not detected, and what is not detected cannot be blurred — such a picture may show a child. We blur the faces we judge to be children’s; a face whose age we cannot judge is left as it is, so that a picture of an adult is not destroyed on a possibility. If, for a moment, the system could not check a picture at all, that picture is stored as it is and we are alerted to fix the cause. We blur what we find, and we do not claim more than that. Lighting matters to this judgement. Daylight gives the clearest picture of a face. Under artificial light, and after dark when the cameras switch to infrared and the picture loses its colour, there is less for the system to go on, and its reading of a person’s age is correspondingly less certain — so a child’s face may sometimes be left unblurred. We measure this on our own cameras rather than assume it, and we are continuing to improve it. If you find a stored image showing a child’s face, tell us at support@stomatobot.com and we will replace it with a blurred copy..
10. Who can see face data. At your premises it is available to you as the account holder and to the staff you authorise on your account, for the cameras you let each of them see. On our side, StomatoBot staff may access it only to operate or support the service, for example to help investigate a fault you have reported to us, and to improve our detection as section 4 describes.
11. You control naming. Names attached to faces are yours. We do not supply identities, and Digital WatchMan does not attempt to identify anyone against any external database, watchlist or public source. The single exception is a binding legal order, set out in section 8a.

4. How we use it

1. To operate the service: detect events, deliver alerts, show live view and history to authorised users of your account.
2. To secure the service: authentication, fraud prevention, abuse detection, and the security logs that Indian law requires us to keep.
3. To answer an enquiry: we use the details you send through a website form only to call or write to you about it and to set up your account if you go ahead. We do not use them for anything else, and we do not add you to any marketing list.
4. To improve reliability: aggregate, diagnostics and crash reports that do not include footage.
5. As agreed in item 12 of our Customer Onboarding Terms, we use your verdicts on alerts, and the photos, clips and detections attached to alerts, to train and test the models that run Digital WatchMan. Footage of minors is out of scope. We may sell or license the models we build; we never sell, rent or share your footage, alert photos, face images, face templates, or any dataset made of them unless compelled by law to do so.We do not use any outside artificial-intelligence service on your footage: all detections and face recognition run on our own servers.

5. Where your data is stored

We tell you this precisely, because “the cloud” is not an answer:

1. Account data, camera settings, alerts and detection records and face data — stored in our database in the Mumbai, India region.
2. Processing (detection engine, live view and servers) — runs on servers located in Mumbai, India. The camera video we keep to build daily summaries stays on these servers.
3. Evidence media — snapshots, clips, summary videos and face pictures — stored with established third-party object-storage providers. These providers operate facilities in several countries, and we place media where capacity, cost and reliability allow, which may be within or outside India. Your account records, camera settings, face data, detections and alert history are kept in India (Mumbai); encrypted backup copies of them, and of the evidence media, are kept by a separate provider outside India.

Where any personal data is stored or processed outside India, we do so only as permitted by the DPDP law, which allows transfer except to territories the Central Government restricts. If a restriction is notified that affects us, we will relocate the affected data and update this policy.

6. Retention and deletion

1. Alerts and their photos and clips: available in your app for at least 90 days on every camera, and for longer on a camera where you buy extra history. We do not delete alerts or their photos on a timer: we keep them to train and test our detections, as section 4 describes. When you remove an alert from your list, it leaves your app and is kept by us for that purpose.
2. Video kept for daily summaries: kept on our servers for about 90 days, then deleted. The summary videos themselves are kept while your account is open. Camera activity counts or health telemetry (no images, no faces): kept while your account is open, and for at least 400 days, so each festival can be compared with the same festival last year.
3. Unnamed face templates: kept until you discard them. You can discard an unnamed face at any time in Faces, and its templates and pictures are deleted.
4. Named face templates: retained while the identity is in use in your account, because recognition of a named person is the purpose you enabled the feature for — and retained through a paused subscription, so resuming does not mean re-teaching the system everyone it already knows. A named identity is kept for as long as your account is open. You can curate one at any time — remove individual photos from it, move a photo to the right person, or merge duplicates — and you can delete an unnamed face outright. To have a named identity itself erased, ask our Grievance Officer (section 11) and we will do it.
5. Account data: for the life of the account, and afterwards only where a law requires us to keep it.
6. Enquiries: kept while we are in touch with you about them, and deleted within 12 months if you do not become a customer; if you do, they become part of your account data.

A paused subscription is not a closed account. If your subscription lapses, the service pauses — but nothing is deleted at that moment. While an account is paused your alerts, their photos and clips and your daily summaries stay with us but are not available in your app while the subscription is paused. Nothing is deleted on a timer: they are kept for as long as your account is open, and for at least 400 days. Resume, and they are back in your app. The video kept to build daily summaries is deleted after about 90 days (item 2), and we do not delete alerts or their photos on a timer (item 1). Your face identities and the names you gave them are kept indefinitely, so that recognition still works the day you resume. Resuming a paused account restores the service; you do not start again from nothing.

On official closure of your account — which you request, and which is distinct from a pause — we erase your recorded video (the camera video we keep to build daily summaries) and your unnamed face data. When you close your account, your alerts, their photos and clips, your daily summaries and the people you have named are kept for 400 days for legal, audit and security reasons. After those 400 days we keep the pictures only with every face blurred and the link to your shop removed. Erasure is done by hand, not by an automatic sweep due to the sensitivity of the nature of this data: we begin the procedure within a week of your request and work through it according to how much data is involved. We may retain billing records where tax or company law requires.

Where a law requires us to erase personal data that we would otherwise keep — for example on a valid request under the DPDP law, or on a court order — we erase it, by hand, and tell the person who asked when it is done.

