Privacy policy

Privacy Policy Version 2.0 | Last updated: April 2026

1. Purpose

Echidna Cams Pty Ltd (Echidna, we, us) is committed to handling personal information responsibly and in accordance with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs).

This policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights in relation to it.

If you have any questions about this policy or how we handle your information, contact us at privacy@echidnacams.com

Important: Echidna's role in the surveillance system

Echidna provides a visual data capture and AI analysis platform. When subscribers deploy Echidna's system, they — not Echidna — are responsible for collecting and managing visual surveillance footage. Echidna acts as a technology platform provider and data processor, not as the primary data controller for subscriber-captured footage.

This means:

Subscribers own and control their footage and are responsible for lawful collection and use.
Echidna processes AI-derived insights on behalf of subscribers but does not hold or access raw footage unless the subscriber explicitly shares it with us.
Echidna is the data controller only for information it collects directly, such as subscriber account details, system telemetry, and website data.

2. Who and What This Policy Covers

This policy applies to personal information collected by Echidna in the following contexts:

Subscriber accounts: Contact names, email addresses, billing details, and account credentials collected when a business subscribes to the Echidna service.

System telemetry: Device health data collected by Echidna from deployed hardware — including battery levels, signal strength, and GPS location of Echidna-owned devices. This data relates to the device, not to individuals captured in footage.

Website visitors: Technical data collected when people visit echidnacams.com, including IP addresses, browser type, and usage analytics.

Team members: Employment-related information for Echidna staff, including resumes, payroll, and performance information.

Subscriber-captured footage: Visual surveillance footage captured by subscribers using Echidna's hardware. Echidna does not collect or hold this footage. The subscriber is the data controller. Echidna processes AI-derived insights from this footage on the subscriber's behalf, in accordance with the subscriber's Service & Licence Agreement.

This policy does not apply to GDPR (European Union) or CCPA (California) frameworks. Echidna currently operates in Australia only. We will update this policy when and if we expand to jurisdictions requiring compliance with those frameworks.

This policy and our website

This policy applies to the Echidna SAaaS platform and Echidna's direct business relationships with subscribers, team members, and business contacts. It also applies to personal information collected through our website and online store at echidnacams.com.

If you make a purchase through our online store, your transaction data is also processed by Shopify. Shopify operates globally and may transfer your e-commerce transaction data to servers located outside Australia. This is governed by Shopify's own privacy policy. Rights requests relating to data processed by Shopify through our online store should be directed to the Shopify Privacy Portal at privacy.shopify.com.

If you are both a website visitor and a SAaaS subscriber, both this policy and Shopify's policy apply to their respective contexts. Where there is any conflict, this policy governs in relation to the SAaaS platform.

Footage involving children

Echidna's surveillance system may be deployed in locations where children are present — for example, school campuses, retail premises, public spaces, or residential properties. In these circumstances, footage and AI-derived insights may capture images of children.

Echidna does not collect or control this footage. The subscriber is the data controller and is solely responsible for ensuring their deployment and use of the system complies with all applicable laws relating to the collection of children's personal information, including any obligations under the Privacy Act and relevant state surveillance laws.

Echidna does not knowingly collect personal information directly from children through its own channels (website, account registration, or support interactions). If you believe a child has provided personal information to Echidna directly, please contact us at privacy@echidnacams.com and we will take steps to delete it.

3. What Personal Information We Collect

3.1 Subscriber account information

When a business subscribes to our service, we collect:

Contact details: name, business name, email address, phone number, and postal address.
Billing and payment information: invoicing details and payment method records.
Account credentials: usernames and access credentials for the cloud portal.

Trade account applications: When a prospective subscriber submits a trade account application through our website, we collect the information provided in that form including organisation name, ABN, contact details, role, and intended use. This information is used solely to assess the application and, if approved, to establish the subscriber account.

3.2 System telemetry data

Echidna's deployed hardware transmits system health data to allow us to monitor device performance and provide support. This includes:

Battery levels and device status.
Signal strength and connectivity metrics.
GPS location of Echidna-owned hardware (Echidna Units and Burrows).

GPS data is used solely to support hardware recovery, maintenance, and deployment assistance. It does not provide access to, or represent, visual footage.

3.3 AI-derived insights (processed on behalf of subscribers)

Echidna's platform processes visual data captured by subscriber-deployed hardware to generate AI insights — for example, activity detections, alerts, and pattern analysis. These insights may relate to identifiable individuals and are therefore treated as personal information.

These insights are:

Owned by and accessible only to the subscriber.
Processed by Echidna on the subscriber's behalf, not for Echidna's own purposes.
Not accessed by Echidna staff unless the subscriber explicitly shares them for technical support purposes.
Retained for 30 days (Core tier) or 60 days (Enhanced tier) in accordance with the subscriber's service agreement, then permanently and automatically deleted.

3.4 Website data

When you visit our website, we may collect:

IP address, browser type, and operating system.
Pages visited, time on site, and referral source.
Cookie data (see Section 11).

3.5 Team member data

For Echidna employees and contractors, we collect information necessary for the employment relationship, including resumes, contracts, payroll records, and performance information. This is governed by applicable employment laws and is not covered in detail in this public-facing policy.

4. How We Use Personal Information

Echidna uses personal information only for the purpose for which it was collected, or a directly related purpose. The primary purposes are:

Delivering the service: To set up and manage subscriber accounts, provide access to the cloud portal, process billing, and provide technical support.

System performance: To monitor the health and performance of deployed Echidna hardware using system telemetry. This does not involve accessing subscriber footage.

Platform improvement: To use anonymised, aggregated system data (logs and performance metrics) to improve the Echidna platform. This data cannot identify subscribers or individuals.

Communications: To send service notices, updates, and — where consent has been given — marketing communications about Echidna's products.

Legal compliance: To meet our obligations under applicable law, respond to lawful requests from authorities, or enforce our agreements.

Employment: To manage the employment relationship with Echidna team members.

5. AI Analysis and Automated Processing

Echidna's platform uses artificial intelligence to analyse subscriber-captured visual data and generate alerts, detections, and reports. This is the core function of the service.

You should be aware of the following:

AI analysis may relate to identifiable individuals captured in footage. Echidna treats AI-generated insights as personal information.
AI outputs are decision-support tools only. They are not guaranteed to be accurate, complete, or suitable for use as evidence. Subscribers are responsible for all operational decisions made on the basis of AI outputs.
Echidna does not use subscriber footage or AI insights to train its models or develop its platform in a way that identifies individuals or discloses subscriber data.
Anonymised, aggregate system-level data (not footage or insights) may be used to improve Echidna's AI platform.

6. Sharing and Disclosure of Personal Information

Echidna does not sell personal information. We do not share personal information with third parties except in the following circumstances:

Cloud infrastructure providers: Subscriber data is stored on third-party cloud infrastructure located in Australia. These providers are bound by data processing agreements and are required to maintain appropriate security standards.

Payment processors: Billing information is processed by third-party payment providers. We do not store full payment card details.

Professional advisers: Lawyers, accountants, and insurers, where necessary and subject to confidentiality obligations.

Legal requirements: Where required by law, court order, or a lawful request from a government or regulatory authority. Where legally permitted, we will notify you before disclosing.

Business transfers: If Echidna is acquired or merges with another entity, personal information may be transferred as part of that transaction. We will notify affected individuals in advance where practicable.

Data storage location

All subscriber data — including account information, system telemetry, and AI-derived insights — is stored on cloud infrastructure located in Australia. Echidna does not transfer subscriber data outside Australia. If this changes, we will update this policy and notify affected subscribers before any transfer occurs.

Website and e-commerce transactions

If you make a purchase through the Echidna online store, your transaction data is processed by Shopify. Shopify operates globally and may transfer your e-commerce transaction data to servers located outside Australia. This is governed by Shopify's own privacy policy and data transfer mechanisms, not by this policy. SAaaS subscriber data is not processed through Shopify and remains stored in Australia as stated above.

7. How We Protect Personal Information

Echidna takes reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our security measures include:

Encrypted communications between deployed hardware and the cloud platform.
Unique device credentials — no universal default passwords on Echidna hardware.
System architecture designed to prevent Echidna staff from accessing subscriber footage without explicit subscriber consent.
Regular security updates to Echidna-owned hardware and software throughout the service term.
Access controls limiting internal access to personal information to staff who need it to perform their role.

No system is completely secure. If you become aware of a security vulnerability or suspected breach involving Echidna's hardware or platform, please notify us immediately at privacy@echidnacams.com.

8. Data Breaches

Echidna is subject to Australia's Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth).

If we have reasonable grounds to believe that an eligible data breach has occurred — meaning a breach that is likely to result in serious harm to one or more individuals — we will:

Assess the breach as quickly as practicable.
Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable.
Notify affected individuals (or, where that is not practicable, publish a public notice) as soon as practicable.

If a data breach involves subscriber-captured footage, Echidna will notify the affected subscriber promptly. Subscribers who are themselves APP entities may have independent notification obligations under the NDB scheme.

9. How Long We Keep Personal Information

Subscriber account data: Retained for the duration of the service agreement and for 7 years after the agreement ends, in accordance with general record-keeping obligations.

AI-derived insights and event data: Retained for 30 days (Core tier subscribers) or 60 days (Enhanced tier subscribers) from the date of capture, then permanently and automatically deleted. Data is also deleted 14 days after a service agreement ends. This deletion is automated and irreversible.

System telemetry: Retained for the duration of the service agreement and for a reasonable period after for support and dispute resolution purposes.

Website data: Retained in accordance with our analytics provider's standard retention settings, typically 26 months.

Team member data: Retained in accordance with applicable employment laws.

10. Accessing and Correcting Your Information

You have the right to request access to the personal information Echidna holds about you, and to request that inaccurate, incomplete, or outdated information be corrected.

To make a request, contact us at privacy@echidnacams.com. We will respond within 30 days. In some circumstances the Privacy Act permits us to refuse access or correction — if we do, we will explain why in writing.

Note for subscribers: Echidna does not hold your visual footage or AI-derived insights for its own purposes. If you need to access or correct data within your subscriber account, log in to the cloud portal or contact us for assistance.

Note for website visitors: Rights requests relating to data processed by Shopify through our online store should be directed to the Shopify Privacy Portal at privacy.shopify.com. Echidna does not control Shopify's processing of e-commerce transaction data.

11. Cookies and Tracking Technologies

Echidna's website uses cookies and similar tracking technologies to understand how visitors use the site and to improve the experience. Cookies may collect IP addresses, pages visited, and browsing behaviour on our site.

You can manage or disable cookies through your browser settings. Disabling cookies may affect some website functionality.

12. Direct Marketing

We may send marketing communications to subscribers and prospective customers about Echidna's products and services. We will only do this where we have your consent, or where we have an existing relationship with you and you have not opted out.

You can opt out at any time by using the unsubscribe link in any marketing email, or by contacting us at privacy@echidnacams.com.

13. Complaints

If you have a complaint about how Echidna has handled your personal information, please contact us first at privacy@echidnacams.com. We will acknowledge your complaint within 5 business days and respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au
Phone: 1300 363 992
Mail: GPO Box 5218, Sydney NSW 2001

14. Changes to This Privacy Policy

We may update this policy from time to time to reflect changes in our practices, our service, or our legal obligations. If we make a material change, we will notify subscribers by email and post the updated policy on our website. The updated policy takes effect on the date it is posted.

This policy is reviewed annually.