Privacy policy

Last updated: October 2026

Protecting your information is a priority for Offsight Inc. (“Offsight,” “we”). This policy explains what we collect, why, who we share it with, how long we keep it, how we use customer data, including camera images, to train and improve our AI models, and what you can ask us to do about it. It applies to the Offsight AI website and to the Offsight AI services — the console, the iOS and Android apps and the Offsight APIs, including Vision AI.

1. Offsight’s roles

Read this first, because everything else depends on it. Offsight acts in three different roles.

• When you visit our website or contact us, Offsight is the controller (in California’s terms, the “business”). We decide what to collect from a demo request or a support message and what to do with it. This policy is the full description.
• When a customer runs their factory on Offsight AI, Offsight is a processor (in California’s terms, a “service provider”). The customer decides what goes into their tenant — production records, photos, camera images, drawings, timesheets, inspections — what Vision AI is configured to detect, track, count, locate or monitor, and which optional features to turn on, and we process it on their documented instructions under our Data Processing Addendum. If you are an employee, contractor or visitor of an Offsight customer and you want to see, correct or delete records held about you in that customer’s tenant — including images from that customer’s cameras — contact that customer. We will help them respond. We do not act on an individual’s request about a customer’s data without that customer, except where the law requires us to.
• When Offsight improves its AI models, it uses Customer Data — including Visual Data that shows people, their faces and their activity — to train and improve its AI models, including the Base Models it uses to provide the Service to all of its customers. This is Model Improvement, described in section 5 and in the Terms of Service section entitled “Model Improvement.” Offsight performs Model Improvement for its own business purposes. To the extent applicable law permits a processor or service provider to use Personal Data to build or improve its services, Offsight performs Model Improvement in that role. To the extent applicable law treats Model Improvement as outside that role, Offsight performs it as an independent controller (or “business” or “third party”), and the customer authorizes and instructs Offsight to receive and use Customer Data for it. In either case, Offsight complies with the obligations that applicable law places directly on it.

2. Terms used in this policy

Capitalized terms in this policy have the meanings given in the Terms of Service, and every Offsight legal page uses them with the same meaning. The ones that matter most to the people whose images a customer’s cameras may capture are repeated here, with “the customer” in place of the Terms’ “you.”

• “Vision AI” is the part of the Service that analyzes still images from cameras the customer installs at its Sites. The customer’s cameras upload still images, not video and without audio, to Offsight over an encrypted connection, at the interval the customer sets on each camera. Vision AI runs detection models on those images to detect, recognize, locate, track, count and report on the state, presence, identity, location and activity of what the customer configures it to monitor, and records the results in the customer’s tenant. That covers the machines, tools, equipment, materials, work areas and operations the customer chooses, and people whenever the customer configures it to detect, track, count, locate or monitor them. Examples include machine states, for example on or off; Work-Area Activity Detection; Tools & Equipment Tracking; and Individual Monitoring. Other object categories and features may be made available over time, as described in the Documentation.
• “Work-Area Activity Detection” means Vision AI’s detection of whether a work area, station or machine is active, idle or occupied, reported for the area as a whole. Where the customer configures it to, it also detects whether people are present or working in the area. Work-Area Activity Detection does not itself identify any person or follow a person as the same individual across images, cameras or time. Configuring it to detect whether people are present or working is Individual Monitoring.
• “Tools & Equipment Tracking” means Vision AI’s recognition of the tools and items of equipment the customer registers, and of where they are seen across its work areas. It uses an appearance-based re-identification model that is applied to images of the detected object, not to people. Tools & Equipment Tracking does not identify people. If the customer links a tool or item of equipment to a named individual, for example by assigning or checking it out to a worker, its location history may become Personal Data about that individual, and using it to follow that individual is Individual Monitoring.
• “Individual Monitoring,” also called “People Tracking,” means any of the following, whether or not any individual is named, and by whatever means, including face, body, gait, clothing, appearance, badge, tag or assignment:
  • (a) configuring or using Vision AI, a Customer Model or any other feature of the Service to detect, track, count, locate or monitor people, including detecting whether people are present or working in an area;
  • (b) any feature or use of the Service that recognizes a person as the same individual across images, cameras, areas or time; identifies or re-identifies an individual; or attributes presence, location, movement, activity, behavior, attendance or performance to a specific individual;
  • (c) any use of Visual Data or Output, alone or combined with other information such as schedules, work assignments, or badge or timekeeping records, to evaluate a specific individual or to attribute activity to one.
  Individual Monitoring is available whenever the customer configures or uses the Service in any of these ways. It does not need to be enabled, approved or attested to, and Offsight does not review or approve it. The customer accepts responsibility for it, as the section of the Terms of Service entitled “Individual Monitoring” and section 12 of this policy describe, by using it and by accepting the Terms of Service or an Order Form.
• “Facial Recognition” means any process that analyzes a person’s face or facial features to identify, verify, recognize or match an individual, or to create a faceprint or face template. It includes one-to-one and one-to-many matching. Detecting that a person or face is present in an image, or where it is, without identifying, verifying or matching the individual and without creating a faceprint or face template, is not Facial Recognition. Offsight’s Vision AI does not currently offer Facial Recognition.
• “Biometric Data” means:
  • (a) any biometric identifier, biometric information or biometric data as defined by any law that applies to the customer, to a Site or to a Monitored Individual; and
  • (b) any faceprint, face template, or other template, embedding or representation derived from a person’s face, hand, iris, retina, fingerprint, voice, gait or other physical or behavioral characteristic, that is used to identify or re-identify a specific individual.
  A photograph or other Visual Data is not in itself Biometric Data, unless a law that applies treats it as such.
• “Personal Data” means information that identifies, relates to, describes, or is reasonably capable of being associated with or linked to an identified or identifiable individual or household, and any information that applicable law defines as “personal data,” “personal information” or an equivalent term. Visual Data that shows an identifiable individual is Personal Data. So is the location history of a tool or item of equipment that the customer has linked to a named individual.
• “Customer Models” means the detection models Offsight trains for a customer, at its direction. Each Customer Model starts from a Base Model and is further trained on that customer’s Visual Data. A Customer Model is deployed only to process that customer’s Visual Data and is not deployed for any other customer. Customer Models, including their weights and parameters, are Offsight’s property, are not Customer Data, and may be used in Model Improvement. Offsight’s use of Customer Data to train and improve its models generally, including Base Models, is Model Improvement, described in section 5 and in the section of the Terms of Service entitled “Model Improvement.”
• “Base Models” means the general detection and recognition models that Offsight develops and from which Customer Models start. Offsight builds Base Models from open-source models, from datasets it is licensed to use and, under Model Improvement, from Customer Data, including Visual Data that shows people. Base Models are Offsight’s property and are used to provide the Service to Offsight’s customers generally.
• “Aggregated Anonymous Data” means data submitted to, collected by or generated by Offsight in connection with a customer’s use of the Service, but only in aggregate, anonymized form that cannot be linked to that customer or to any individual or household and that is not Personal Data under applicable law.
• “Model Improvement” means Offsight’s use of Customer Data to train, retrain, fine-tune, test, evaluate, validate, improve and develop Offsight’s AI models, including Base Models and other models Offsight uses to provide the Service to its other customers. The Customer Data used includes Visual Data that shows people, their faces and their activity, Vision AI Results, Individual Monitoring Data, and the markups, labels and notes attached to them. Training a Customer Model for a customer is not Model Improvement.
• “Training Copies” means copies of Customer Data, including Visual Data and the markups, labels and notes attached to it, that Offsight selects and stores for Model Improvement. Training Copies are not subject to the retention periods that apply to Customer Data in the customer’s tenant. Offsight keeps them for as long as it uses them for Model Improvement, including after the customer’s agreement ends, and protects them as the Model Improvement Safeguards describe.

