Privacy Policy

Last updated: October 26, 2026

The company with the name “AGLAIASENSE”, with the principal office at 910 Auburn Ct, Fremont, CA 94538, USA, hereinafter the “Company”, provides this Privacy Policy to explain how it collects, uses, discloses and protects personal data in connection with:

its corporate website at https://aglaiasense.com/, including the Contact Us form (the “Corporate Website”);
its Device Manager platform at https://gs.leopardaws.com/ (the “Device Manager”); and
related user accounts, devices and services.

The Company acts as a Data Controller with respect to the operation of its websites, user accounts, Contact Us inquiries and related services, and as a Data Processor with respect to personal data processed on behalf of its customers through customer-deployed devices and related services. This Privacy Policy applies to individuals worldwide. It is provided in the context of the data protection laws that apply to the Company’s activities, including the General Data Protection Regulation EU 2016/679 and any national implementing laws and regulations (collectively “GDPR”), U.S. federal and state privacy laws, including the California Online Privacy Protection Act (“CalOPPA”) and, to the extent applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), Japan’s Act on the Protection of Personal Information (“APPI”), and Singapore’s Personal Data Protection Act 2012 (“PDPA”). Information specific to these regions is set out in the section “Additional information for specific regions”.

Obligation to protect the personal data

The Company undertakes to comply with the provisions of the legislation in force concerning the protection of personal data and to protect the personal data of the visitors and/or users (registered or not) of the Corporate Website and the Device Manager, as well as the personal data provided to the Company in its capacity as Data Processor from its customers, in the context of the Company’s business activities and for the provision of the Company’s services to its customers. The Company does not collect information relating to visitors’/users’ personal data unless they themselves provide such information, except as otherwise described in this Privacy Policy (such as the technical and aggregated usage data described below). Personal data are requested by the Company only for the special and specific purposes mentioned herein.

Personal and business data that the Company may collect

Information which we may collect and constitute personal data is the following:

Personal data the Company may collect, by party affected
Parties Affected	Data Type	Purpose	Retention Time
Corporate Website visitors	Aggregated usage data (such as pages visited, referring website, browser and device type, and country), collected through Cloudflare Web Analytics without cookies	To understand, in aggregate, how the Corporate Website is used and to improve its content and performance	Processed only in aggregated form that does not identify individual visitors. The Company does not create profiles of visitors.
Visitors of the websites, registered users	IP address and related technical connection data (such as browser type)	Temporary visitor identification, delivery of the websites, and website traffic monitoring for security purposes, including protection against spam, bots and attacks	Device Manager: until the end of the session on the website. Following the end of the session, the data are kept anonymized in server operational log for 90 days. Corporate Website: processed by the Company’s hosting and security service provider, Cloudflare, Inc., in accordance with its retention practices. The Company does not maintain its own log of Corporate Website visitor IP addresses.
Contact Us form submitters	Name, business e-mail address, company name, job title, the content of the message, and any other information the submitter chooses to include	To respond to the inquiry and to communicate with the submitter about the requested information, products or services	For up to two (2) years after the Company’s last communication with the submitter. If the inquiry leads to a contractual relationship, the data are retained for the duration of that relationship and any additional period required by law.
Registered users	First name, last name, and e-mail	To send out alerts based on user preferences, password reset links, and MFA verification codes	Until the user account is deleted. Following the deletion, the data are removed from backup files within 90 days, as backups are overwritten.
Individuals whose personal data is collected	Images of individuals, vehicles and other personal data captured via the Company’s devices as products	To extract and record shapes and related metadata (such as external characteristics, license plate, speed and dwelling time) of humans or vehicles, without identifying individuals, in order to provide the devices and related services in accordance with the customer’s instructions. Only where the customer has given its prior written consent, to develop, train and improve algorithms and artificial intelligence methodologies in computer vision and embedded software. By default, the data are not used for this purpose.	For 90 days, or until the registered user deletes them, whichever is earlier, unless the customer instructs otherwise. Following the deletion, the data are removed from backup files within 90 days, as backups are overwritten. When the customer’s contract ends, the data are deleted or returned to the customer in accordance with the contract.

The information mentioned above is provided by the data subjects, (a) when they make contact or when we contact them for the first time; (b) when they transact with us or with third parties through the websites and the web pages of the Company and through the services, programs and tools provided therein; (c) when they visit and browse the websites and web pages of the Company; or (d) in the context of our business activities and for the purpose of providing our services to our customers in accordance with our contractual obligations. The provision of the information mentioned above may take place at various instances and by different means, such as via printed or online forms, telephone or email, online delivery or providing access to such information remotely or online, through a member of our personnel or of a business partner, through the employer or a member of the personnel of the data subject or a third-party data controller or their business partner. We may also collect information concerning the data subject, for example when, either the data subject, or the third-party data controller who possesses and lawfully processes personal data of the data subject:

asks for information or submits a request, a query etc. through the Contact Us form on the Corporate Website or by other means using the contact information of the Company;
registers and/or creates an account for the use of the services provided by the Company through its websites and web pages, whereby a registered user is able to post content;
enters into a contractual agreement with our Company for the provision of services which require the processing of personal data which is lawfully in the possession of the third-party data controller;
and the personnel of the Company visits web pages on which the information mentioned above has been lawfully posted and made publicly available.

Where the Company processes image data on behalf of its customers, it does so strictly as a Data Processor, in accordance with the documented instructions of the customer acting as Data Controller. The Company uses such data to develop, train and improve its algorithms only where the customer has given its prior written consent; by default, such data are not used for this purpose. The Company does not use such data to identify individuals and does not perform facial recognition or biometric identification unless expressly agreed in writing with the Data Controller and permitted by applicable law.

Contact Us form

When you submit the Contact Us form on the Corporate Website, the following applies:

The information you submit is transmitted through Web3Forms, a form-delivery service, and delivered by e-mail to the Company’s mailbox at sales@aglaiasense.com.
To protect the form from spam and automated abuse, the Company uses Cloudflare Turnstile. Turnstile processes technical information about your browser and connection (such as your IP address and browser characteristics) to verify that the submission comes from a human. This information is used only for security purposes.
The Company uses the information you submit only to respond to your inquiry and for the security and legal purposes described in this Privacy Policy. It is not added to any mailing list, and the Company does not use it to send you newsletters, marketing or promotional communications.
Providing this information is voluntary. However, without your name and business e-mail address the Company cannot respond to your inquiry.
Please do not include sensitive personal data (such as health information or government identification numbers) in your message.

Purpose for collecting and processing personal data by the Company

The Company uses the personal data it collects for the following purposes:

Responding to inquiries submitted through the Contact Us form or by e-mail.
Facilitating user account management for the registered users.
Operating and securing the Corporate Website, the Device Manager and related services.
Understanding, in aggregated form, how the Corporate Website is used.
Sending service-related communications, including alerts, security notifications, and account recovery messages.
Developing, maintaining, and improving software, applications, and services in the field of artificial intelligence and computer vision. Image data from customer-deployed devices is used for this purpose only with the customer’s prior written consent.
Complying with legal and regulatory obligations.

Disclosure of personal data

The Company may disclose personal data only in the following cases:

To authorized personnel and business partners acting as data processors, strictly on a need-to-know basis and under contractual obligations including data protection clauses
Where disclosure is required by law or by an order of a competent authority
Where the data subject has explicitly consented to such disclosure

The service providers the Company currently uses for the Corporate Website include Cloudflare, Inc. (website hosting, content delivery and security, Cloudflare Turnstile and Cloudflare Web Analytics), Web3Forms (Contact Us form delivery), and the Company’s business e-mail provider.

The Company does not sell personal data and does not share personal data for cross-context behavioral advertising.

International data transfers

The Company is located in the United States. Personal data may be transferred to, stored in, or accessed from the United States and other countries where the Company or its service providers operate, which may not provide the same level of data protection as the country where the data subject lives. Where required by applicable law, the Company puts appropriate safeguards in place for such transfers, as described in the section “Additional information for specific regions”.

Retention of personal data

The Company retains the personal data it collects for as long as necessary to fulfil the purpose of their collection, as set out in the table above, as well as for any additional period of time required by any applicable legislation or following a prior written and specific consent of the data subject. Personal data retained in backup systems is protected by appropriate technical and organizational measures, is not actively processed, and is deleted as backups are overwritten, within the periods set out in the table above. If a backup is restored, the Company will not return personal data that had been deleted to active use.

