Privacy Policy

This Privacy Policy ("Policy") describes how SENSORAP LLC ("SENSORAP", "Company", "we", "us", or "our") collects, uses, stores, discloses, and protects information about you when you access or use our physical-world intelligence platform, including our web application, API services, device management infrastructure, analytics dashboards, and associated services (collectively, the "Services").

SENSORAP operates as a B2B enterprise platform whose primary function is processing operational sensor data — including environmental, asset, and facility data — on behalf of our corporate clients ("Customers"). When we process data on behalf of a Customer, we act as a data processor and that Customer acts as the data controller. This Policy governs both our role as a controller of our own platform user data and as a processor of Customer operational data.

By accessing or using the Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please do not use our Services.

We collect information in multiple ways: information you provide directly, information collected automatically during Service use, data transmitted by connected physical sensors and devices, and information from third-party sources where applicable.

• Account Registration Data: Name, business email address, job title, company name, phone number, billing address, and payment information when you create or manage an account.
• Platform Usage Data: Dashboard interactions, feature usage patterns, configuration changes, alert acknowledgments, workflow executions, and session activity logs.
• Technical Data: IP addresses, browser type and version, operating system, device identifiers, time zone settings, access timestamps, and referring URLs.
• Communications: Messages, support tickets, feedback, and inquiries submitted through the platform or via email.
• Sensor and Device Data: Telemetry, state data, and environmental readings from all hardware devices and sensors registered to your account.

The core of our platform is the collection, storage, and processing of telemetry, state, and environmental data from physical sensors and connected hardware devices. This data is central to service delivery and may include:

• Environmental Metrics: Temperature, humidity, air quality (CO2, VOC, particulate matter), atmospheric pressure, light levels, and sound levels.
• Asset and Machine Metrics: Vibration levels, power consumption (kW), operational state (on/off/idle), runtime hours, heat signatures, and equipment error codes.
• Occupancy and Movement Data: Motion detection events, people-counting data, foot traffic patterns, zone dwell times, and facility utilization rates.
• Energy and Utility Data: Electrical consumption across circuits, water flow rates, gas usage metrics, and HVAC performance readings.
• Device Metadata: MAC addresses, IP addresses, firmware versions, battery charge levels, wireless signal strength (RSSI), and real-time connectivity status.
• Location and Zone Data: Physical GPS or BLE installation coordinates, floor-level zone assignments, and real-time asset tracking positions.
• Event Timelines: Chronological records of detected events (temperature spikes, door open events, machine anomalies, device offline events) and associated workflow actions taken.

All sensor and operational data collected via the platform remains the property of the Customer. SENSORAP processes this data solely as a data processor and only to the extent necessary to deliver the contracted Services.

Customers may upload or configure digital representations of their physical environments within SENSORAP. This can include building floor plans, facility zone and room maps, equipment layout diagrams, organizational unit hierarchies, asset registers, sensor placement records, and maintenance schedule data. All such information is classified as confidential Customer Data and is subject to the confidentiality and security provisions of the applicable Customer service agreement.

SENSORAP uses collected information for the following clearly defined purposes:

• Service Delivery: To provision, operate, and maintain the platform, including real-time monitoring dashboards, intelligent alert engines, predictive analytics, and automated operational workflows.
• Account Management: To create and manage your account, process billing and payments, and communicate critical account-related information including renewal notices and service updates.
• Technical Support: To respond to support requests, diagnose and troubleshoot technical issues, and deliver onboarding, training, and professional services.
• Platform Intelligence and Improvement: To analyze usage patterns and platform telemetry, identify feature opportunities, conduct quality assurance, and develop new platform capabilities.
• Security and Fraud Prevention: To monitor for unauthorized access attempts, detect anomalous platform activity, and protect the integrity of connected sensor infrastructure and Customer data.
• Legal and Regulatory Compliance: To meet applicable legal obligations, enforce our contractual terms, respond to lawful government requests, and establish or defend legal claims.
• Communications: To send product release notes, technical notices, security advisories, and — where you have provided appropriate consent — commercial communications about new features or service expansions.

For users located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process personal data under the following lawful bases as defined by the General Data Protection Regulation (GDPR):

• Contractual Necessity (Article 6(1)(b)): Processing required to fulfill obligations under your service agreement, including operating the platform, billing, providing support, and delivering core Service functionality.
• Legitimate Interests (Article 6(1)(f)): Processing for our legitimate business interests such as security monitoring, fraud prevention, platform analytics, and product improvement, provided these are not overridden by your fundamental rights and freedoms.
• Legal Obligation (Article 6(1)(c)): Processing necessary to comply with applicable laws, regulations, or binding judicial or administrative orders.
• Consent (Article 6(1)(a)): Where you have provided explicit, freely given consent to specific processing activities, such as receiving marketing emails. You may withdraw consent at any time without affecting the lawfulness of prior processing.