Other capitalized terms — including “Service,” “Documentation,” “Customer Data,” “Visual Data,” “Vision AI Results,” “Output,” “Individual Monitoring Data,” “Image Review,” “Second-Opinion Review,” “Sub-processor,” “Site,” “Monitored Individual,” “Monitoring Laws,” “Required Authorizations,” “Biometric Release Requirements,” “Model Improvement Safeguards,” “Model Improvement Effective Date,” “Consequential Employment Decision,” “Offsight Indemnitees,” “Covered Claims,” “Losses,” “Suspension Events,” “Authorized Administrator” and “Material Change” — have the meanings given in the Terms of Service. Section 3 describes what Visual Data includes, section 4 describes Image Review and Second-Opinion Review, and section 5 sets out the Model Improvement Safeguards.

3. Information we collect

Information you give us

• First and last name
• Email address
• Phone number
• Employer, job title and role
• What you write in a demo request, sales enquiry or support message
• Account details when a tenant is created for you: username, password (stored only in hashed form), role and permission assignments, and two-factor enrolment details
• Billing contact details. Card details are collected and stored by our payment processor, not by Offsight

Information you put into the platform

This is Customer Data, and it belongs to the customer. It typically includes production and quality records, checklists and sign-offs, photographs taken on the floor, drawings, models and sheets, materials, inventory and purchase-order records, labor records and timesheets, delivery and shipping records, and messages exchanged with the Offsight AI assistant.

Information collected through Vision AI

Vision AI, defined in section 2, handles Visual Data together with the details and results that go with it. Like everything else in a tenant, all of it is Customer Data:

• Camera frames — still images, not video and without audio, uploaded by the customer’s cameras at the interval the customer sets on each camera, together with reduced-size copies made to display them
• Detection overlays — annotated images Vision AI generates to show the evidence for a detection
• Training captures — frames the customer selects to train a model, and any photos or video previously uploaded for that purpose. Vision AI uses still frames from uploaded video. A video a customer uploads may also contain an audio track, and the customer is responsible for any consent the law requires to record it
• Markups, annotations and notes — the regions a customer’s users draw on training captures, and the notes they write about a capture or about an area a camera watches
• Frame details and Vision AI Results — which camera sent an image and when, and the states Vision AI detected, with their confidence and time
• Work-Area Activity Detection results — whether a work area, station or machine is active, idle or occupied and, where the customer configures it to, whether people are present or working there. These results are reported for the area as a whole; Work-Area Activity Detection does not itself identify any person
• Tools & Equipment Tracking data — the tools and items of equipment the customer registers, the reference images the customer provides to register them (which are Visual Data), and where and when Vision AI saw each one across the customer’s work areas. The re-identification model is applied to images of the detected object, not to people. If the customer links a tool to a named individual — for example by assigning or checking it out to a worker — its location history may be Personal Data about that individual
• Individual Monitoring Data — the Visual Data, Output and other data that Individual Monitoring creates, uses or derives, including any count, location, track, identifier, embedding, profile, attendance or activity record relating to people or to a specific individual. It exists whenever a customer configures Vision AI to detect, track, count, locate or monitor people, or uses Visual Data or Output to evaluate or attribute activity to a specific individual. Individual Monitoring Data is Customer Data. It follows the retention rule for the data it is made of (section 9) and is used for Model Improvement like other Customer Data (section 5)

A camera captures whatever is in its view, so camera frames can include people who work at or visit a customer’s Site, and their faces and activity. The customer’s cameras upload still images, not video and without audio. Offsight’s Vision AI does not currently offer Facial Recognition, and Offsight does not use Customer Data to create a faceprint, face template or other biometric template of any individual.

