Privacy Policy

1. About this policy

Spyglass Technologies Inc. ("Spyglass," "we," "us," or "our") is a Delaware corporation that builds software for vehicle registration plate recognition (also known as automatic license/number plate recognition, or ALPR/ANPR) and the command platforms that manage it, including ROVE (our field application), Trellis (our web command platform), and RELAY (our companion application). This policy explains how we handle personal data.

We wear two different hats, and this policy is organized around them:

• As a controller, we decide how and why we process personal data for our own website, our marketing, and the business accounts we open for our customers and their users. This processing is described in Sections 6 to 16.
• As a processor in delivering the service, we process personal data on behalf of our customers when they use our products to run plate recognition. Here the customer is the controller and decides what is collected, why, and for how long. This is described in Sections 4 and 5, and is governed by our Data Processing Agreement (DPA), which controls over this policy for those activities.

This policy covers our websites, our marketing, and the accounts we operate for customers and their Authorized Users. It does not change the terms of any agreement we have signed with a customer.

This policy is a transparency notice, not a contract. Where we rely on your consent, we ask for it separately (see Section 10). Capitalized terms that are not defined in this policy have the meaning given to them in our Website Terms of Use or in the applicable customer agreement.

2. Who we are and how to reach us

Data controller: Spyglass Technologies Inc.
Email: privacy@spyglasstech.co

3. Key terms

• Personal data (also called "personal information" in some jurisdictions) means any information relating to an identified or identifiable individual.
• Customer Data and Customer Content mean all data a customer collects, enters, or stores using our products — including plate reads, images, lists, and zones. The customer owns and controls this data at all times.
• Operational Telemetry means the device, system and usage diagnostics we hold to operate, secure, and improve our products.
• Aggregated Statistics means genuinely anonymized, non-personal aggregate statistics — the only form in which your Customer Data or Customer Content contributes to improving and developing our products.
• Authorized User means an individual authorized by a customer to use our products under that customer's account.

4. How our products handle plate data (the short version)

Our plate recognition runs on the device, at the edge. A device recognizes a vehicle registration plate locally, in real time, and does not send images to the cloud for analysis. What happens next is set by the customer's configuration:

• In many deployments, plate reads and images stay entirely within the customer's own systems and never reach Spyglass at all.
• In other deployments, the customer configures a sync into their own area of our Trellis platform. Sync is off by default and turns on only by the customer's written instruction under the DPA.

In every case, the customer owns and controls this data — including its retention, access, export, and deletion. Spyglass does not own, control, mine, sell, or share it. When we do process it, we do so on the customer's behalf as a processor, under the DPA.

5. Personal data we process as a processor (customer deployments)

When a customer uses our products for plate recognition, the customer is the controller and Spyglass is a processor in delivering the service. The customer decides the lawful basis for processing — which the customer determines according to its own status and purpose, and which may include performance of a contract, legitimate interests, a public task, a legal obligation, or, for a competent authority acting for law-enforcement purposes, the law-enforcement-specific basis applicable to it — as well as the categories of data collected and the retention rules.

Depending on the customer's configuration, the personal data processed in delivering the service may include plate reads, plate and vehicle images, event timestamps, location data associated with a read, device identifiers, and user-entered annotations and lists.

If you are an individual whose data has been captured by a Spyglass-powered deployment and you wish to exercise your rights, please contact the organization operating the system — they are the controller and decide how that data is handled. We will support that organization in responding (see Section 15).

Any automated matching or alerting in a deployment — for example, flagging a plate against a list — is configured and controlled by the customer as controller, not by Spyglass.

The full terms for this processing — including security measures, sub-processors, international transfers, and data return and deletion — are set out in the DPA and its annexes, which are provided to and signed with each customer.

6. Personal data we process as a controller

6.1 Website visitors

When you visit our website, we collect standard technical data such as IP address, browser type, operating system, and pages viewed, together with cookie and similar-technology data (see Section 9). We use this to run and secure the site and to understand how it is used. We also use a third-party visitor-identification service on our marketing website to identify business visitors, described in Section 9.