SENSORAP does not sell, rent, or trade your personal information or Customer Data. We may disclose information in the following limited, controlled circumstances:

• Authorized Sub-Processors: Vetted third-party vendors who process data on our behalf to provide cloud infrastructure (hosting, storage), payment processing, customer support tooling, security monitoring, and platform analytics. All sub-processors are bound by strict data processing agreements that prohibit any use of data beyond the agreed scope.
• Business Transfers: In connection with a merger, acquisition, corporate restructuring, financing event, or sale of company assets, where Customer and user data may be transferred as part of the business. Affected parties will be notified prior to any such transfer and given the opportunity to exercise applicable rights.
• Legal and Regulatory Compliance: Where required by applicable law, court order, regulatory directive, or governmental authority. We will, where legally permissible, notify the affected Customer before disclosing their data to a government body.
• Protection of Rights: Where disclosure is reasonably necessary to protect the legal rights, property, or safety of SENSORAP, our employees, customers, or the public.
• With Your Explicit Consent: For any purpose not described in this Policy, where you have provided prior explicit consent for the specific sharing activity.
• Aggregated and Anonymized Reports: We may publish or share aggregated, de-identified, and statistically anonymized data that cannot reasonably be used to identify any individual or organization, for purposes including industry research, benchmarking reports, or platform capability demonstrations.

SENSORAP retains personal account information and platform configuration data for as long as your account remains active or as necessary to provide the Services. Sensor telemetry and operational event data is retained in accordance with the data retention period configured by the Customer within the platform (typically ranging from 90 days to 3 years), subject to the default retention schedule defined in your service agreement.

Upon expiration or termination of your service subscription, all Customer Data is made available for self-service export for a period of 30 calendar days. After this period, data is permanently and securely deleted from all active systems using industry-standard data destruction procedures. Anonymized or aggregated records derived from Customer Data may be retained indefinitely in a form that cannot identify any individual or organization. Certain records may be retained longer where required by applicable law or regulatory obligation.

Security is foundational to the SENSORAP platform. We implement a multi-layered security program covering infrastructure, application, network, and operational domains:

• Encryption in Transit: All data transmitted between connected sensor devices, client applications, and our backend infrastructure is encrypted using TLS 1.2 or higher.
• Encryption at Rest: All Customer Data stored within our infrastructure is encrypted using AES-256 symmetric encryption.
• Access Control: Granular Role-Based Access Control (RBAC) ensures users only access data relevant to their assigned permissions. Multi-Factor Authentication (MFA) is enforced for all administrative accounts.
• Device Authentication: Every physical sensor or gateway connecting to the SENSORAP platform must authenticate using unique cryptographic device credentials. Unauthorized or unregistered devices are automatically rejected at our ingress gateways.
• Continuous Monitoring: Our infrastructure is subject to 24/7 security monitoring, automated intrusion detection, and real-time threat alerting.
• Audit Logging: All platform access, configuration changes, data exports, and administrative actions are recorded in immutable audit logs, which can be reviewed by authorized Customer administrators.
• Third-Party Assessments: We engage independent security firms to conduct regular penetration testing and vulnerability assessments of the platform.
• Incident Response: We maintain a documented incident response plan. In the event of a data breach affecting your personal information, we will notify you in accordance with applicable law.

Depending on your jurisdiction and applicable law, you may have the following rights with respect to your personal data. To exercise any of these rights, contact us at the address provided at the end of this Policy. We will acknowledge your request within 5 business days and respond fully within 30 calendar days.

• Right of Access: Request confirmation of whether we hold personal data about you, and receive a copy of that data in a commonly used format.
• Right to Rectification: Request correction of inaccurate, incomplete, or outdated personal data we hold about you.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format, and transmit that data to another controller where technically feasible.
• Right to Object: Object to processing of your personal data where it is based on legitimate interests or for direct marketing purposes.
• Right to Restriction: Request that we temporarily restrict processing of your data while a dispute regarding accuracy or legitimate grounds is being resolved.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority if you believe your privacy rights have been violated.

SENSORAP operates as a global platform and your data may be transferred to, stored in, and processed in countries other than your country of residence, including the United States. Where personal data originating from the EEA, UK, or Switzerland is transferred to countries that have not received an adequacy decision from the European Commission, we ensure appropriate legal safeguards are in place, including Standard Contractual Clauses (SCCs) as approved by the European Commission, Binding Corporate Rules where applicable, or other legally recognized transfer mechanisms.

Our Services are designed exclusively for business use by corporate entities and professional users. We do not knowingly collect personal information from individuals under the age of 16. If we become aware that a minor has submitted personal information through our platform, we will take prompt steps to delete such information. If you believe a minor has provided us with personal data, please contact us immediately.

We reserve the right to update this Privacy Policy at any time to reflect changes in our business practices, legal requirements, regulatory guidance, or platform capabilities. Material changes will be communicated by posting the updated Policy on our website with a revised "Last Updated" date, and where appropriate, by direct notification to registered users via email or an in-platform notification banner. Your continued use of the Services after the effective date of a revised Policy constitutes your acceptance of the changes. If you do not agree with the updated Policy, you must discontinue use of the Services.

For any questions, concerns, or requests related to this Privacy Policy, our data practices, or the exercise of your privacy rights, please contact our Data Protection team:

SENSORAP LLC — Privacy & Data Protection
Email: support@sensorap.com
Subject Line: Privacy Policy Inquiry