Global Privacy Policy & Zero-Persistence Architecture.

§ 1.0Scope, Entity & Dual-Role Architecture

This Global Privacy Policy ("Policy") explains how Chkdin ("Chkdin AI", "we", "us" or "our") handles personal data. It applies to two distinct operational domains, and our legal role differs between them.

(A) Corporate & Digital Properties (chkdin.com/ai)

For visitors to our website and for business contacts who submit procurement inquiries, demo requests or technical briefing requests, Chkdin acts as the Data Controller (or "Data Fiduciary" under India's DPDP Act). Sections 4, 5, 7, 9 and 10 describe this processing in detail.

(B) Edge-Native Physical Intelligence Suite

For Vision Secure, Vision Venue, Vision Miles and Vision Event, Chkdin supplies air-gapped hardware and software that is deployed exclusively within the client's own infrastructure. In this domain Chkdin acts strictly as an On-Premise Technology Provider, and, where Chkdin personnel provide installation or support services, as a Data Processor or sub-processor acting on the documented instructions of the client. The client organization is the Data Controller for all data processed by its deployment.

§ 2.0Volatile Memory Processing & Zero-Persistence Biometric Architecture

Chkdin edge systems are engineered on a privacy-by-design basis. The following controls are built into the architecture of every deployment.

• No persistent video recording. Chkdin AI edge nodes do not function as DVR or NVR surveillance recorders. Raw optical frames are ingested into isolated volatile RAM buffers, evaluated by the Proprietary Low-Latency Vision-AI Engine in under 10 ms, and overwritten (zeroized) within 50 ms. No raw video or image frames are written to persistent storage.
• One-way mathematical vectors. Where a Data Controller enables authorized 1:N identity matching (for example, garrison access control or VIP event clearance), facial geometry is converted into a one-way mathematical embedding bound to a Hardware-Enclave Cryptographic Key. The original image is not stored and is not designed to be reconstructable from the vector.
• Anonymous spatial telemetry. In crowd counting and spatial heatmap modes (Vision Venue and Vision Event), the system processes non-identifying bounding-box coordinates (X, Y spatial vectors) without extracting facial features, so no identity data is generated in these modes.

§ 3.0Air-Gapped Sovereignty & Zero External Data Transfer

Chkdin AI edge nodes are designed to operate in 100% air-gapped, zero-cloud configurations, executing all computation on client-owned hardware inside the client's facility.

Chkdin has no remote backdoor access to deployed systems, ingests no cloud telemetry from them, and has no visibility into biometric templates, access logs or optical feeds processed on client-owned edge hardware. Any on-site or remote support access is provided only when the client grants it, for the duration and purpose the client approves.

§ 4.0Categories of Personal Data Collected (Corporate Portal)

We collect personal data through chkdin.com/ai only when you choose to interact with it.

• Professional contact data: name, rank or title, institutional email address, direct phone or WhatsApp number, organization category, products of interest and deployment specifications that you submit through our Contact or Request Demo forms.
• Technical and security logs: strictly necessary server logs (such as IP address, browser type and request time), rate-limiting metadata and anti-abuse signals used to protect the portal from automated and malicious traffic.
• No behavioral ad tracking: we do not sell, rent, trade or otherwise monetize visitor data, and we do not use third-party cross-site advertising trackers.

Service providers we rely on

To operate the portal securely we use a small number of service providers, each processing data only for the purpose stated:

• Google reCAPTCHA - to distinguish human visitors from bots when a form is submitted. It may collect device and interaction data and set cookies, subject to Google's privacy policy.
• Transactional email delivery (Mandrill by Mailchimp) - to deliver your form submission to our team's inbox.
• Google Fonts - to display the website's typefaces; your browser requests font files from Google's servers.
• Website analytics (if enabled) - aggregate, IP-anonymized usage statistics to understand how the site is used.