Offsight imposes no restrictions of its own on where a customer places cameras, what they capture, or what the customer uses Vision AI to detect, track, count, locate or monitor, including people. The customer alone makes those decisions, and the customer alone is responsible for making sure that each of them is lawful in every country, state, province and locality where it operates a camera or where a Monitored Individual is located — including by telling the people in view and obtaining any consent the law requires, as the Terms of Service and the Acceptable Use Policy describe. The only rule the Terms of Service set for those decisions is that the customer may not use the Service in violation of law, and complying with the law is the customer’s responsibility, not Offsight’s. See sections 11 and 12. Laws that may apply to a customer include, for example:

• laws that ban cameras in restrooms, locker rooms, changing areas and lactation spaces, such as California Labor Code section 435, New York Labor Law section 203-c and Connecticut General Statutes section 31-48b;
• laws that require every party’s consent to record a conversation, such as California Penal Code section 632, if any camera or device the customer connects records audio;
• biometric privacy laws, such as the Illinois Biometric Information Privacy Act, Texas Business and Commerce Code section 503.001 and Washington’s biometric identifier law;
• workplace electronic-monitoring notice laws, such as Connecticut General Statutes section 31-48d, New York Civil Rights Law section 52-c and Delaware Code title 19, section 705;
• Section 7 of the National Labor Relations Act;
• state laws on artificial intelligence and automated decisions in employment, such as Colorado’s artificial intelligence act, the Illinois Human Rights Act’s rules on artificial intelligence, California’s regulations on automated decision-making technology, and New York City Local Law 144.

These are examples of laws the customer is responsible for. They are not rules Offsight sets, and the list is not complete.

Information collected automatically

• IP address, browser type and version, device type and operating system
• Access times, pages viewed, referring URLs and, in-product, screens visited
• Application and error telemetry used to keep the Service working and to diagnose faults
• API usage metering — request counts and volumes against each API key, used to enforce limits and to bill accurately
• AI credit consumption, recorded per request so an account can see where it went

Our sites and apps use cookies and similar technologies that are necessary to operate them — keeping you signed in, remembering a session, and understanding aggregate usage so we can fix what is broken. We do not sell your information, and we do not rent or lease customer lists.

Sensitive personal information and precise location

• Offsight’s Vision AI does not currently offer Facial Recognition, and Offsight does not use Customer Data to create a faceprint, face template or other biometric template of any individual. If Customer Data that Offsight holds includes Biometric Data — for example because of how a customer uses the Service — section 10 governs its retention and destruction.
• Account log-in credentials — a username together with a password, which Offsight stores only in hashed form — are sensitive personal information under some state laws. Offsight uses them only to authenticate users and to keep accounts secure.
• Where Visual Data or Individual Monitoring Data shows where an identifiable individual is inside a facility, that location may be precise geolocation or other sensitive personal information under some state laws.
• Offsight does not sell sensitive personal information or precise geolocation. Where Customer Data contains them, Offsight uses them to provide the Service and, like other Customer Data, for Model Improvement as section 5 describes.

4. How AI processing works

This is the section most vendor reviews are actually looking for, so it is specific.

What gets sent. When someone uses an AI feature, the content of that request and the records, documents or images relevant to answering it are sent over an encrypted connection to a third-party model provider, which processes them and returns a response. What is sent is scoped to the request. A question about one work order does not ship the whole database.

Who processes it. Model inference is performed by third-party model providers engaged as our Sub-processors, under commercial API terms and under written data-protection obligations. Providers and model versions change as the technology changes. See the sub-processors section of the DPA for how Sub-processors are engaged and how customers get the identified list.

Large language models. Offsight does not currently collect, use or sell personal data to train large language models. The Offsight AI assistant is powered by third-party model providers acting as Offsight’s Sub-processors. Inference requests to third-party model providers — for the AI assistant and AI agents, Image Review and Second-Opinion Review — are made under terms that do not allow the provider to train its models on customer content. Offsight’s own Vision AI models are computer-vision detection models, not large language models; how Offsight trains and improves its models with Customer Data is described in section 5.

Vision AI and Customer Models. Vision AI detection, and the training of the models it uses, run on computing infrastructure Offsight operates in its cloud hosting environment, not at a third-party model provider. Each customer’s Customer Models start from a Base Model, are further trained on that customer’s Visual Data, are deployed only to process that customer’s Visual Data, and are not deployed for any other customer. No customer’s Customer Data, or any image or other data that identifies a customer or any individual, is disclosed to another customer. Customer Data, including Visual Data that shows people, is also used to train and improve Base Models and Offsight’s other AI models, as described in section 5. The notes attached to training captures and to camera areas are not used to train a Customer Model; like other Customer Data, they are used for Model Improvement.

Second-Opinion Review. A customer can turn on the account setting “Improve Vision AI capability and accuracy,” which is off unless it is turned on. While it is on, when a detection’s confidence falls just short of the threshold for that state, Vision AI may send up to eight camera frames, the state being checked, and the related notes attached to training captures and to the area the camera watches over an encrypted connection to a third-party model provider acting as Offsight’s Sub-processor for a second opinion. The request is made with the provider’s response-storage option turned off, and the verdict is recorded beside the detection without overwriting it.

Image Review. Image Review is an optional, paid check of training captures that a customer may request before a Customer Model is trained. When a customer requests it, the training captures under review — with the markups, labels, notes and capture details needed for the check, and reference captures from the same customer for comparison — are sent to a third-party model provider acting as Offsight’s Sub-processor. Apart from Second-Opinion Review, while it is on, and Image Review, when a customer requests it, Vision AI itself does not send Visual Data to a third-party model provider. Visual Data that a user shares with, or asks, the AI assistant about — for example, the notes on a training capture, or an image attached to a chat — is sent as described under “What gets sent” above, whether or not Second-Opinion Review is on.

Permissions still apply. An AI request executes in the context of the user who made it. It is scoped to that user’s tenant and bounded by their per-module and per-user-group permissions. It cannot reach another tenant, and it cannot see a module the user cannot see.

It is logged. AI sessions — the request, the actions taken and the output returned — are stored in the customer’s tenant as part of the record, so an administrator can see what was asked, what the system did, and on whose behalf.