Security of personal data

The Company implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Your privacy rights

The Company extends the following rights to all individuals, regardless of where they live, subject to the limitations and exceptions permitted by applicable law:

Right to information: To request information, in addition to the above-mentioned in this Privacy Policy, regarding the way in which the Company uses their personal data and their rights.
Right to access: To obtain access to their own personal data and to related information such as the processing purposes, the data categories, their origin and their recipients, if any.
Right to correction: To correct their personal data if they are inaccurate or incomplete.
Right to deletion: To request the deletion of their personal data when (a) they are no longer necessary for the purposes for which they were collected or (b) there is no lawful justification for the Company to continue using them or (c) if the data subject has withdrawn their consent, or in any other case where applicable law provides a broader right to deletion.
Right to restriction of processing: To restrict, in some cases, further processing of their personal data.
Right to data portability: To receive their personal data and/or request that the Company transmits them to another data controller.
Right to object: To object at any time to the processing of their personal data based on the Company’s legitimate interests, including profiling.
Right to withdraw consent at any time, where processing is based on consent.
Right to non-discrimination: Not to receive discriminatory treatment for exercising any of these rights.

How to submit a request. Requests may be sent to sales@aglaiasense.com. The Company may ask for information to verify the identity of the person making the request, and will use that information only for verification. Where permitted by applicable law, a data subject may designate an authorized agent to submit a request on their behalf.

Response time. The Company will respond in writing within one (1) month from the date of the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by two (2) further months, in which case the Company will inform the data subject of the extension and the reasons for it within the first month. Where applicable law sets a different time limit, the Company will comply with that time limit.

Fees. The information will be provided free of charge with the exception of manifestly unfounded, excessive or repeated requests, for which a reasonable fee may be charged for the Company’s administrative costs, where permitted by applicable law.

Appeals and complaints. If the Company declines a request, it will explain the reasons. The data subject may appeal the decision by replying to the Company’s response with the subject line “Privacy Appeal”, and the Company will respond to the appeal within forty-five (45) days, or within any shorter period required by applicable law. Data subjects may also have the right to lodge a complaint with their local data protection authority, as described in the section “Additional information for specific regions”.

Where the Company processes personal data as a Data Processor on behalf of a customer, requests should be addressed to that customer as the Data Controller. If the Company receives such a request, it will forward it to the relevant customer.

Children’s privacy

The Corporate Website and the Device Manager are intended for businesses and are not directed to children under 16 years of age. The Company does not knowingly collect personal data from children under 16. If you believe that a child has provided personal data to the Company, please contact the Company and it will delete such data.

Additional information for specific regions

The following sections supplement the rest of this Privacy Policy for individuals in the regions listed. If there is a conflict between a regional section and the rest of this Privacy Policy, the provision that is more protective of the individual applies.

European Economic Area (EEA)

Legal basis for processing. The Company processes personal data on the basis of one or more of the following legal grounds under Article 6 GDPR:

Performance of a contract (Art. 6(1)(b)), where processing is necessary for the provision of services, account management, and user authentication, or for taking steps at the request of the data subject prior to entering into a contract, such as responding to a request for information about purchasing products or services
Compliance with legal obligations (Art. 6(1)(c)), including security, record-keeping, and regulatory requirements
Legitimate interests (Art. 6(1)(f)), including responding to other business inquiries, understanding aggregate website usage, ensuring network and information security, preventing spam and fraud, improving services, and defending legal claims, provided that such interests do not override the fundamental rights and freedoms of data subjects
Consent (Art. 6(1)(a)), where explicitly obtained for a specific purpose. Where processing is based on consent, the data subject may withdraw such consent at any time, without affecting the lawfulness of processing before the withdrawal.

International data transfers. Where personal data of individuals in the EEA is transferred to a country that the European Commission has not recognized as providing an adequate level of protection, including the United States, the Company relies on Standard Contractual Clauses (SCCs) approved by the European Commission or another transfer mechanism permitted under GDPR, such as the EU-U.S. Data Privacy Framework where the recipient is certified under it. A copy of the relevant safeguards may be requested by contacting the Company.

Provision of personal data. Providing personal data is not a statutory requirement. Certain personal data are necessary to create a Device Manager account or for the Company to respond to an inquiry, as described above.

Automated decision-making. The Company does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning data subjects or similarly significantly affect them.

Right to lodge a complaint. Data subjects have the right to lodge a complaint with a supervisory authority in the EU Member State of their habitual residence, place of work, or place of the alleged infringement.

