Draft. This text must be reviewed by a qualified Indian lawyer, and the bracketed details filled in, before it is relied on. Set LEGAL_REVIEWED=yes to hide this notice.

Privacy Policy

This policy explains how Airotor Labs [set legal entity name] (“Airotor Labs”, “we”) handles personal data in the Airotor Live service at livestream.airotor.in, including the dashboard, the site box and the helmet cameras. It is written to meet the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, “DPDP law”), the Information Technology Act, 2000 and the rules made under it.

1. Who is responsible for what

• Account and security data (names, work emails, roles, sign-in records): Airotor Labs decides how this is used, so we are the Data Fiduciary.
• Live video of workers and anyone else in view: the client organisation that installs the cameras decides why and where to film, so the client is the Data Fiduciary. Airotor Labs carries the video to the client's authorised users on the client's instructions, as its Data Processor.

If you are a worker who appears on a camera, your employer or the site operator is your first point of contact. We will help them answer your request, and you can also contact our Grievance Officer (section 10).

2. Personal data we handle

• Account data: name, work email, organisation, role, password (stored only as a one-way scrypt hash).
• Security and audit logs: sign-ins and failed sign-ins, IP address, time, and actions such as adding cameras, managing users and opening a camera's live view.
• Live video: images from cameras the client connects. Helmet cameras (ESP32-CAM) have no microphone. Phones or drones a client connects may send audio; the dashboard plays it muted by default.
• Browser storage: one essential session cookie to keep you signed in, plus your grid layout saved in your own browser. We use no advertising or analytics cookies.

We do not record or store video. Video passes through our media server in real time and is discarded. We do not run face recognition, biometric identification or automated profiling on it.

3. Why we use it

• To provide the service under our contract with the client: sign-in, showing each organisation only its own cameras.
• To keep the service secure: detect misuse, lock accounts after repeated failed sign-ins, investigate incidents.
• To meet legal duties, including CERT-In directions on logs and incident reporting.

Clients are responsible for their own lawful basis for filming people: either a legitimate use under section 7 of the DPDP Act (for example, employment-related safety and supervision) or consent. In every case they must give clear notice to the people filmed (see our Acceptable Use Policy).

4. How long we keep it

• Live video: not stored.
• Account data: while the account is active. It is deleted when the user or their organisation is deleted.
• Security and audit logs: one year, then deleted. That covers the 180 days CERT-In requires, plus time to handle disputes.

5. Who we share it with

Only (a) the authorised users of the client organisation that owns the camera, (b) our hosting provider, which processes data for us under contract on servers located in India, and (c) government authorities when Indian law requires it. We do not sell personal data or use it for advertising.

6. How we protect it

• HTTPS (TLS) for the dashboard and video viewing, and encrypted SRT for helmet-camera uploads.
• Each organisation's cameras are isolated. The media server checks with the dashboard before every upload and every view, so one client can never open another client's camera.
• Viewing uses short-lived signed tokens (15 minutes). Disabling a user or an organisation stops new viewing at once.
• Per-camera secret stream keys, stored only as hashes. Passwords stored as scrypt hashes. Accounts lock after 5 failed sign-ins. Role-based access (viewer, admin, super admin).
• An audit log of security-relevant actions, visible to each organisation's admins.

7. Your rights

Under DPDP law you can ask for: a summary of your personal data and how it is processed; correction, completion or updating of it; erasure of data that is no longer needed; grievance redressal; and nomination of another person to exercise your rights if you die or become incapable. Contact your organisation's admin or our Grievance Officer. We may need to confirm your identity first.

8. Personal data breaches

If a breach happens, we will inform the affected people and the Data Protection Board of India as the DPDP Rules require. We will report cyber security incidents to CERT-In within 6 hours of noticing them, and tell affected client organisations without delay.

9. Children

The service is for businesses only. Accounts are not for anyone under 18. Cameras must not be used to film children.

10. Grievance Officer

[set GRIEVANCE_NAME]
Email: [set GRIEVANCE_EMAIL]
[set LEGAL_ADDRESS]

We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India.

11. Changes

We will post changes here with a new version date. Signed-in users are asked to accept material changes before continuing to use the service.

Version 2026-11-05. Airotor Labs [set legal entity name], [set LEGAL_ADDRESS].