Output can be wrong. AI output — including Vision AI Results and any Output about people — is decision support, not a professional opinion, and it can be wrong. The Terms of Service section entitled “AI output requires human review” explains how output should be checked before it is relied on. Offsight does not design, market or offer Vision AI or the AI assistant for making Consequential Employment Decisions. This describes how Offsight designs and offers the Service; it does not restrict how a customer uses it. A customer that uses Output in any decision about an individual does so as the deployer and at its sole risk, as section 12 describes.

AI assistants you connect. A user can connect Offsight AI to a third-party AI assistant that supports remote connectors. The user signs in on Offsight’s own sign-in page and chooses the account to connect; their password is never given to the assistant. The connection then acts as that user, within the same tenant and permissions described above. It can only read unless the user grants it access to make changes, it is built to ask for the user’s approval in the conversation before each change, and each change is recorded in the customer’s tenant. When the user asks the assistant something, the records needed to answer are sent to it. What the assistant’s provider does with them is governed by the user’s or the customer’s own agreement with that provider, not by this policy. To keep a connection working, Offsight stores an encrypted copy of the user’s Offsight session, which is deleted automatically no later than ninety (90) days after the user signed in. The connector’s logs record which operation was called and when, not the content of the request or the response. Removing Offsight from the assistant ends its access.

5. Model Improvement

Offsight uses Customer Data — including Visual Data that shows people, their faces and their activity — to train and improve its AI models, including the Base Models it uses to provide the Service to all of its customers. This is the Model Improvement described in the section of the Terms of Service entitled “Model Improvement.” Training a customer’s own Customer Model is not Model Improvement.

What is used

Model Improvement may use any Customer Data. The Customer Data used includes Visual Data that shows people, their faces and their activity, Vision AI Results, Individual Monitoring Data, and the markups, labels and notes attached to them. Offsight uses it to train, retrain, fine-tune, test, evaluate, validate, improve and develop its AI models, including Base Models and other models it uses to provide the Service to its other customers. Model Improvement does not depend on any setting, and there is no opt-out other than any that applicable law requires. The account setting “Improve Vision AI capability and accuracy” controls only Second-Opinion Review, described in section 4.

Training Copies

Offsight selects and stores copies of Customer Data for Model Improvement — Training Copies, as defined in section 2. Training Copies are not subject to the retention periods that apply to Customer Data in the customer’s tenant, described in section 9. Offsight keeps them for as long as it uses them for Model Improvement, including after the customer’s agreement ends, and protects them as the Model Improvement Safeguards describe.

Offsight’s role

Offsight performs Model Improvement for its own business purposes. To the extent applicable law permits a processor or service provider to use Personal Data to build or improve its services, Offsight performs Model Improvement in that role. To the extent applicable law treats Model Improvement as outside that role, Offsight performs it as an independent controller (or “business” or “third party”), and the customer authorizes and instructs Offsight to receive and use Customer Data for it. In either case, Offsight complies with the obligations that applicable law places directly on it.

Model Improvement Safeguards

The Model Improvement Safeguards are the following commitments, which are the only limits on Model Improvement. Offsight:

• (a) does not disclose the customer’s Customer Data, or any image or other data that identifies the customer or any individual, to any other customer;
• (b) does not use Customer Data to create a faceprint, face template or other biometric template of any individual;
• (c) does not sell Customer Data; and
• (d) protects Training Copies and other Customer Data used for Model Improvement with commercially reasonable security measures.

Making a model trained with a customer’s Customer Data available to other customers is not a disclosure of that customer’s Customer Data. Offsight’s models, including their weights and parameters, are Offsight’s property and are not Customer Data.

The customer’s authorizations

Each customer represents and warrants to Offsight that it has obtained, and will maintain, every Required Authorization. That includes every notice and consent needed for Offsight to use Customer Data, including Visual Data that shows Monitored Individuals, for Model Improvement as the Terms of Service describe. Each customer also represents that its notices to workers and others who may appear in Visual Data tell them that images are processed by Offsight as the customer’s vendor and are used by Offsight to train and improve its AI models. Claims that arise from Offsight’s use of Customer Data for Model Improvement are Covered Claims, within the customer’s duty to defend and indemnify described in section 12.

From when

Model Improvement applies from the Model Improvement Effective Date: for a customer that first accepts the current version of the Terms of Service, or signs an Order Form that references it, the date it does so; for an existing customer, the date thirty (30) days after Offsight gives notice of that version under the section of the Terms of Service entitled “Changes to these Terms.” From that date, Model Improvement applies to all Customer Data that Offsight holds on that date and to all Customer Data provided after it.

After an account ends

Offsight owns the models, weights, parameters and other results of Model Improvement, and they are not Customer Data. Training Copies, Aggregated Anonymous Data and the models trained with Customer Data are kept by Offsight after a customer’s account ends, and are not returned or deleted with Customer Data. Section 13 explains how requests from individuals are handled.

This section summarizes the Terms of Service section entitled “Model Improvement.” As between Offsight and a customer, if this section differs from that section, that section controls.

6. How we use information

• To operate, maintain, secure and improve the Service and this website. Offsight uses a customer’s Customer Data to build and improve the quality of the Service provided to that customer, and improves its AI models for customers generally through Model Improvement, as section 5 describes
• To provide Vision AI to the customer whose cameras sent the images — including Work-Area Activity Detection, Tools & Equipment Tracking, Individual Monitoring as that customer configures it, and training that customer’s own Customer Models
• To use Customer Data, including Visual Data that shows people, their faces and their activity, for Model Improvement, as described in section 5
• To provide the services you have requested, including a demo or support
• To create and administer accounts, permissions and authentication
• To bill accurately, including metered API and AI credit usage
• To send transactional messages: alerts, notifications, confirmations, and service announcements
• To tell you about other Offsight products and services. You can opt out of marketing email at any time using the link in the message or by writing to us
• To comply with legal obligations and to enforce our agreements

We may also generate Aggregated Anonymous Data, which cannot be linked to a customer or to any individual or household, and use and make it available to improve, test and operate our products.

7. Sharing information

Offsight does not sell Customer Data. Offsight does not sell or “share” personal information — in California’s terms, “share” means disclosing it for cross-context behavioral advertising — and does not sell, rent or lease its customer lists to third parties. Offsight does not disclose one customer’s Customer Data to another customer.

We share information only in these situations:

• Sub-processors. We use Sub-processors to perform part of the Service for us. They fall into these categories: cloud hosting and storage; AI model inference, which covers the AI assistant and AI agents, Image Review and Second-Opinion Review; design-file processing; transactional and notification email; subscription billing and payment processing; and DNS and edge delivery for our public website. Offsight also uses its cloud hosting and storage Sub-processors to store Training Copies and to perform Model Improvement. Each is engaged under a written contract, is bound to use the information only to provide its service to Offsight, and is bound to confidentiality. Customers and their assessors can obtain the identified list under the DPA — see the sub-processors section of the DPA. Visual Data is stored and processed on infrastructure provided by our cloud hosting and storage Sub-processors. Visual Data reaches an AI model inference Sub-processor only through Second-Opinion Review, if a customer turns it on; through Image Review, if a customer requests it; or when a user shares it with the AI assistant. The cameras themselves are hardware a customer buys from a third party; their manufacturers are not Offsight Sub-processors.
• Integrations you connect. If you connect Offsight AI to another system — an ERP, an accounting package or a design-file platform, for example — data moves between the two at your instruction and under that provider’s terms.
• AI assistants you connect. If you connect Offsight AI to a third-party AI assistant, the records needed to answer your requests are sent to it at your instruction and handled under that provider’s terms, as described in section 4.
• Legal process. We may disclose information if required by law, or in the good-faith belief that it is necessary to comply with legal process, to protect and defend our rights or property, or to act in exigent circumstances to protect someone’s personal safety.
• Business transfer. If Offsight is involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction, subject to this policy.

8. Security

Offsight secures information against unauthorized access, use, alteration and disclosure. The controls in place include:

• Encryption in transit (TLS) and encryption at rest
• Two-factor authentication
• Per-module and per-user-group permissions, administered by your own admins
• Tenant isolation, so one customer’s data is separated from another’s
• Audited access, including logging of administrative and support access
• API keys with rotation, live usage metering and enforceable limits
• For Vision AI: cameras upload over encrypted FTPS, with unencrypted FTP and older TLS versions refused; camera credentials can only upload — they cannot read back, list or delete anything; each uploaded camera image is written to a storage path the server generates under the customer’s tenant; Visual Data is encrypted at rest; Vision AI images are kept private rather than given public links, and training captures are opened through short-lived signed links; and Customer Model training runs with credentials limited to that customer’s Visual Data
• Managed cloud infrastructure in the United States: containerized services, a managed relational database with a read replica, a caching tier, and per-tenant data separation

No transmission over the internet or any wireless network can be guaranteed to be completely secure. While we work to protect your information, you acknowledge that there are security and privacy limitations inherent to the internet that are beyond our control. We will answer a written security questionnaire about the architecture, subject to confidentiality — ask us on the contact page.

9. Retention

• Customer Data is retained for as long as the customer’s account is active, and then in accordance with the customer’s agreement. On termination, data can be exported and is then deleted on request. Data may be irretrievably deleted if an account is ninety (90) days or more delinquent. Training Copies and Offsight’s models are not deleted with Customer Data, as described below.
• AI session records — requests, actions and output — are retained in the customer’s tenant on the same basis as other Customer Data, because they are part of the audit trail.
• AI assistant connections — the encrypted session copy that keeps a connected assistant signed in is deleted automatically no later than ninety (90) days after the user signed in. The changes a connection made are retained in the customer’s tenant as part of the audit trail.
• Visual Data — raw camera frames, and the reduced-size copies made to display them, are deleted automatically thirty (30) days after they are stored. Detection overlay images are deleted automatically three hundred sixty-five (365) days after they are stored. Training captures, their markups, annotations and notes, and Customer Models are retained in the customer’s tenant while the customer’s account is active and are deleted from it in accordance with the customer’s agreement, at termination or on request. Removing a training capture in the product does not by itself immediately erase the stored image. Vision AI Results, including Work-Area Activity Detection and Tools & Equipment Tracking results, are retained like other Customer Data. These periods apply to the customer’s tenant; Training Copies and Offsight’s models follow the rules below.
• Individual Monitoring Data follows the retention rule for the data it is made of. For example, a raw camera frame that shows people is deleted from the customer’s tenant thirty (30) days after it is stored, like any other raw camera frame, and Vision AI Results about people are retained like other Customer Data.
• Biometric Data, if Offsight holds any, is retained and destroyed under the policy in section 10.
• Training Copies are kept for as long as Offsight uses them for Model Improvement, including after a customer’s account ends, as described in section 5.
• Models and Aggregated Anonymous Data — Offsight’s models trained with Customer Data, including Base Models and Customer Models, and Aggregated Anonymous Data are kept by Offsight after a customer’s account ends. Neither they nor Training Copies are returned or deleted with Customer Data.
• Website and marketing information — a demo request, an enquiry — is retained for as long as needed to respond and to maintain a record of the relationship, and is deleted on request.
• Logs and telemetry are retained for a limited operational period and then rotated out. Logs from Vision AI’s image-upload and detection services are kept for thirty (30) days.
• Billing records are retained for as long as required for tax and accounting purposes.

10. Biometric Data retention and destruction policy

This is Offsight’s public written policy for retaining and permanently destroying any Biometric Data that Offsight holds. It states the limits that the law sets.

