VISIONLINKSPrivacy Policy
This policy explains how VisionLinks Oy handles personal data when you visit our website, create an account, use the VisionLinks web or mobile application, connect cameras, or contact us. It also explains how to exercise your privacy rights.
Creating an account or reading this policy does not give blanket consent to every use of your data. Where we rely on consent, we request it separately for the relevant purpose.
1. Who is responsible
VisionLinks Oy is the controller for account administration, operation of the service, billing administration, support and service security. Privacy contact: contact@visionlinks.fi.
Our registered postal address has not yet been published here. Contact us for company details.
Our Business ID has not yet been published here.
For camera footage processed solely on a customer's instructions, the customer normally acts as controller and VisionLinks acts as processor. The camera operator determines why recording is necessary, where cameras are placed, who may view footage and how long it should be kept. Applicable business deployments require a data processing agreement.
If you appear in customer footage, this policy does not replace the camera operator's own surveillance notice.
2. Information we collect and why
We receive information directly from you, from your connected cameras, from your browser or device, and from integrations you choose to use. Google sign-in can provide a verified email address, profile name and account identifier. Payment services can provide subscription and transaction references or status.
| Information | Purpose | Legal basis |
|---|---|---|
| Name, email, account settings, password hash and sign-in identifiers | Create and administer your account, authenticate you and provide account recovery | Performance of our contract with you (Article 6(1)(b)) |
| Camera names, premise/location settings, device identifiers and connection settings | Connect and organize cameras and deliver requested service functions | Contract; where you act for an organization, legitimate interests in administering that customer relationship (Article 6(1)(f)) |
| Sign-in and activity events, camera identifiers, video windows, timestamps, HTTP outcomes and technical connection information | Protect accounts, investigate misuse and maintain accountability for access and exports | Legitimate interests in protecting the service, customers and people recorded |
| Subscription status, billing references and support correspondence | Provide paid services, resolve support requests and meet applicable accounting obligations | Contract, legitimate interests in customer support, and legal obligations where applicable (Article 6(1)(c)) |
| Privacy request details, identity checks and responses | Verify and respond to requests and demonstrate how they were handled | Compliance with data protection obligations |
Customer footage may contain images, voices, timestamps and information about people's movements or activities. When acting as processor, we handle that footage to provide live viewing, recording, playback, export and deletion under the customer's instructions; the customer determines the applicable lawful basis.
Camera connection URLs may include camera credentials. Do not put passwords or sensitive details in camera names or privacy-request descriptions. Account credentials and connection information needed to provide the service are not optional; without them, relevant functions may be unavailable. You choose which cameras and optional integrations to connect.
This policy does not authorize biometric identification, advertising uses of footage or AI training on customer recordings. A materially different use requires its own assessment and appropriate information before it begins.
4. Storage and international transfers
Currently self-hosted. Migration to AWS is planned; AWS is not represented as the current hosting provider. Contact us for the current storage location.
An EU-based company does not by itself mean that every provider stores or accesses data only in the EU/EEA. Provider locations, remote support and subprocessors can affect international transfers. Before a transfer outside the EEA, the applicable arrangement must be identified, such as a relevant adequacy decision or appropriate safeguards including Standard Contractual Clauses, with additional assessment where required. You may request details of applicable safeguards from contact@visionlinks.fi.
We will update the hosting and transfer information when the AWS migration or another material infrastructure change takes place. We do not claim that an unverified region or transfer safeguard is already in use.
5. Retention, backups and deletion
| Data | Retention or deletion criteria |
|---|---|
| Account and configuration records | While your account remains active, followed by account deletion, subject to a specific lawful retention obligation or exception. |
| Camera recordings | The camera's configured retention within the plan limits. Choose the shortest period necessary for your purpose; a plan allowance does not justify keeping footage longer than needed. |
| Activity audit events | 30 days. Events include sign-ins, camera openings, playback and exports, with camera references, video windows and timestamps. Account deletion clears the actor and associated camera identifiers/names. |
| Expired verification codes, recovery tokens and invitation records | Scheduled for removal by hourly cleanup after a 24-hour grace period following expiry. |
| Privacy requests | Completed or declined requests: one year after their last update, or earlier with account deletion. Pending requests remain until handled. |
| Billing and provider records | Applicable contractual, accounting, tax or dispute requirements. Provider-held records are handled separately from deletion of the VisionLinks account. |
Database backups
The deployment workflow creates database backups before redeployment. These contain database records, not recording video files. An automated backup expiry period has not yet been configured or published. Contact us about retention and erasure of backup copies.
