Privacy Statement

OneKByte Labs Private Limited (“OneKByte Labs”, “we”, “us”) designs edge AI video analytics that run on an organisation’s existing CCTV infrastructure. This statement applies to our website, our sales and support interactions, and the software and devices we supply to customers.

It does not govern how any individual customer operates their own camera network. A site operator decides where cameras point, what is recorded, how long footage is kept and who may view it. Those decisions belong to them, and their own privacy notice governs them.

We process personal data in accordance with India’s Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under it, and — where our processing falls within its territorial scope — the EU and UK General Data Protection Regulation.

Almost every question about surveillance privacy depends on which of two roles we are occupying. The distinction matters, so we state it plainly.

When you contact us. Our contact form collects your name, email address, organisation, the reason for your enquiry and your message. We use this to respond and, where relevant, to evaluate a deployment. Submissions are stored in a managed database hosted in India and are readable only by authorised personnel.

When you browse. Our hosting and analytics providers process standard request data — IP address, user agent, referring page and page viewed — to serve the site, keep it secure and understand aggregate traffic. We do not build advertising profiles from it.

When you become a customer. We hold business contact details, contractual and billing records, deployment configuration, support correspondence and device telemetry such as uptime, model version and error logs.

Within a deployment. Our software processes live video from cameras the customer already operates, and generates detection metadata — for example an event type, a timestamp, a camera identifier and a bounding box. We process this as a processor, on the customer’s behalf.

Video of an identifiable person is personal data. Where a deployment is configured to use facial recognition or similar techniques, the resulting templates may constitute biometric information, which is treated as sensitive personal data under Indian law and as a special category of data under the GDPR. We handle it accordingly.

Where a customer enables recognition features, they remain responsible for establishing a lawful basis, displaying the notices and signage their jurisdiction requires, and completing any impact assessment. Our contracts require it. We will withdraw support from a deployment we believe is being operated unlawfully.

Our systems are built to run inference on the device at the customer’s site rather than by streaming footage to a central cloud. This is an engineering decision with a direct privacy consequence: by default, video frames do not leave the customer’s premises and do not reach our infrastructure.

What typically leaves the device is metadata about an event, not the footage itself, and it goes to the customer’s own system. Where a customer asks us to assist with a specific fault, any access to footage is time-boxed, granted by the customer, logged, and limited to what the investigation requires.

• To respond to enquiries and provide quotations, demonstrations and evaluations.
• To deliver, configure, support and maintain the systems we supply.
• To monitor device health, diagnose faults and improve reliability.
• To secure our services — detecting abuse, intrusion and fraud.
• To meet legal, accounting, tax and regulatory obligations.
• To send operational notices, and service updates you have asked to receive.

We do not make decisions producing legal or similarly significant effects about you through automated processing of your personal data in our own capacity as a controller.

Under the DPDP Act we process personal data on the basis of your consent or, where permitted, a legitimate use recognised by the Act. Where the GDPR applies, we rely on:

• Performance of a contract — to deliver and support the services a customer has purchased.
• Legitimate interests — to run and secure our business, respond to enquiries and improve our products, balanced against your rights.
• Consent — for optional communications, which you may withdraw at any time.
• Legal obligation — where retention or disclosure is required by law.

We keep this deliberately minimal. This site uses privacy-preserving, cookieless analytics to count page views and measure aggregate traffic. We do not use third-party advertising cookies, and we do not track you across other websites.

Strictly necessary storage may be used to operate core site functions. Where your jurisdiction requires consent for any non-essential cookie, we will ask before setting it.

We share personal data only where it is necessary, and only with parties bound to protect it:

Sub-processors are engaged under written terms imposing confidentiality and security obligations at least as protective as those we accept ourselves. A current list of sub-processors used in customer deployments is available to customers on request.

We think a surveillance company should be explicit about this rather than bury it.

We are based in India and prefer to keep data there. Our website enquiry records are stored in an Indian region. Some business tooling may process limited data outside India.

Where personal data is transferred across borders, we rely on transfer mechanisms recognised by the applicable law — including standard contractual clauses where the GDPR applies — and we assess the destination’s protections before transferring.

When a retention period ends we delete the data or irreversibly anonymise it. Where deletion from backups is not immediately possible, the data remains isolated and protected until the backup cycle expires.

• Encryption of personal data in transit and at rest.
• Role-based access control and least-privilege access, reviewed periodically.
• Row-level authorisation on our application databases, so records are not readable by default.
• Segregation between customer deployments, with no shared identity data.
• Logging and monitoring of administrative access.
• Secure development practices, dependency patching and vulnerability review.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India, other competent authorities and affected individuals within the timelines the applicable law requires.

Subject to the law that applies to you, you may:

• Access the personal data we hold about you and ask how it is processed.
• Have inaccurate or incomplete data corrected or updated.
• Request erasure of data we no longer have a lawful reason to keep.
• Withdraw consent at any time, without affecting processing already carried out.
• Nominate another individual to exercise your rights in the event of death or incapacity, as provided by the DPDP Act.
• Object to or restrict certain processing, and request portability, where the GDPR applies.
• Complain to the Data Protection Board of India or your local supervisory authority.

Write to privacy@onekbytelabs.com. We will verify your identity before acting, and respond within the statutory period. If your request concerns footage from a deployment we operate only as a processor, we will forward it to the controlling organisation and tell you that we have done so.

Our website and commercial services are directed at organisations, not children, and we do not knowingly collect personal data from children through them. Where a customer deploys our technology in a setting involving children — a school, for instance — that customer is responsible for obtaining verifiable parental consent where the DPDP Act requires it, and for the additional safeguards the law imposes. If you believe we hold a child’s personal data without an appropriate basis, contact us and we will delete it.

We update this statement as our products, our vendors and the law change. The “last updated” date above always reflects the current version. Where a change materially affects how we handle your personal data, we will give prominent notice and, where the law requires it, seek fresh consent.

For any question about this statement, or to exercise your rights, contact our Grievance Officer:

We acknowledge grievances promptly and aim to resolve them within the period prescribed by the DPDP Act. If you are not satisfied with our response, you may escalate to the Data Protection Board of India or, where the GDPR applies, to your local supervisory authority.

For anything that is not a privacy matter, please use our contact page.