Processing Terms

What this covers

These Processing Terms are part of our Terms of Service. They apply to Customer Content that contains personal information, such as footage that shows or records people. They are meant to meet the contract requirements that privacy laws, such as the California Consumer Privacy Act and similar state laws, place on a service provider or processor. They are a short schedule, not a full data processing agreement. We do not sign other data processing agreements. Words defined in the Terms have the same meaning here.

Our role

For hosting, compression, verification, storage, retrieval, and deletion of Customer Content, we process it only on your instructions, as your service provider or processor, and you are the business or controller. For that processing we will not sell or share it, will not use it for our own purposes, will not combine it with other customers’ content except as needed to run the multi-tenant service, and will not use it to train artificial intelligence models.

We do not use Customer Content for training at all. If we ever offered training, it would be a separate, optional setting for the workspace owner, and for that use we would act as a separate business, not as your service provider. You could use CamVue without it.

Nature and purpose of processing

We receive, compress, verify, store, and return Customer Content, and secure the workspace, for as long as the subscription and the download period after it last. Your instructions are these Terms and what you do in your workspace, such as uploading, setting retention, downloading, and deleting.

Types of data

Video, audio if present, poster images, metadata embedded in the files (which can include precise location), workspace account information, workspace FTP logins, and logs.

What we will do

• Follow your documented instructions, unless the law requires otherwise. If it does, we will tell you before we act, if the law allows.
• Bind the people who can access Customer Content to confidentiality, and limit access to those who need it to provide and secure the service.
• Keep Customer Content in the United States, encrypted at rest, and apply the security measures described in the Terms and Privacy Policy. Plain FTP is not encrypted in transit, as the Terms explain.
• Tell you if we decide we can no longer meet our duties under these Processing Terms.
• Give you the information you reasonably need to assess our compliance, on request.
• Tell the workspace owner about a confirmed security incident within 72 hours, as the Terms describe.

Subprocessors

You authorize us to use subprocessors in these categories: cloud infrastructure and storage in the United States, email delivery, and payment processing. We use a subprocessor only under a written contract that is no weaker than these Processing Terms, only for the task we hired it for, and with a ban on using Customer Content for its own purposes or to train its own models. We remain responsible for our subprocessors. We will give you our list of subprocessors on request, and we will tell you of a new one before it processes Customer Content, by email to the workspace owner or a notice in your workspace. You may object to a new subprocessor for a reasonable data protection reason, and if we cannot resolve it, you may cancel and receive a refund of prepaid fees for the time remaining. We do not send footage or audio to any AI model provider.

Requests, incidents, and audits

If someone asks us for access to, correction of, or deletion of footage that shows them, we will pass the request to you rather than answer it, unless you instruct us otherwise or the law requires us to. We will reasonably help you respond to those requests. Legal process is handled as the Terms describe. For security incidents, see the Terms. We will answer a reasonable written security questionnaire once a year. We do not offer on-site audits.

Return and deletion

You can download your archives while your subscription is active and for 30 days after it ends. After that we delete Customer Content, including replicated copies. We do not keep a restorable backup. We keep what the law requires us to keep, and records of billing and security that do not include the recordings. A confirmed hold or legal preservation duty pauses deletion of the files it covers.

What this is not

This schedule does not cover protected health information, payment card data, criminal justice information, or education records, which CamVue is not for. It does not change the limits on our liability in the Terms. Questions: legal@camvue.net.