Deleting an account does not immediately rewrite existing database backup files. A backup may therefore contain data removed from the active database. Backup copies, past server copies and restore-related erasure require separate handling; contact contact@visionlinks.fi for a request involving them. The existence of a database dump is not a promise of an independently tested disaster-recovery service.
Server logs
Hosting, reverse-proxy and provider logs are separate from the 30-day activity audit. Their exact retention periods have not yet been published. Contact us for the applicable schedule. These logs may contain IP addresses, request metadata and technical diagnostics.
Account erasure
Use Delete account in the account menu, or contact us. The self-service process confirms your identity, stops owned cameras, clears recognized recordings on their currently assigned media servers and removes owned database records. If cleanup fails, deletion does not complete and may require a retry or operator assistance. Some footage may already have been erased before a later step fails.
Administrator and active-billing restrictions on self-service deletion do not prevent you from making an erasure request by email. Historical or orphaned recordings, provider records, legal retention exceptions and backups need separate review. Copies you downloaded or shared are outside the application's deletion controls.
6. Your rights and choices
Depending on the processing and applicable law, you may request access to your data, correction, erasure, restriction, portability, and information about recipients and safeguards. You may object to processing based on legitimate interests, including explaining your particular circumstances. If direct marketing is introduced, you may object to it at any time.
Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Withdrawal does not automatically end processing based on another applicable lawful basis. Rights are subject to relevant legal conditions and the rights of other people.
Open Privacy and your data to download core account data, correct your name or submit and track a request. Download footage separately from Recordings; change your email through the account menu. The account export excludes credentials and authentication proofs. Contact us for additional personal data held in logs, backups or provider systems.
You can email contact@visionlinks.fi without an account, including after deletion. We may ask for proportionate information to verify identity. We normally respond without undue delay and within one month. If a lawful extension is needed because of complexity or the number of requests, we will explain it within the original period. Requests are generally free; any permitted refusal or charge will be explained.
If you appear in customer footage, contact the camera operator first where possible. We can help identify the appropriate request route and assist the responsible controller. Access to footage may require protecting other people through redaction or other appropriate arrangements.
You may complain to the Finnish Office of the Data Protection Ombudsman, or another competent supervisory authority, including where you live or work. Contacting us first is not a condition for making a complaint.
8. Security, incidents and automated decisions
Controls include password hashing, ownership and administrator checks, email verification, optional email-based two-factor authentication, session revocation and activity auditing. The production website supports HTTPS. Camera transports and storage protection depend on the connected equipment and deployment; website HTTPS does not itself encrypt an RTSP camera connection. We do not claim end-to-end encryption or verified encryption of every storage volume.
We restrict service access through application permissions and use the incident-response process to assess suspected unauthorized access or loss. If a personal-data breach requires notification, we will notify the responsible controller, supervisory authority or affected people as applicable and within the relevant legal time limits. Report a suspected incident to contact@visionlinks.fi; do not send passwords or private keys.
Current account and camera-management functions are not presented as decisions with legal or similarly significant effects made solely by automated processing. Any future biometric identification or consequential automated analysis requires a separate assessment and appropriate information before use.
9. Children and people filmed
VisionLinks is designed for people and organizations managing cameras, rather than as a service directed at children. Children may nevertheless appear in customer footage, which requires particular care from the camera operator. Contact us if you believe a child's account or footage is being handled without a proper basis; we will assess the request and involve the responsible controller where appropriate.
Camera operators are responsible for lawful placement, notices and the rights of occupants, visitors, workers, neighbours and others recorded. A camera used at home is not automatically outside data protection law, particularly if it records public areas or neighbouring property. This policy does not provide permission for unlawful surveillance.
10. Changes and contact
We may revise this policy when the service, providers or legal requirements change. The update date and version identify the current notice. For material changes affecting how personal data is handled, we will provide an appropriate notice, such as an in-app message or account email. Where a new use requires consent, publication of a revised policy alone will not replace that consent.
For privacy questions, a request, provider details or a security report, email contact@visionlinks.fi. Include enough information to understand your request, but avoid unnecessary sensitive details. The Terms of Service and any applicable customer data processing agreement are separate from this notice.