1. Data Controller & Processor roles
For your account data and this website: Legal entity: pending publication, Tax ID: pending publication, Registered address: pending publication. Contact: info@vizto.io.
For photographs uploaded by jobsite cameras: the client who installs the camera, or the professional agency providing the service, is the Data Controller. We process those photographs on their behalf as Data Processor, solely to provide the service and following their instructions.
2. What data we process
- Account data: name, email, company, country, phone number (if provided) and password (stored hashed and unreadable).
- Technical logs: IP address, browser user-agent and access timestamp in server logs, plus the session cookie when you log in.
- Jobsite photographs, which may incidentally capture individuals or license plates within the camera frame.
- Project metadata: project name, location coordinates and timezone.
3. Why we use your data
- To provide the service and manage your account (legal basis: performance of a contract).
- To send transactional service emails: invitations, password resets and camera offline alerts (legal basis: performance of a contract).
- To protect the platform and prevent abuse, such as rate-limiting repeated login attempts (legal basis: legitimate interest).
- To comply with legal and tax obligations (legal basis: legal obligation).
We never sell your data, never use it for third-party advertising, and do not make automated decisions that affect you.
4. Photographs capturing individuals
Jobsite cameras may capture workers or passers-by. The entity installing the camera, as Data Controller, must have a valid legal basis, inform affected individuals (for example, via on-site signage and worker notices), frame the camera to capture only the construction site, and avoid recording public roads beyond what is strictly unavoidable.
Projects are private by default: they are accessible only to users invited by the client or recipients of a shareable link.
If you appear in photographs of a construction site and wish to exercise your privacy rights, please contact the organization managing that site. If you do not know who manages it, email us and we will forward your request to them.
5. Subprocessors and recipients
We share data only with the infrastructure providers required to operate the service, under GDPR-compliant data processing agreements:
- Hetzner Online GmbH (Germany): cloud servers and encrypted backups in data centers located in Finland and Germany.
- Hostinger: transactional service email delivery.
- Open-Meteo: we query project coordinates to retrieve historical weather for each photograph. No personal data is sent to Open-Meteo.
If you access the platform through a white-label partner’s domain, that partner also has access to your account and project data. We only disclose data to public authorities when legally required.
6. Where data is stored
On servers located within the European Union (Finland and Germany). Should any provider process data outside the European Economic Area, it will do so under GDPR safeguards such as European Commission Standard Contractual Clauses.
7. How long we retain data
- Account data: while your account remains active. Upon cancellation we delete it, except for records we must keep by law (such as invoices) for the statutory retention period.
- Photographs and videos: while the camera or project is active or in archive mode. After cancellation we retain them for 30 days in case you need recovery, after which they are deleted.
- Technical security logs: kept for a few weeks as needed to protect the service.
- Backups: rotated continuously; deleted data is purged from all backups within a maximum of 30 days.
8. Your GDPR rights
You have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability. Email us at info@vizto.io and we will respond within one month.
If you believe your data has not been handled properly, you may lodge a complaint with your national data protection authority. In Spain, this is the Agencia Española de Protección de Datos (www.aepd.es).
9. How we protect your data
Encrypted connections (HTTPS), hashed passwords, login rate-limiting, firewalls, restricted server access and daily encrypted offsite backups.
10. Changes to this policy
If we make material changes to this policy, we will notify you by email or within the platform.
Have any questions?
Send us an email and we will get back to you.