• Current state. Offsight’s Vision AI does not currently offer Facial Recognition, and Offsight does not use Customer Data to create a faceprint, face template or other biometric template of any individual. This policy governs any Biometric Data that Offsight nonetheless holds — for example because of how a customer uses the Service or what it uploads.
• Use and disclosure. Offsight processes Biometric Data that it holds to provide the Service to the customer, on that customer’s documented instructions, and, as part of Customer Data, for Model Improvement as section 5 describes, in each case as applicable law permits. Offsight does not sell, lease or trade Biometric Data, and does not otherwise profit from it where applicable law prohibits that. Offsight discloses it only to its Sub-processors, as the customer’s releases name them, or where the law requires or permits disclosure. Offsight stores, transmits and protects it using the reasonable standard of care in its industry, and in a manner at least as protective as the way it protects other confidential and sensitive information.
• Destruction schedule. Biometric Data that Offsight holds is permanently destroyed no later than the earliest deadline set by the law that applies to it. Where they apply, those deadlines include:
  • Illinois: when the initial purpose for collecting or obtaining it has been satisfied, or three (3) years after the individual’s last interaction, whichever is first;
  • Texas: within a reasonable time, and no later than one (1) year after the purpose for collecting it expires;
  • Colorado: when the initial purpose for collecting it has been satisfied, twenty-four (24) months after the individual’s last interaction, or within forty-five (45) days after it is determined that keeping it is no longer necessary, adequate or relevant to the purpose, whichever is first.
  Offsight may keep Biometric Data longer only where a valid warrant or subpoena, a legal hold or another legal obligation requires it, to the extent applicable law permits, only for that purpose and for no longer than required. This schedule applies to Biometric Data wherever Offsight holds it, including in Training Copies, and sections 5 and 9 are subject to it.
• Customers’ obligations. A customer whose use of the Service involves Biometric Data is solely responsible, where the law requires it, for meeting the Biometric Release Requirements for every Monitored Individual — including written notice that the data will be disclosed to and processed by Offsight and its Sub-processors, including for Model Improvement — and for any duty the Monitoring Laws place on it to publish its own biometric policy. These are Required Authorizations, and section 12 applies to them.

11. If you appear in a customer’s camera images

This section is for workers, visitors and anyone else who may appear in images from an Offsight customer’s cameras.

• The customer is in charge of its cameras. The Offsight customer that operates the cameras — usually your employer, or the company running the Site — decides whether cameras operate, where they are placed and point, and what Vision AI is configured to detect, track, count, locate or monitor, including people. Offsight imposes no restrictions of its own on those choices; the customer alone is responsible for making them lawful. That customer is responsible for telling you, for posting any required signs and for obtaining any consent the law requires. Each customer represents to Offsight that it has given every notice and obtained every consent the law requires, including for Offsight’s use of images for Model Improvement, and that its notices tell the people in view that images are processed by Offsight as the customer’s vendor and are used by Offsight to train and improve its AI models.
• What Offsight does and does not do. The customer’s cameras upload still images, not video and without audio. Offsight’s Vision AI does not currently offer Facial Recognition. Offsight uses Customer Data — including images that show you, your face and your activity — to train and improve its AI models, as described in section 5. Offsight does not use Customer Data to create a faceprint, face template or other biometric template of any individual, does not disclose images or other data that identify you to any other customer, and does not sell Customer Data.
• Making a request. To see, correct or delete images or records about you, contact your employer or the Site operator. Offsight will help them respond. You can also write to support@offsight.com, and we will direct you to the right customer, or pass your request to it where we can identify it.
• Raising a concern about a camera. If you are concerned about how a customer uses its cameras — for example a camera in a restroom, locker room or other private area, a device that records audio, or monitoring you were not told about — raise it with your employer or the Site operator, and with the authorities that enforce the laws where you work. You can also write to support@offsight.com, and we will pass your concern to the customer where we can identify it. Offsight does not decide whether a customer’s use of its cameras is lawful. Offsight suspends or restricts the Service only on a Suspension Event, as the Terms of Service describe — including when a court, regulator or other government authority orders it.

12. INDIVIDUAL MONITORING — THE CUSTOMER’S SOLE RESPONSIBILITY AND RISK

INDIVIDUAL MONITORING IS AVAILABLE WHENEVER A CUSTOMER CONFIGURES VISION AI TO DETECT, TRACK, COUNT, LOCATE OR MONITOR PEOPLE, OR USES VISUAL DATA OR OUTPUT TO EVALUATE OR ATTRIBUTE ACTIVITY TO A SPECIFIC INDIVIDUAL. NO SEPARATE SETTING, APPROVAL OR ATTESTATION IS REQUIRED. BY USING INDIVIDUAL MONITORING THE CUSTOMER ACCEPTS, FOR ITSELF AND ITS COMPANY, FULL RESPONSIBILITY FOR THAT USE, AND THE CUSTOMER ACKNOWLEDGES AND AGREES THAT:

• (1) THE CUSTOMER ALONE DECIDES WHETHER, WHERE, WHEN AND HOW TO MONITOR ANY INDIVIDUAL, AND, AS BETWEEN THE CUSTOMER AND OFFSIGHT, THE CUSTOMER IS THE EMPLOYER, CONTROLLER, “BUSINESS” AND “DEPLOYER” FOR THAT MONITORING;
• (2) THE CUSTOMER USES INDIVIDUAL MONITORING AT ITS SOLE LEGAL RISK, AND THE CUSTOMER IS SOLELY RESPONSIBLE FOR COMPLYING WITH ALL MONITORING LAWS OF EVERY COUNTRY, STATE, PROVINCE AND LOCAL JURISDICTION WHERE IT OPERATES A CAMERA OR WHERE A MONITORED INDIVIDUAL IS LOCATED;
• (3) THE CUSTOMER WILL OBTAIN AND MAINTAIN EVERY REQUIRED AUTHORIZATION. THAT MEANS GIVING EVERY NOTICE, POSTING EVERY SIGN, OBTAINING EVERY CONSENT AND RELEASE (INCLUDING WRITTEN BIOMETRIC RELEASES WHERE THE LAW REQUIRES THEM), COMPLETING EVERY ASSESSMENT, AND MEETING EVERY OBLIGATION TO NOTIFY, CONSULT OR BARGAIN WITH A UNION OR OTHER EMPLOYEE REPRESENTATIVE. THE CUSTOMER WILL ALSO HANDLE EVERY REQUEST FROM A MONITORED INDIVIDUAL;
• (4) OFFSIGHT HAS NO RELATIONSHIP WITH MONITORED INDIVIDUALS, CANNOT GIVE NOTICE OR OBTAIN CONSENT ON THE CUSTOMER’S BEHALF, DOES NOT PROVIDE LEGAL ADVICE, AND MAKES NO REPRESENTATION THAT ANY USE OF VISION AI OR INDIVIDUAL MONITORING IS LAWFUL IN ANY JURISDICTION;
• (5) OFFSIGHT HAS NO RESPONSIBILITY, AND NO LIABILITY TO THE CUSTOMER, FOR THE CUSTOMER’S INDIVIDUAL MONITORING OR FOR ANY DECISION THE CUSTOMER MAKES ABOUT ANY INDIVIDUAL; AND
• (6) THE CUSTOMER WILL DEFEND, INDEMNIFY AND HOLD HARMLESS THE OFFSIGHT INDEMNITEES AGAINST EVERY COVERED CLAIM AND ALL LOSSES, AS SET OUT IN THE SECTION OF THE TERMS OF SERVICE ENTITLED “CUSTOMER INDEMNITY.” THAT OBLIGATION HAS NO CAP AND SURVIVES TERMINATION.

THE OFFSIGHT INDEMNITEES ARE OFFSIGHT, ITS AFFILIATES, AND THEIR RESPECTIVE OFFICERS, DIRECTORS, EMPLOYEES, CONTRACTORS AND AGENTS. THE CUSTOMER’S DUTY TO DEFEND, INDEMNIFY AND HOLD THEM HARMLESS COVERS EVERY COVERED CLAIM, INCLUDING EVERY CLAIM, DEMAND, LAWSUIT, CLASS, COLLECTIVE OR REPRESENTATIVE ACTION, ARBITRATION, AND REGULATORY OR GOVERNMENTAL INVESTIGATION, INQUIRY, AUDIT OR PROCEEDING, WHETHER THREATENED OR BROUGHT, BY ANY THIRD PARTY OR GOVERNMENT AUTHORITY, INCLUDING ANY MONITORED INDIVIDUAL OR ANY UNION, WORKS COUNCIL OR OTHER LABOR ORGANIZATION — AND ALL RESULTING DAMAGES (INCLUDING STATUTORY AND LIQUIDATED DAMAGES), SETTLEMENTS, JUDGMENTS, AWARDS, ATTORNEYS’ AND EXPERTS’ FEES AND COSTS AND, TO THE EXTENT APPLICABLE LAW PERMITS INDEMNIFICATION FOR THEM, FINES AND PENALTIES — THAT ARISES OUT OF OR RELATES TO INDIVIDUAL MONITORING, OR ANY OTHER USE OF VISION AI, A CUSTOMER MODEL, VISUAL DATA OR OUTPUT THAT INVOLVES ANY INDIVIDUAL, INCLUDING THE APPEARANCE OF ANY INDIVIDUAL IN VISUAL DATA; THE PLACEMENT, FIELD OF VIEW, AUDIO SETTINGS OR OPERATION OF ANY CAMERA OR OTHER DEVICE THE CUSTOMER CONNECTS TO THE SERVICE; THE REQUIRED AUTHORIZATIONS, OR ANY FAILURE TO GIVE, OBTAIN, COMPLETE OR KEEP ANY OF THEM; ANY CONSEQUENTIAL EMPLOYMENT DECISION OR OTHER DECISION THE CUSTOMER MAKES ABOUT ANY INDIVIDUAL; OFFSIGHT’S USE OF CUSTOMER DATA FOR MODEL IMPROVEMENT; THE MONITORING OF, OR THE APPEARANCE IN VISUAL DATA OF, WORKERS OF OTHER EMPLOYERS AT A SITE; OR THE CUSTOMER’S BREACH OF THE TERMS OF SERVICE, THE ACCEPTABLE USE POLICY OR ITS REPRESENTATIONS AND WARRANTIES, OR ITS VIOLATION OF ANY MONITORING LAW OR OTHER APPLICABLE LAW, IN EACH CASE AS THE TERMS OF SERVICE DEFINE COVERED CLAIMS. THAT DUTY APPLIES EVEN IF THE CLAIM ALLEGES, OR THE LOSS IS CAUSED IN PART BY, THE ACTIVE OR PASSIVE NEGLIGENCE, STRICT LIABILITY OR STATUTORY VIOLATION OF AN OFFSIGHT INDEMNITEE. IT DOES NOT APPLY ONLY TO THE EXTENT A LOSS IS FINALLY DETERMINED TO HAVE BEEN CAUSED BY THE FRAUD, GROSS NEGLIGENCE OR WILLFUL MISCONDUCT OF AN OFFSIGHT INDEMNITEE, BY OFFSIGHT’S BREACH OF ITS SECURITY OBLIGATIONS OR OF THE MODEL IMPROVEMENT SAFEGUARDS, OR BY AN ACT OR OMISSION FOR WHICH APPLICABLE LAW DOES NOT PERMIT INDEMNIFICATION. IT IS UNLIMITED, IS NOT SUBJECT TO ANY CAP, LIMITATION OR EXCLUSION OF LIABILITY IN THE TERMS OF SERVICE, AND SURVIVES THE TERMINATION OR EXPIRATION OF THE TERMS OF SERVICE AND OF EVERY ORDER FORM.