6.2 Marketing and business contacts

If you contact us, request information, sign up for updates, or attend one of our events or demonstrations, we collect the details you give us — such as your name, organization, role, and contact details — and a record of our correspondence. Where an event involves photography or recording, we give notice and an opt-out, and we do not use recordings or images of identifiable individuals for promotional purposes without consent.

6.3 Account holders and Authorized Users

To open and run a customer account, we process a limited set of account data: typically the user's name, the email address used to activate a login, the user's role, and basic records needed for licensing, support, and troubleshooting. We keep this data to a minimum.

6.4 Automated decision-making

As a controller, Spyglass does not make automated decisions that produce legal or similarly significant effects about individuals.

7. Operational Telemetry

To keep our products running, secure, and reliable, we hold a limited amount of Operational Telemetry: device and system diagnostics such as device and system health data, error traces and performance metrics, and records of how our applications are used. Because this includes limited personal data, we treat Operational Telemetry as personal data, keep it to the minimum needed, and use it only for the purposes described in this section.

Why we hold it. We use Operational Telemetry to operate, maintain, monitor, secure, and troubleshoot our products, to investigate incidents, to preserve platform integrity, and to maintain, improve, and develop our products, which may include training and improving our machine-learning models on Operational Telemetry only (never on Customer Data or Customer Content). We do not use Customer Data or Customer Content for product improvement or to train our models, except as Aggregated Statistics (see Section 8).

What it is not for. We do not use Operational Telemetry to collect plate reads, read locations or images. Those are Customer Data, handled as Sections 4 and 5 describe.

How long we keep it. We keep Operational Telemetry only for as long as we need it to operate, secure and support our products, and then delete it. It is held by our monitoring and analytics providers, some of which are in the United States, under the transfer safeguards described in Section 12.

8. Improving our products

We are committed to a simple rule: we do not build our business on your data. We do not sell your personal data, and we do not mine, rent, trade, or otherwise disclose it except as described in this policy. We do not use Customer Data or Customer Content to train our models, except in the form of Aggregated Statistics — genuinely anonymized, non-personal aggregate statistics from which individuals cannot be identified. Aggregated Statistics are the only form in which your Customer Data or Customer Content contributes to improving and developing our products. We maintain and use Aggregated Statistics, and any deidentified information, only in deidentified or aggregate form; Spyglass does not attempt to re-identify de-identified or aggregated data, and contractually prohibits its sub-processors from doing so.

9. Cookies and similar technologies

We use cookies and similar technologies on our website for strictly necessary, analytics, functional, and marketing purposes. In the EU and UK, non-essential cookies are not set without your prior consent, and you can manage your preferences through the cookie banner, the cookie settings at the end of our Cookie Policy, and your browser settings. Full details of the cookies we use, their purposes, and their durations are in our separate Cookie Policy.

Website visitor identification. We use third-party services on our marketing website to help us understand which businesses are interested in us. What they do depends on where you are, so we have set it out separately.

If you are in the United States. When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout. This service operates on United States traffic and resolves individuals.

If you are in the United Kingdom or the European Economic Area. We do not run any non-essential tracking, including visitor identification, unless you have given your consent. Nothing is collected by these services before you consent, and if you decline, they do not run at all. Where you do consent, the identification is organization level only. We do not identify you as an individual. You can withdraw your consent at any time through the cookie settings at the end of our Cookie Policy, and you may also opt out at https://www.rb2b.com/rb2b-gdpr-opt-out.

Wherever you are, here is what these services never do. They run on our marketing website only. They are never used on the Trellis portal or any other product surface. They are never applied to Customer Data, and they never touch plate reads, images, or anything inside a customer deployment. We do not combine what they tell us with any product data, and we do not use them to make decisions about individuals. We use them for one purpose, which is to know which businesses are interested in us so that we can follow up.

10. Legal bases for processing (UK/EU)

Where we act as a controller and UK or EU data protection law applies, we rely on the following legal bases:

Where we act as a processor in delivering the service, the customer (as controller) is responsible for determining the lawful basis for processing (see Section 5). Two classes of user data sit on different sides of this line. Any Authorized User names or identifiers that are entered on a device and travel with plate reads or audit trails into a customer's synced deployment are processed on the customer's behalf as a processor under the DPA, not on the controller bases in the table above. By contrast, the limited account and licensing identity data we hold to open and run a customer account (Section 6.3) — for example the email used to activate a login — is our own data, processed on the controller bases in the table above; it is not Customer Data under the DPA.