§ 5.0Lawful Bases for Processing

• Contractual necessity and pre-contractual steps - responding to RFPs and inquiries, executing Mutual NDAs and scoping hardware trials at your request (GDPR Art. 6(1)(b)).
• Legitimate interests - securing our infrastructure, preventing fraudulent or abusive inquiries, and following up on business inquiries you initiate (GDPR Art. 6(1)(f)).
• Consent - where you submit a form, you consent to be contacted about that request. Under India's DPDP Act, processing of your inquiry data relies on your consent or on the legitimate uses permitted by the Act. You may withdraw consent at any time (see § 10.0).
• Client-deployed systems - for on-premise edge deployments, the enterprise or institutional Data Controller determines and documents the applicable lawful basis (such as explicit consent, an employment or workplace-safety obligation, or a statutory or national-security authorization) before enrolling any person.

§ 6.0Global Regulatory Alignment Matrix

The table below summarizes how the Chkdin architecture is designed to support the obligations of Data Controllers under major privacy frameworks. Final compliance for any deployment depends on how the Data Controller configures and operates it.

§ 7.0Data Retention & Cryptographic Erasure Protocols

• Edge optical buffers: overwritten within 50 ms; 0 KB of raw frames retained on disk.
• Authorized enclave databases: stored only on client-controlled local hardware, for the period defined by the Data Controller's active roster, and purged when a person's badge or access is revoked.
• Corporate procurement inquiries: retained only for the duration of active commercial evaluation, any NDA term, or a statutory or audit requirement, after which they are permanently deleted.
• Security logs: retained for a limited period necessary to detect and investigate abuse, then deleted or anonymized.

§ 8.0Hardware-Enclave & Cryptographic Security Safeguards

• Hardware-Enclave Cryptographic Binding designed to prevent extraction of identity vectors if a physical edge unit is removed or tampered with.
• Encrypted local mesh communication between nodes over isolated facility VLANs.
• Role-Based Access Control (RBAC) and tamper-evident local audit logs for administrative actions.
• Encryption in transit (HTTPS/TLS) for all data submitted through chkdin.com/ai.

No method of transmission or storage is completely secure. If we become aware of a personal data breach affecting data we control, we will notify affected individuals and regulators as required by law.

§ 9.0Cross-Border Data Transfers

Air-gapped edge deployments: no cross-border data transfer occurs, because all computation remains physically within the client's sovereign facility.

Corporate inquiries: inquiry data is handled by our operations team in India and by the service providers listed in § 4.0, some of which may process data in other countries. Where personal data from the EU, UK or other regulated regions is transferred, we rely on appropriate safeguards such as Standard Contractual Clauses, together with encryption in transit.

§ 10.0Global Data Subject Rights & Exercise Procedures

Depending on where you live, you may have the right to access, rectify, erase ("right to be forgotten"), restrict or object to the processing of your personal data, to data portability, to withdraw consent, and, under the DPDP Act, to nominate another person to exercise your rights and to seek grievance redressal.

• Data held by Chkdin (website and inquiries): email contact@chkdin.com. We will verify your identity and respond within the period required by applicable law.
• Data processed on a client's edge deployment: please direct your request to the facility, employer or event organizer that operates the system, as they are the Data Controller. Chkdin will provide them with the technical support needed to fulfil access and erasure requests.

You also have the right to lodge a complaint with your local data protection authority.

§ 11.0Automated Decision-Making & Human-in-the-Loop Safeguards

Vision Secure and Vision Event perform deterministic identity and permit matching against rosters approved by the Data Controller. These systems are designed to operate with real-time oversight by security personnel ("human-in-the-loop") at physical gates and command consoles, who handle exceptions, review alerts and can override automated outcomes. Chkdin does not use deployment data to build profiles or make decisions about individuals for its own purposes.

§ 12.0Data Protection Officer (DPO) & Regulatory Contact

For any question about this Policy or to exercise your rights, contact:

Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top shows when it was last revised. Material changes will be highlighted on this page.