OFFSIGHT HAS NO RESPONSIBILITY AND NO LIABILITY TO THE CUSTOMER FOR ANY LOSS ARISING FROM INDIVIDUAL MONITORING, FROM ANY OTHER USE OF VISION AI INVOLVING INDIVIDUALS, FROM THE CUSTOMER’S PLACEMENT OR CONFIGURATION OF CAMERAS, FROM ANY DECISION THE CUSTOMER MAKES ABOUT AN INDIVIDUAL, OR FROM THE CUSTOMER’S FAILURE TO COMPLY WITH MONITORING LAWS OR TO OBTAIN THE REQUIRED AUTHORIZATIONS, INCLUDING ANY SUCH LOSS ALLEGED TO ARISE FROM OFFSIGHT’S NEGLIGENCE, EXCEPT TO THE EXTENT CAUSED BY OFFSIGHT’S FRAUD, GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, OR BY OFFSIGHT’S BREACH OF ITS SECURITY OBLIGATIONS OR OF THE MODEL IMPROVEMENT SAFEGUARDS.

THE CUSTOMER’S OBLIGATIONS ARE SET OUT IN FULL IN THE TERMS OF SERVICE AND THE ACCEPTABLE USE POLICY. THIS SECTION SUMMARIZES THE TERMS OF SERVICE; AS BETWEEN OFFSIGHT AND A CUSTOMER, IF IT DIFFERS FROM THEM, THE TERMS OF SERVICE CONTROL.

NOTHING IN THIS POLICY OR IN THE TERMS OF SERVICE EXCLUDES OR LIMITS ANY LIABILITY, OR WAIVES ANY RIGHT, THAT CANNOT BE EXCLUDED, LIMITED OR WAIVED UNDER APPLICABLE LAW, INCLUDING CALIFORNIA CIVIL CODE SECTION 1668. EACH PROVISION THAT ALLOCATES RISK OR LIABILITY APPLIES TO THE FULLEST EXTENT THE LAW ALLOWS. NOTHING IN THIS POLICY OR IN THE TERMS OF SERVICE WAIVES ANY RIGHT OF A MONITORED INDIVIDUAL OR OTHER THIRD PARTY THAT CANNOT BE WAIVED BY CONTRACT.

13. Your rights

Depending on where you live, you may have the right to request access to the Personal Data we hold about you, to have it corrected, to have it deleted, to restrict or object to how it is processed, to receive a portable copy, to withdraw a consent you previously gave, and to appeal a decision we make about your request. You will not be treated differently for exercising any of these rights.

Data Offsight holds as controller. To make a request about data Offsight holds as controller — for example a demo request or a marketing contact record — write to support@offsight.com. We may need to verify your identity before acting, and you may use an authorized agent where the law allows. If we decline to act on your request, we will tell you why. You may appeal by replying to that decision, or by writing to support@offsight.com with “Privacy appeal” in the subject line. We will tell you the outcome of an appeal within the time the law requires and, if we deny it, how to contact your state attorney general.

Data in a customer’s tenant. To make a request about records held inside a customer’s tenant — including images from that customer’s cameras — contact that customer. They are the controller of that data, and we will support them in responding. On the customer’s instruction, Offsight carries out deletion and correction across camera frames, detection overlays and training captures in the customer’s tenant. Offsight’s Vision AI does not currently offer Facial Recognition, so images are found by camera and time rather than by name, and raw camera frames older than thirty days will already have been deleted from the tenant.

Model Improvement. Training Copies and the models trained with Customer Data are kept by Offsight, as section 5 describes, and are not deleted when a customer deletes data from its tenant. Where applicable law gives you a right that applies to Offsight’s own use of your Personal Data for Model Improvement — for example where Offsight acts as an independent controller, as section 1 describes — you can make the request to support@offsight.com, and Offsight will respond as that law requires.

Aggregated Anonymous Data. Aggregated Anonymous Data is not Personal Data, so it is not subject to access, correction or deletion requests.

Consumer health data. Where Customer Data is consumer health data — for example Biometric Data about visitors or members of the public — people in Washington (RCW 19.373) and Nevada (NRS 603A.400 et seq.) may have rights over it, including rights of access and deletion and the right to withdraw consent. Those requests go to the customer, and Offsight will help it respond within the time those laws allow.

14. International transfers

Offsight is based in the United States and the Service, including Vision AI and the storage of Visual Data, is operated on infrastructure in the United States. If you access the Service from outside the United States, your information is transferred to and processed there. Where Personal Data is transferred out of a jurisdiction that restricts such transfers, we rely on the safeguards set out in our Data Processing Addendum.

15. Children

Offsight does not knowingly collect personally identifiable information from children under the age of thirteen. If you are under thirteen, you must ask a parent or guardian for permission before using this website. The Service is offered only to businesses and other organizations and is not directed to children.

16. Email communications

From time to time we may contact you by email with announcements, alerts, confirmations, surveys and other general communication. Transactional messages about your account and the Service are part of the Service. Marketing email always carries an unsubscribe link.

17. Changes to this policy

Offsight may change this policy from time to time, and the “Last updated” date at the top of this page shows when it last changed. Offsight will give notice of a Material Change at least thirty (30) days before it takes effect, by email to the customer’s Authorized Administrators and/or by notice in the Service or on this site. A change that expands Offsight’s use of Customer Data is a Material Change under the Terms of Service. A Material Change takes effect at the end of that notice period, and a customer’s continued use of the Service after it takes effect is the customer’s acceptance of it, as the section of the Terms of Service entitled “Changes to these Terms” describes. Other changes take effect when Offsight posts them or gives notice of them. If an Order Form or other agreement signed by both a customer and Offsight conflicts with a change, the signed agreement controls for its term.

18. Contact

Questions about this policy: support@offsight.com. Contract questions: sales@offsight.com.

Offsight Inc.
650 California St
San Francisco, California 94108

Sign Up For Free