We do not intentionally collect special-category personal data. If a specific enforcement or enterprise context requires such data to be processed, it is processed on the customer's lawful basis and instructions, under the DPA.

11. Who we share personal data with

We share personal data only where necessary, and only with:

• Service providers (sub-processors) that help us deliver and secure our products, by category: cloud hosting and infrastructure; edge security; error and infrastructure monitoring; and product analytics. They are bound by contract to process data only as needed for that purpose. The current list of sub-processors used to deliver customer deployments is maintained in the sub-processor annex to the DPA and is available to customers.
• Our own business tools, which we use as a controller to run the company — for example payment processing for billing, and the tools we use to manage customer relationships, marketing, and support. These process our account, billing, and marketing data — never customer plate data — and only as needed to run our business.
• Visitor-identification partners: our marketing website uses a third-party service that matches website activity against identity data held by that provider and its own data partners, so that we can follow up with business contacts (Section 9). This applies to our marketing website only. It never receives Customer Data, plate data, or product data.
• Business transfers: if Spyglass is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this policy.
• Legal and government requests: we disclose personal data only where required by valid legal process. Where a request concerns Customer Data, we direct the requester to the customer as controller; where that is not possible, we require valid legal process, disclose only the minimum necessary, challenge requests where there are grounds, and notify the affected party where we are legally permitted to do so.
• With your consent or at your direction, in any other case.

Apart from the visitor-identification service described in Section 9, we do not sell your personal data and we do not share it for cross-context behavioral advertising. Section 16 explains how that service is treated under California law and how to opt out.

We never sell, share, rent, or monetize Customer Data or plate data, in any circumstances. That commitment is absolute and is separately binding on us under the Data Processing Agreement with each customer.

12. International data transfers

We handle international data transfers along five separate paths.

Hosting. Our production infrastructure runs on Amazon Web Services (AWS) in London, United Kingdom, where hosted Customer Data is held. For EU/EEA customers, that hosting relies on the UK adequacy decision (adopted 2021 and renewed in 2025), so it is not a restricted transfer.

Monitoring and diagnostics. Operational Telemetry (Section 7) is processed by our monitoring and analytics providers, some of which are established in the United States, under appropriate transfer safeguards (the Standard Contractual Clauses or the EU-US Data Privacy Framework, as applicable to each provider).

Our support access. Our support and engineering personnel and our authorized contractors are located in Germany and the United States and may access a limited set of operational data to support and secure our products. Authorized contractors are bound by the same confidentiality and access-control obligations as our employees. Where this involves a transfer of personal data outside the UK or EEA, that access is minimized, limited to defined operational data, and subject to the access controls and confidentiality obligations described above.

Website visitor identification. Our visitor-identification providers (Section 9) are established in the United States. The US person-level service operates on United States traffic only and is not applied to UK or EEA visitors, so no UK or EEA personal data is transferred to it.

Where a UK or EEA visitor has consented to organization-level identification, the technical data used to perform the lookup is transferred to the United States under the Standard Contractual Clauses or the UK International Data Transfer Addendum, as applicable. Where you do not consent, no transfer takes place.

Customer Data. For customer deployments, international transfers of Customer Data are governed by the DPA and the transfer mechanism attached to it for the customer's region — the EU Standard Contractual Clauses or the UK International Data Transfer Addendum, as applicable. For California and other US customers, we act as a service provider under CCPA terms; CCPA does not itself regulate cross-border transfers, so no transfer mechanism applies to that processing.

