Privacy Policy

Draft v1 · Aug 2026. This Policy describes how Evidentum, Inc. (“Evidentum”) processes information for evidentum.ai, the Evidentum web/mobile apps, APIs, and related services. Contact: privacy@evidentum.ai. Address: [to be provided].

If you use Evidentum through your employer or another organization (the “Customer”), that organization typically controls the Account and Customer Content. Camera/investigation requests usually go to your organization first. Business Customers may execute a DPA.

1. Categories of information

• Account: name, email, organization, role, auth data, invites, IP/login metadata
• Billing: plan, invoices, payment status via Stripe (we do not store full card numbers)
• Customer Content / Camera Data: camera metadata, zones, frames/thumbnails/clips, events, incidents, cases, evidence, notes, uploads, exports/packages, integration payloads you configure
• AI context: text timelines, labels, queries, and generated narratives/answers when AI Features are enabled
• Logs & device: usage needed to operate/secure the service, audit logs, cookies (see Cookie Policy), mobile device/session/push data if you use the app
• Support/sales: messages you send us

Evidentum is not a facial-recognition or biometric-identification product and does not determine identity, intent, or guilt.

2. Camera footage & sensitive circumstances

Footage may incidentally show people’s appearance, behavior, location, and workplace or customer activity. Customers choose which cameras to connect and are responsible for lawful monitoring, signage, consent, and audio-recording laws. Unless we expressly enable documented audio features, detection/AI pipelines are designed to process video frames, not audio.

3. How we collect

• Directly from you (signup, billing, support, configuration)
• Automatically (IP, device/browser, logs, cookies)
• From Customer systems (RTSP cameras, integrations, APIs, uploads, SSO)
• From processors (e.g., Stripe events, email delivery)

4. Purposes

Provide and secure the Services; authenticate Users; detect events; generate incidents/cases/evidence tools; AI assists; billing; support; prevent abuse; comply with law. By default we do not use Customer video or case content to train general-purpose AI models.

5. Sharing

We do not sell Customer investigation content. We share with subprocessors that run the service (list), including AI providers that may receive text prompts/metadata (current paths are designed not to send raw video files). We also share when Customer directs an integration/export, with Account admins/Users per roles, with advisors in corporate transactions, or when legally required.

6. Retention & deletion

• Plan entitlements and Customer configuration may set retention windows
• Operational backups, billing, and security logs have separate cycles
• Legal holds (and legal requirements) can pause deletion
• Deletion from primary systems is commercially reasonable—not always instantaneous; backups rotate over time

Individuals who appear only in Customer footage should contact the Customer organization; we assist under the DPA where applicable.

7. Security

Measures include TLS, authentication, RBAC/site scoping, signed media access, audit/custody tooling, rate limits, and production secret controls. No system is 100% secure. We do not claim SOC 2 unless completed and stated on Security. Report issues to security@evidentum.ai.

8. Cookies

See the Cookie Policy. Essential cookies for security/auth; no invasive third-party behavioral tracking on the marketing site today.

9. International transfers

Data may be processed in the U.S. and other countries where we or subprocessors operate. Cross-border transfer tools: counsel to complete (see DPA for Enterprise).

10. Children

Services are for businesses and adult professionals. We do not knowingly collect personal information from children for the Services.

11. California privacy

Depending on applicability, California residents may have rights to know, delete, correct, opt out of sale/sharing, limit certain sensitive uses, and non-discrimination. Email privacy@evidentum.ai. We do not sell personal information as commonly understood. See also Notice at Collection.

12. Changes & contact

We may update this Policy; the effective date will change. Material changes will be noticed as appropriate. privacy@evidentum.ai · legal@evidentum.ai · security@evidentum.ai

Full working draft: docs/legal/02-privacy-policy.md