United States

California: categories of personal information. In the preceding twelve (12) months, the Company has collected the following categories of personal information: identifiers (such as name, business e-mail address and IP address); professional or employment-related information (such as company name and job title); and internet or other electronic network activity information (such as IP addresses and other security data processed to protect the websites). In addition, the Company processes visual information captured by customer-deployed devices on behalf of its customers as a service provider. The sources, purposes, recipients and retention periods of this information are described above.

No sale or sharing. The Company does not sell personal information and does not share personal information for cross-context behavioral advertising, and has not done so in the preceding twelve (12) months. The Company does not knowingly sell or share the personal information of consumers under 16 years of age.

California: your rights. To the extent the CCPA applies, California residents have the rights described in “Your privacy rights”, including the right to know what personal information the Company has collected about them and how it is used and disclosed, the right to request deletion, the right to request correction, and the right not to be discriminated against for exercising these rights.

California: Do Not Track. Some web browsers offer a “Do Not Track” setting. The Corporate Website does not use cookies or other technologies to track visitors over time and across third-party websites, so the Company does not change its practices in response to Do Not Track signals. Other than the service providers described above, which act on the Company’s behalf, the Company does not allow third parties to collect personally identifiable information about your online activities over time and across different websites when you use the Corporate Website or the Device Manager.

California: Shine the Light. The Company does not disclose personal information to third parties for their own direct marketing purposes.

Other U.S. states. Residents of other U.S. states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah, Texas and Oregon) may, to the extent those laws apply, have the right to access, correct, delete and obtain a copy of their personal data, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. The Company does not sell personal data, engage in targeted advertising, or carry out such profiling. Requests and appeals may be submitted as described in “Your privacy rights”. If an appeal is denied, the resident may contact the Attorney General of their state.

Japan

This section provides information required under the APPI for individuals in Japan.

Business operator. AGLAIASENSE, 910 Auburn Ct, Fremont, CA 94538, USA. Representative: Leon Luo, Chief Executive Officer.

Purposes of use. Personal data is used for the purposes described in “Purpose for collecting and processing personal data by the Company”.

Handling outside Japan. The Company is located in the United States and handles personal data there. Its service providers may also handle personal data in other countries where they operate, and the Company will provide the names of these countries upon request. Where the Company entrusts personal data to service providers, it requires them by contract to take measures equivalent to those required of personal information handling business operators under the APPI, and will provide further information about these measures upon request. Information on the personal information protection system of the United States is published by Japan’s Personal Information Protection Commission.

Security control measures. The Company takes security control measures including: establishing internal rules for the handling of personal data and assigning responsibility for it (organizational measures); confidentiality obligations for personnel (personnel measures); controlling access to areas and equipment where personal data is handled (physical measures); access controls, including multi-factor authentication for the Device Manager, and protection against unauthorized access (technical measures); and handling personal data in the United States with an understanding of the personal information protection system there (understanding the external environment).

Requests and complaints. Individuals may request disclosure, correction, addition, deletion, suspension of use, or suspension of third-party provision of their retained personal data, and disclosure of records of provision to third parties, and may submit complaints, by contacting the Company as described in “Your privacy rights”.

Singapore

This section provides information required under the PDPA for individuals in Singapore.

Consent and withdrawal. Where the Company relies on consent to collect, use or disclose personal data, individuals may withdraw their consent at any time by contacting the Company. The Company will inform the individual of the likely consequences of the withdrawal.

Transfers outside Singapore. Where personal data is transferred outside Singapore, the Company ensures that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that under the PDPA.

Data Protection Officer. The Company’s Data Protection Officer can be contacted at sales@aglaiasense.com. Individuals may also lodge a complaint with Singapore’s Personal Data Protection Commission.

Other countries and regions

Individuals in other countries and regions may have additional rights under local law. They may exercise those rights by contacting the Company, and the Company will respond in accordance with applicable law. They may also have the right to lodge a complaint with the data protection authority in their country.

Changes to the Privacy Policy

The Company reserves the right to amend this Privacy Policy at any time to reflect changes in its data processing practices or applicable law. The effective date of the latest version will always be indicated at the top of this document. If material changes are made, the Company will post the updated Privacy Policy on the Corporate Website with a new effective date.

Contact

For any questions about this Privacy Policy, or to exercise any of the rights described above, you may contact the Company at:

E-mail: sales@aglaiasense.com
Mail: AGLAIASENSE, 910 Auburn Ct, Fremont, CA 94538, USA