13. How long we keep personal data

• Customer Data (customer deployments): retention is set and controlled by the customer, not by Spyglass. We do not make independent retention decisions for Customer Data. Customers can export or retrieve their data at any time, and data is returned or deleted at the end of the customer relationship in line with the DPA.
• Operational Telemetry: kept only as long as needed to operate, secure and support our products (see Section 7).
• Account data: kept while the account is open, and deleted after it is closed, in line with the customer's agreement.
• Acceptance and consent records (proof that an administrator or Authorized User accepted the applicable terms): retained as a distinct evidentiary class for the life of the account and, after the account closes, for no less than the limitation period applicable under applicable law, so we can establish, exercise, or defend legal claims. This class is separate from, and outlives, the operational account data above.
• Audit logs: retained for at least one year, for security and accountability.
• Website visitor-identification data (Section 9): kept only as long as necessary for business-to-business follow-up, and deleted on request.
• Website, marketing, and correspondence data: kept only as long as necessary for the purpose it was collected for.

When a retention period ends, we dispose of personal data securely and irrecoverably.

14. How we protect personal data

We encrypt personal data in transit, and our databases and file storage are encrypted at rest (AES-256). No system is completely secure, so we cannot guarantee absolute security; you are responsible for keeping your account credentials confidential.

If a personal-data breach occurs, what we do depends on our role. Where we are the controller of the affected data — for example website, marketing, or account data — we will notify the relevant supervisory authority, and any affected individuals, as and when the law requires. Where we process the data on a customer's behalf, we will notify that customer without undue delay after we become aware of the breach, so that they, as the controller, can meet their own notification duties.

15. Your data protection rights (UK/EU)

Where we act as a controller, you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have your data deleted in certain circumstances;
• restrict or object to processing in certain circumstances;
• object to direct marketing at any time;
• request portability of data you provided to us; and
• withdraw consent where we rely on it.

To exercise any of these rights, contact us at privacy@spyglasstech.co. We handle these requests through a defined manual process: we will verify your identity, locate the relevant data, and respond within the time required by law (generally one month under UK/EU GDPR, which may be extended where the law permits). There is normally no charge.

If your personal data was captured by a customer's deployment, Spyglass is a processor and cannot decide the request on its own. In that case, please contact the organization operating the system, which is the controller; we will support that organization in responding.

16. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• know and access the categories and specific pieces of personal information we have collected about you;
• request deletion of your personal information;
• request correction of inaccurate personal information;
• opt out of the sale or sharing of personal information;
• limit our use and disclosure of sensitive personal information; and
• not be discriminated against for exercising your rights.

Sale and sharing. We use a visitor-identification service on our marketing website, described in Section 9. That service may constitute a "sharing" of personal information for cross-context behavioral advertising under the CCPA, and we tell you so plainly rather than rely on a technicality.

You can opt out at https://app.retention.com/optout, or through the "Do Not Sell or Share My Personal Information" link on our website. That link is required of us both by California law and by our contract with the provider.

Apart from that service, we do not sell or share personal information. When we process personal information on behalf of a business customer, we act as that customer's service provider and use the information only to provide the service. We never sell or share Customer Data or plate data.

Categories we collect, and how we use and disclose them. In the preceding 12 months, we have collected these categories of personal information: identifiers (such as name, email address, and IP address); internet or network activity (such as how you use our website); and professional or employment-related information (such as your organization and role). We collect it directly from you, automatically from your device when you use our website or products, and — for account users — from the customer that opened your account. We use it for the business purposes described in Sections 6, 7, and 10, and we disclose it to the categories of service providers, business tools, and visitor-identification partners described in Section 11. In the preceding 12 months we have disclosed identifiers and internet or network activity to our visitor-identification provider, as described in Section 9. We do not knowingly collect or sell sensitive personal information.

To make a request, contact us at privacy@spyglasstech.co. You may use an authorized agent to submit a request on your behalf; we may need to verify your identity and the agent's authority before responding, and we will respond within the timeframe required by law (generally within 45 days).

17. Children's privacy

Our products and website are not directed to children, and we do not knowingly collect personal data from anyone under 16. If we learn that we have collected such data, we will delete it.

18. Changes to this policy

We may update this policy to reflect changes in our practices, our products, or the law. When we do, we will change the "Last updated" date and version above and post the revised policy here. Where changes are material, we will provide additional notice as required.

19. Complaints

If you are in the UK or EU and you have a concern we have not resolved, you have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO), https://ico.org.uk. In the EU, this is the data protection authority in your country.