7. Sharing and our sub-processors

We do not sell or rent personal data. We share it only with the service providers needed to run Digital WatchMan, each bound to use it solely to provide their service to us: our cloud database and hosting providers, our object-storage and backup-storage providers, our website host and the bot-check service on our website forms, our SMS and email providers (sign-in codes and account emails), our push-notification and crash-report service (browser and device notification services, and crash reports from the mobile app), and our payment gateway (Razorpay). We also disclose data where required by law or valid legal process (section 8a).

8. Your rights as an account holder

Under the DPDP law you may ask us to give you access to your personal data, correct or complete it, erase it, and you may withdraw consent (which may end the service). You may also nominate another person to exercise your rights if you die or become incapacitated. Write to our Grievance Officer (section 11). We respond within the timelines the law prescribes.

8a. Law enforcement, courts and government requests

We disclose personal data to the police, a court or a government authority only where a law or a valid legal process requires it. We ask for the request in writing, satisfy ourselves that it is properly authorised, and disclose the minimum necessary to answer it rather than a whole account. Where we are permitted to tell the customer that their data has been requested, we do.

Comparison across accounts. Face data is held separately for each customer and is not searched across customers in the ordinary course. Where we are lawfully directed to do so by a court, a judicial order or a competent authority acting under statutory powers — typically in connection with the prevention, detection, investigation or prosecution of an offence — we may carry out a comparison across accounts to the extent, and only to the extent, that the direction requires. We do this only under such a direction, never on request alone.

We keep a record of every such direction we act on.

9. If you were recorded by a customer’s camera

Notice at the premises. Our customers agree, as a condition of using Digital WatchMan, to display a clear notice at the entrances to their premises stating that the area is under camera monitoring and, where they have switched it on, that face recognition is in use. That notice is how you are told, and putting it up is the customer’s responsibility as the Data Fiduciary for their own cameras — not ours. We supply the wording; we cannot put up their signs.

If you believe you appear in footage captured by a Digital WatchMan customer and you want access, correction or erasure, the request goes to that customer — they are the Data Fiduciary for their cameras, not us. If you do not know who operates the camera, or you cannot reach them, write to our Grievance Officer (section 11): we will identify the customer where we can, pass your request on, and act on their instruction to correct or erase. A request about our own use of alert photos to improve our detection (section 4) we answer ourselves, and we erase where the law requires it (section 6). We will not disclose one customer’s footage to another person on our own initiative, because doing so would itself be a breach of their data.

10. Security and breach handling

We protect data with row-level access controls so each customer can reach only their own data, encrypted transport, least-privilege service keys, and audit logging. Your camera or DVR login is stored only on our servers and in our encrypted backups, because our servers need it to connect to your cameras. It is never sent back to any phone or shown in the app, and our database is encrypted at rest. We recommend giving Digital WatchMan a separate, view-only DVR user rather than your admin login.

If a personal data breach occurs, we will notify affected customers without undue delay with what we know, what is affected, and what we are doing, and we will make the intimations the DPDP law requires to the Data Protection Board. Where we act as your Processor, we will notify you promptly so that you can meet your own obligations as Data Fiduciary.

Our servers’ clocks are set from the National Physical Laboratory’s time servers, India’s official time. We keep our servers’ security logs for at least 180 days on servers in India. If a cyber-security incident occurs, we report it to CERT-In within 6 hours of noticing it.

11. Grievance Officer

For any question, request or complaint about personal data:
Grievance Officer: Rajashri ·
ask(at)stomatobot(dot)com
StomatoBot Technologies Private Limited, 12-A, 3rd Floor, RM Corner,
VS1 Building, Near Maharaja Complex, Paud Road, Kothrud, Pune 411038, Maharashtra.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

12. Consent and withdrawal

Where we rely on your consent, you may withdraw it at any time, as easily as you gave it. Withdrawal does not affect processing already carried out, and may mean we can no longer provide part or all of the service.

13. Website cookies and embedded content

The stomatobot.com website and the Digital WatchMan app use only essential cookies — session/login state and security — and set no advertising or cross-site tracking cookies. Pages may occasionally embed content from other websites (for example, a product video); such embeds behave as if you visited that website directly and may set their own cookies under that provider’s privacy policy.

14. Children

The service is intended for account holders aged 18 or over. We do not knowingly collect children’s personal data as account holders, and we do not create face identities for children on our own initiative.

Children who are recorded by a customer’s cameras are covered by the redaction rule in section 3: a face judged to be a child’s is blurred in stored images and no face template is kept for it, on every camera. A person the customer marks as under 18 is the one case where templates are kept, so that they can be recognised and blurred (section 3, item 6). Section 3 also states plainly what that protection cannot reach — a face the system does not detect cannot be blurred.

We do not track children. Section 9(3) of the Digital Personal Data Protection Act, 2023 states that a Data Fiduciary “shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children”. Unlike the consent requirement in section 9(1), this one has no exception that a parent can waive — it is a prohibition, not a permission we could ask for. So for anyone judged to be a child, or marked by you as under 18, Digital WatchMan does not record how long they stayed, does not follow them between cameras, and does not build any visit history or profile. We show you that they arrived, and that arrival alert is kept like any other alert. We do not keep a record of their day.

Currently, Digital WatchMan never shows advertising of any kind, to anyone.

15. Changes

We will post updates here and, for material changes, notify account holders.

16. Contact

StomatoBot Technologies Private Limited ·
U72300PN2015PTC156223 ·
12-A, 3rd Floor, RM Corner, VS1 Building, Near Maharaja Complex, Paud Road, Kothrud, Pune – 411038, Maharashtra, India ·
support(at)stomatobot(dot)com