Privacy policy

1What we collect

• Your account: your name, email address, phone number, a password stored only as a secure hash, and the roles you hold in an organisation.
• Your organisation: sites, devices, users and permissions, and the settings you choose.
• Video and events: live video that passes through our relays, recordings, clips and snapshots you store with us, and events such as motion, offline and alarms.
• Device credentials: the logins for your cameras and recorders. These are kept on your LunaCam Box or agent. They are not kept in the cloud in plain form.
• Activity: an audit log of sign-ins, live views, playback, exports, PTZ moves, sharing and configuration changes.
• Your devices: push notification tokens, app version, device type and the network addresses we use to keep accounts secure.
• Billing: plan, invoices and payment records for paid accounts.

2How we use it

• To show you your cameras, play back recordings and send alerts.
• To keep accounts and sites secure and to investigate misuse.
• To provide the audit log, evidence and compliance features your organisation turns on.
• To bill paid accounts and keep the records the law requires.
• To support you when you ask us to.

We do not sell your data and we do not use your video to train models for anyone else.

3Where it is kept

Account data, video, snapshots, events, audit logs and backups are stored on servers in Nepal, and the processing runs on LunaCam-operated servers in Nepal. We do not transfer customer data across borders by default. Video also exists on your own recorders and on the box, which are outside our hosting.

4Who we share it with

• People in your organisation, as your roles and permissions allow.
• People you choose, through shares and links you create, which can expire.
• Police and courts, when the law requires it and the organisation that holds the footage has approved or been ordered to hand it over. Requests from foreign authorities are not served directly. They must come through Nepali legal channels.
• Service providers that run parts of the service, under written terms. A current list is available on request.

5How long we keep it

• Recordings follow your recording policy. Organisations covered by the Privacy Act, 2075 have a floor of 90 days.
• Footage under legal hold or in an open case is kept until the hold or case is closed.
• Events and snapshots attached to events: 12 months by default, set by the organisation.
• Audit log: 3 years.
• Billing records and invoices: 7 years.
• Backups: 14 days, then removed.
• Closed accounts: organisation data is removed within 30 days of closure, except data under a hold or a legal duty.

6Security

Video is encrypted in transit with TLS and, for live video, SRTP with DTLS. Data at rest is encrypted. Access to production is limited and logged. To report a vulnerability, write to security@lunacam.app.

7Your rights

You can ask us to give you your data, correct it or delete it. Write to info@ninjainfosys.com. Where footage belongs to an organisation, the request goes to that organisation, and we help it respond. We cannot delete data that is under a legal hold or that the law requires us to keep. See how to delete your account.

8Cameras and the people they record

If you operate cameras, you are responsible for lawful use: placing them, telling people where required, keeping and handing over footage as the law asks. LunaCam gives you tools for the notice, retention and delivery duties in the Privacy Act, 2075, but the duty stays with you.

9Changes

We will post changes here and change the date at the top. For material changes we will also tell account owners.