Privacy Policy Version 2.1 | Last updated: August 2026

1           Purpose

Echidna Cams Pty Ltd (Echidna, we, us) is committed to handling personal information responsibly and in accordance with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs).

This policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights in relation to it. We use plain English throughout.

If you have any questions about this policy or how we handle your information, contact us at privacy@echidnacams.com

 

Important: Echidna's role in the surveillance system Echidna provides a visual data capture and AI analysis platform. When subscribers deploy Echidna's system, they, not Echidna, are responsible for collecting and managing visual surveillance footage. Echidna acts as a technology platform provider and data processor, not as the primary data controller for subscriber-captured footage. This means: •     Subscribers own and control their footage and are responsible for lawful collection and use. •     Echidna processes AI-derived insights on behalf of subscribers but does not hold or access raw footage unless the subscriber explicitly shares it with us. •     Echidna is the data controller only for information it collects directly, such as subscriber account details, system telemetry, and website data.

 

2         Who and What This Policy Covers

This policy applies to personal information collected by Echidna in three contexts:

Subscriber accounts

Contact names, email addresses, billing details, and account credentials collected when a business subscribes to the Echidna service.

 

System telemetry

Device health data collected by Echidna from deployed hardware — including battery levels, signal strength, and GPS location of Echidna-owned devices. This data relates to the device, not to individuals captured in footage.

 

Website visitors

Technical data collected when people visit echidnacams.com, including IP addresses, browser type, and usage analytics.

 

Team members

Employment-related information for Echidna staff, including resumes, payroll, and performance information.

 

Subscriber-captured footage

Visual surveillance footage captured by subscribers using Echidna's hardware. Echidna does not collect or hold this footage. The subscriber is the data controller. Echidna processes AI-derived insights from this footage on the subscriber's behalf, in accordance with the subscriber's Service & Licence Agreement.

 

This policy does not apply to GDPR (European Union) or CCPA (California) frameworks. Echidna currently operates in Australia only. We will update this policy when and if we expand to jurisdictions requiring compliance with those frameworks.

This policy and our website privacy policy This policy applies to the Echidna SAaaS platform and Echidna's direct business relationships with subscribers, team members, and business contacts. If you visit our website or make a purchase through our online store, a separate privacy policy governs that interaction. Our website is hosted by Shopify, and Shopify's data practices, including international data transfers associated with e-commerce transactions, are governed by the website privacy policy published at echidnacams.com and by Shopify's own Consumer Privacy Policy. Rights requests relating to website transaction data should be directed through the Shopify Privacy Portal. If you are both a website visitor and a SAaaS subscriber, both policies apply to their respective contexts. Where there is any conflict, this policy governs in relation to the SAaaS platform.

 

Footage involving children Echidna's surveillance system may be deployed in locations where children are present — for example, school campuses, retail premises, public spaces, or residential properties. In these circumstances, footage and AI-derived insights may capture images of children. Echidna does not collect or control this footage. The subscriber is the data controller and is solely responsible for ensuring their deployment and use of the system complies with all applicable laws relating to the collection of children's personal information, including any obligations under the Privacy Act and relevant state surveillance laws. Echidna does not knowingly collect personal information directly from children through its own channels (website, account registration, or support interactions). If you believe a child has provided personal information to Echidna directly, please contact us at privacy@echidnacams.com and we will take steps to delete it.

 

3         What Personal Information We Collect

3.1          Subscriber account information

When a business subscribes to our service, we collect:

•     Contact details: name, business name, email address, phone number, and postal address.

•     Billing and payment information: invoicing details and payment method records.

•     Account credentials: usernames and access credentials for the cloud portal.

•     Trade account applications: When a prospective subscriber submits a trade account application through our website, we collect the information provided in that form including organisation name, ABN, contact details, role, and intended use. This information is used solely to assess the application and, if approved, to establish the subscriber account.

3.2         System telemetry data

Echidna's deployed hardware transmits system health data to allow us to monitor device performance and provide support. This includes:

•     Battery levels and device status.

•     Signal strength and connectivity metrics.

•     GPS location of Echidna-owned hardware (Echidna Units and Burrows).

GPS data is used solely to support hardware recovery, maintenance, and deployment assistance. It does not provide access to, or represent, visual footage.

3.3        AI-derived insights (processed on behalf of subscribers)

Echidna's platform processes visual data captured by subscriber-deployed hardware to generate AI insights — for example, activity detections, alerts, and pattern analysis. These insights may relate to identifiable individuals and are therefore treated as personal information.

These insights are:

•     Owned by and accessible only to the subscriber.

•     Processed by Echidna on the subscriber's behalf, not for Echidna's own purposes.

•     Not accessed by Echidna staff unless the subscriber explicitly shares them for technical support purposes.

•     Retained for 30 days (Core tier) or 60 days (Enhanced tier) in accordance with the subscriber's service agreement, then permanently and automatically deleted.

3.4        Biometric information (face matching — Enhanced tier only)

Where a subscriber enables face matching (an Enhanced-tier, opt-in feature), Echidna’s platform generates a biometric template from faces detected in event footage. This is sensitive information under APP 3 of the Privacy Act, and is only processed with the subscriber’s explicit opt-in.

What we do:

•     The system converts a detected face into a protected, irreversible template using a cancelable biometrics transform (aligned to ISO/IEC 24745). The template cannot be reversed back into a face image.

•     Raw face images and unprotected biometric data are never stored or retained.

•     Templates can be revoked and reissued at any time; revoking immediately invalidates all previously generated templates for that subject.

•     Templates are retained under the same tenant retention policy as other derived data (see Section 9) and are deleted on the same automated schedule.

Face matching is a decision-support tool, not a means of legal identification, and is not relied upon as sole evidence of identity.

3.5        Website data

When you visit our website, we may collect:

•     IP address, browser type, and operating system.

•     Pages visited, time on site, and referral source.

•     Cookie data (see Section 9).

3.6        Team member data

For Echidna employees and contractors, we collect information necessary for the employment relationship, including resumes, contracts, payroll records, and performance information. This is governed by applicable employment laws and is not covered in detail in this public-facing policy.

4        How We Use Personal Information

Echidna uses personal information only for the purpose for which it was collected, or a directly related purpose. The primary purposes are:

Delivering the service

To set up and manage subscriber accounts, provide access to the cloud portal, process billing, and provide technical support.

 

System performance

To monitor the health and performance of deployed Echidna hardware using system telemetry. This does not involve accessing subscriber footage.

 

Platform improvement

To use anonymised, aggregated system data (logs and performance metrics) to improve the Echidna platform. This data cannot identify subscribers or individuals.

 

Communications

To send service notices, updates, and — where consent has been given — marketing communications about Echidna's products.

 

Legal compliance

To meet our obligations under applicable law, respond to lawful requests from authorities, or enforce our agreements.

 

Employment

To manage the employment relationship with Echidna team members.

5         AI Analysis and Automated Processing

Echidna's platform uses artificial intelligence to analyse subscriber-captured visual data and generate alerts, detections, and reports. This is the core function of the service.

You should be aware of the following:

·         AI analysis may relate to identifiable individuals captured in footage. Echidna treats AI-generated insights as personal information.

·         AI outputs are decision-support tools only. They are not guaranteed to be accurate, complete, or suitable for use as evidence. Subscribers are responsible for all operational decisions made on the basis of AI outputs.

·         Echidna does not use subscriber footage or AI insights to train its models or develop its platform in a way that identifies individuals or discloses subscriber data.

·         Anonymised, aggregate system-level data (not footage or insights) may be used to improve Echidna's AI platform.

6         Sharing and Disclosure of Personal Information

Echidna does not sell personal information. We do not share personal information with third parties except in the following circumstances:

Cloud infrastructure providers

Subscriber data is stored on third-party cloud infrastructure located in Australia. These providers are bound by data processing agreements and are required to maintain appropriate security standards.

 

Payment processors

Billing information is processed by third-party payment providers. We do not store full payment card details.

 

Professional advisers

Lawyers, accountants, and insurers, where necessary and subject to confidentiality obligations.

 

Legal requirements

Where required by law, court order, or a lawful request from a government or regulatory authority. Where legally permitted, we will notify you before disclosing.

 

Business transfers

If Echidna is acquired or merges with another entity, personal information may be transferred as part of that transaction. We will notify affected individuals in advance where practicable.

 

Data storage location All subscriber data — including account information, system telemetry, and AI-derived insights — is stored on cloud infrastructure located in Australia. Echidna does not transfer subscriber data outside Australia. If this changes, we will update this policy and notify affected subscribers before any transfer occurs.

 

Website and e-commerce transactions If you make a purchase through the Echidna online store, your transaction data is processed by Shopify. Shopify operates globally and may transfer your e-commerce transaction data to servers located outside Australia. This is governed by Shopify's own privacy policy and data transfer mechanisms, not by this policy. This clarification applies only to website and store transactions. SAaaS subscriber data is not processed through Shopify and remains stored in Australia as stated above.

 

7          How We Protect Personal Information

Echidna takes reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our security measures include:

·         Encrypted communications between deployed hardware and the cloud platform.

·         Unique device credentials — no universal default passwords on Echidna hardware.

·         System architecture designed to prevent Echidna staff from accessing subscriber footage without explicit subscriber consent.

·         Regular security updates to Echidna-owned hardware and software throughout the service term.

·         Access controls limiting internal access to personal information to staff who need it to perform their role.

No system is completely secure. If you become aware of a security vulnerability or suspected breach involving Echidna's hardware or platform, please notify us immediately at privacy@echidnacams.com.

8         Data Breaches

Echidna is subject to Australia's Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth).

If we have reasonable grounds to believe that an eligible data breach has occurred, meaning a breach that is likely to result in serious harm to one or more individuals, we will:

·         Assess the breach as quickly as practicable.

·         Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

·         Notify affected individuals (or, where that is not practicable, publish a public notice) as soon as practicable.

If a data breach involves subscriber-captured footage, Echidna will notify the affected subscriber promptly. Subscribers who are themselves APP entities may have independent notification obligations under the NDB scheme.

9         How Long We Keep Personal Information

Subscriber account data

Retained for the duration of the service agreement and for 7 years after the agreement ends, in accordance with general record-keeping obligations.

 

AI-derived insights and event data

Retention varies by data type and subscriber tier (video, stills, derived frames, and reports each have separate schedules) and is set out in full in Echidna's Data Safety & Sovereignty Statement, available on request or at echidnacams.com. All retained data is deleted automatically and irreversibly at the end of its retention period, and no later than 14 days after a service agreement ends.

 

Biometric templates (Enhanced tier, face matching only)

Retained under the same schedule as other derived data for the subscriber’s tier, then permanently and automatically deleted. Revoking a template invalidates it immediately regardless of the retention schedule.

 

System telemetry

Retained for the duration of the service agreement and for a reasonable period after for support and dispute resolution purposes.

 

Website data

Retained in accordance with our analytics provider's standard retention settings, typically 26 months.

 

Team member data

Retained in accordance with applicable employment laws.

10     Accessing and Correcting Your Information

You have the right to request access to the personal information Echidna holds about you, and to request that inaccurate, incomplete, or outdated information be corrected.

To make a request, contact us at privacy@echidnacams.com. We will respond within 30 days. In some circumstances the Privacy Act permits us to refuse access or correction — if we do, we will explain why in writing.

Note for subscribers: Echidna does not hold your visual footage or AI-derived insights for its own purposes. If you need to access or correct data within your subscriber account, log in to the cloud portal or contact us for assistance.

Note for website visitors: Rights requests relating to data processed by Shopify through our online store should be directed to the Shopify Privacy Portal at privacy.shopify.com. Echidna does not control Shopify's processing of e-commerce transaction data.

11        Cookies and Tracking Technologies

Echidna's website uses cookies and similar tracking technologies to understand how visitors use the site and to improve the experience. Cookies may collect IP addresses, pages visited, and browsing behaviour on our site.

You can manage or disable cookies through your browser settings. Disabling cookies may affect some website functionality.

12      Direct Marketing

We may send marketing communications to subscribers and prospective customers about Echidna's products and services. We will only do this where we have your consent, or where we have an existing relationship with you and you have not opted out.

You can opt out at any time by using the unsubscribe link in any marketing email, or by contacting us at privacy@echidnacams.com.

13      Complaints

If you have a complaint about how Echidna has handled your personal information, please contact us first at privacy@echidnacams.com. We will acknowledge your complaint within 5 business days and respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

·         Website: www.oaic.gov.au

·         Phone: 1300 363 992

·         Mail: GPO Box 5218, Sydney NSW 2001

14     Changes to This Privacy Policy

We may update this policy from time to time to reflect changes in our practices, our service, or our legal obligations. If we make a material change, we will notify subscribers by email and post the updated policy on our website. The updated policy takes effect on the date it is posted.

This policy is reviewed annually.