Trust Center

Security, privacy, and how your footage is handled.

Super Vision reads cameras you already own. This page sets out what we do with that footage, what we deliberately never do, and the documents you can ask for during a review.

Last updated: October 14, 2026

How Super Vision processes video

Super Vision connects to cameras a customer already operates and turns the footage into event-level operational information: queues, visits, zone activity, staff service events, and the metrics and reports built from them.

For that footage and the analytics derived from it, the customer decides the purpose and the means. Super Vision acts as a processor or service provider, working only on the customer's documented instructions as set out in the agreement, the configuration, and other lawful directions.

For its own account administration, customer relationship, billing, and legal compliance records, Super Vision is an independent controller. That is covered in the Privacy Policy.

What customers instruct us to do

• Ingest authorized camera streams or recordings at identified business sites.
• Detect people, movement, queues, visits, zone activity, and staff service events within the configured field of view.
• Produce operational and customer-experience metrics, reports, alerts, and answers to authorized user questions.
• Troubleshoot and secure connections, and carry out configured retention and deletion requests.
• Provide support, billing, and legal compliance services.

No other purpose is authorized. We do not sell customer data to third parties, and we do not use it for unrelated profiling.

What we deliberately do not do

The product is built to describe what happens at a location, not to identify or score individuals. These capabilities are off, and stay off unless a customer separately approves one and it is available:

• Identity matching
• Face recognition
• Biometrics
• Cross-location person identification
• Audio capture
• Age, gender, or style profiling of individuals
• High-impact automated decisions about employees

Inference of race or ethnicity is excluded entirely. It is not an option a customer can enable.

Findings describe operational activity. They are not designed for individual performance scoring.

Security

Super Vision processes video from customer-authorized camera and VMS sources and converts it into operational intelligence. The architecture uses cloud video transport and storage together with AI processing.

Controls we hold ourselves to

• Access control. Access is scoped to the locations a person is responsible for, and limited to staff who need it for a specific task.
• Tenant separation. Customer media is kept from being reachable by another customer.
• Monitoring and audit. We capture events for sign-in, administrative operations, media access, deletion, and unusual export, and alert on material errors or suspicious access.
• Deletion and recovery. Deletion follows the retention schedule in the data processing agreement, with restricted backups and tested restore and deletion procedures.
• Incident response. We notify affected customers without undue delay and share what we know about scope and remediation as an investigation progresses.

We may suspend affected connections when needed to deal with a material security threat, a privacy violation, or an unlawful feed, giving notice where that is practical.

Encryption and certification

• In transit. All connections to our services, including camera and VMS transport, use TLS 1.2 or higher.
• At rest. Stored video, derived data, and backups are encrypted with AES-256.
• Administrative access. Multi-factor authentication is required, with access granted on a least-privilege basis and reviewed as roles change.
• SOC 2. We are working toward SOC 2 and are in progress. We do not yet hold a completed report, and we will say so here when that changes.

Security questionnaires, the current deployment and data flow detail, and the full security addendum are available to customers and prospects on request.

Data processing and customer control

Customers sign a data processing agreement that governs footage and derived analytics. It covers roles, permitted purposes, confidentiality, security measures, subprocessors, assistance with individual rights, incident handling, retention, audits, and international transfers.

Control customers keep

• Choose which cameras are connected, and disconnect them at any time.
• Direct prompt termination of future capture, independently of deleting historical data.
• Request deletion of selected site data where that is technically available and legally appropriate.
• Request an export or retrieval of data while the account is in good standing.
• Object to a new subprocessor that handles camera data, as described below.

The customer's own obligations

The customer confirms it has authority over the cameras and sites it connects, and is responsible for notices to employees and visitors where local law requires them. We provide template site and employee notices to help with this.

We assist, as far as the nature of the processing allows, with verifiable requests from consumers or workers.

Subprocessors

We use a small number of service providers to deliver the product, covering cloud hosting and storage, video transport, AI processing, authentication, scheduling, and email. Each is bound by data protection obligations no less protective than those in our data processing agreement, and we remain responsible for their performance of that work.

Changes and your right to object

• We give advance notice before a material new subprocessor begins handling camera data, where that is reasonably practical.
• A customer may object for a documented privacy or security concern.
• If we cannot resolve it in good faith, the customer may terminate the affected services, with no future fees for them after termination.

Current subprocessors

This list is current as of the date at the top of this page. Customers on an active subscription are notified before it changes in a way that affects camera data.

Retention and deletion

Retention is set per category of data in Schedule C of the data processing agreement, which we confirm in writing before cameras are connected. The periods below are what we apply today.

How the lifecycle works

• Each category has its own retention window, applied automatically.
• Customers can request deletion of selected site data at any time.
• Stopping future capture and deleting historical data are separate actions, and a customer can ask for either.
• After an account closes, we provide export or retrieval access while it is in good standing, and all customer data is deleted within 30 days.
• A legal obligation or a valid litigation hold can require a longer, limited retention.
• Billing and tax records are kept separately for as long as the law requires.

Current retention periods

Raw footage is deliberately short-lived. The 7-day window is what we need to produce and check the analytics, after which the footage goes and the derived metrics remain.

The full schedule, including log and backup detail, forms part of the data processing agreement and is available from Team@supervision.work.

Documents and contact

These are available to customers and prospects on request: