Surveillance, Audio and Biometric Terms

Version: 12 November 2026.

1. Scope and relationship to other terms

These terms apply when you use Performance Hub Inc's services or connected devices for video surveillance, cloud recording, audio capture, transcription, facial recognition, biometric matching, search or related analytics. They supplement the Customer Terms, including their definitions, liability provisions and dispute procedures. They apply to cloud, on-premises and hybrid deployments.

The Data Processing Addendum governs our processing of personal data on your behalf and prevails on that subject; mandatory international transfer terms prevail where applicable. The AI, Model Router and Agent Terms, Acceptable Use Policy and applicable Order also apply. Our Privacy Policy and Biometric Data Policy explain our own relevant processing. They do not replace the notices and policies you must give people whose information you collect.

For personal data you collect or cause to be processed through these features, you act as the controller or equivalent, or as an authorised processor acting for a controller, according to the actual arrangement. This can include data about employees, contractors, customers, visitors and other individuals. Where you act for another controller, you must have authority to issue the relevant instructions and appoint us. We act as processor or subprocessor, as applicable, for processing on your behalf under the Data Processing Addendum; we may separately act as controller for our own business operations described in the Privacy Policy. Actual activities and applicable law determine the roles. Your responsibilities below concern your purposes, instructions, configurations, premises and other matters within your control. They do not transfer our own statutory or contractual obligations to you or restrict any individual's rights against either party.

2. Lawful deployment

Before enabling a feature, you must establish that its intended use is lawful in every relevant jurisdiction. You must have authority to use the premises, devices, accounts and information involved, identify the purpose of each processing activity, and obtain any required permissions, licences, consents or other lawful basis. Technical availability, a subscription or our acceptance of an Order is not legal approval of your deployment.

You must assess the necessity and proportionality of surveillance, limit its coverage and sensitivity, and complete any required privacy, biometric, employment or AI impact assessment and consultation. Position cameras and microphones to avoid unnecessary capture of neighbouring property, public areas and private activities. Do not use the services for covert surveillance or monitoring in toilets, changing rooms or similarly private spaces except where the particular activity is expressly lawful and permitted under the Acceptable Use Policy.

Your assessment must cover employees, contractors, members, customers, visitors, children and other people who may be captured, including people who never create an account or agree to your membership terms. A person's presence on your premises does not itself establish valid consent.

3. Notices, audio and transcripts

You must provide notices at the time and in the form required by law, including appropriate signage and accessible information identifying the operator, purposes, categories of information, recipients, retention and rights contact. Explain material changes in use before starting them. Provide information in a language and form people can understand where required, regardless of the language of these terms.

Assess audio separately from video. Permission to record video does not automatically authorise recording conversations, creating transcripts, identifying speakers, searching speech or transmitting recordings to an AI provider. Before enabling these activities, satisfy applicable interception, recording, workplace and privacy requirements, including consent from the required participants where the law requires it. Keep audio disabled where you cannot meet those requirements.

Your notices must accurately explain any transcription, searchable speech, AI analysis, agent access and external processing you enable. Limit captured conversations and access to transcripts to what your documented purpose requires. Transcripts can expose sensitive information even when the underlying conversation appears routine; their retention and disclosure require separate consideration.

4. Facial recognition and other biometric processing

Before enrolling a person or enabling biometric identification, verification, tracking or matching, you must establish the lawful basis and any additional conditions for that processing. Where required, provide prior written information about the purpose and duration, obtain a valid written or electronic release or explicit consent, and retain evidence. Where the law requires a practical non-biometric alternative or withdrawal mechanism, you must provide it.

These duties can apply to face templates and embeddings, named profiles, watchlists and unnamed or "shadow" profiles that distinguish or recognise individuals. Removing a name does not necessarily anonymise a profile. They can also apply to speaker-identification features where enabled. An unsuccessful match, short processing time or local deployment does not by itself remove these duties.

You must keep enrolment records and watchlists accurate, restrict who can add or change them, and reassess continued inclusion. Do not create a biometric database by indiscriminately scraping images or footage, sell biometric identifiers, or use the services for a prohibited biometric purpose. Sharing profiles across locations, customers or systems requires its own lawful authority and appropriate safeguards.

For example, applicable United States biometric laws can require prior written notice and release and a public retention and destruction policy. Applicable Australian privacy law generally requires consent and reasonable necessity for collection of sensitive biometric information unless an exception applies. UK and EEA use can require both an ordinary lawful basis and an additional condition for biometric identification. These examples do not exhaust local requirements.

5. Review of matches, analytics and decisions

Video detections, identity matches, transcripts, translations, alerts, summaries and search results can be incomplete or wrong. Lighting, camera placement, sound quality, accents, environmental conditions, configuration and model limitations can affect results. A confidence score is not proof of identity, conduct or accuracy.

You must arrange review by a suitably authorised person before relying on an output for a consequential decision, including an accusation, disciplinary action, denial of essential services or referral to law enforcement. Verify the underlying material and relevant context. Do not assume that an absent alert or search result proves that an event did not occur.

Do not use the services for prohibited discrimination, sensitive biometric categorisation, unlawful emotion inference, or a legally restricted automated decision. A use classified as high risk or otherwise regulated must not begin unless you have satisfied the applicable requirements and the relevant deployment is expressly supported by an agreed Order. Consent does not override a prohibition or substitute for a specifically required statutory exception, including restrictions on biometric categorisation. These terms do not authorise an otherwise prohibited use.

6. Access, agents and onward disclosure

You control whom you authorise to view, search, export or act on surveillance information. Apply suitable access restrictions, review account and integration access, protect credentials, and remove access when it is no longer needed. Scope agent tools and permissions to the intended task; access to a search tool may expose information from many recordings or transcripts.

Before enabling a model, integration, shared link or export destination, confirm that sending the relevant information there is lawful and permitted by your commitments to affected people. Your instructions must account for prompts, retrieved context, images, audio, transcripts and other material included in a request, not only the text an operator enters.

You remain responsible for disclosures you initiate and copies you place in independently controlled systems. We remain responsible for our own handling of personal data and for subprocessors to the extent required by the Data Processing Addendum and applicable law.

7. Enterprise, local and cloud processing

On-premises AI inference is currently available to enterprise customers under the applicable Order and Enterprise Deployment Schedule. The enterprise configures the enabled models, agents, connections and permitted destinations.

The Model Router uses the models enabled for that deployment. It does not use a cloud inference model as a fallback when only on-premises models are enabled. When both the relevant agents and inference run on the same local network, that processing remains on that local network. When a cloud agent uses on-premises inference, information travels between the agent's cloud region and the on-premises hardware. Separately enabled cloud recording, integrations, exports and other services follow their applicable configurations.

You must assess the complete data flow before representing that a deployment is local-only or satisfies a residency requirement. Our staff's remote support access requires you to initiate and authorise support before access is provided. Authorised support access and any information you submit with a support request are additional processing activities governed by the applicable terms and Data Processing Addendum.

8. Retention, deletion and derived information

You must select and maintain lawful retention periods, taking account of the purpose, applicable maximum periods and any preservation duty. Available storage capacity or a default product setting is not a legal retention recommendation. Apply shorter limits where law or your notices require them.

Consider each category you create or enable: original recordings, audio, transcripts, clips, images, facial templates, profiles, search indexes or embeddings, annotations, agent conversations and memory, exports and backup copies. Deleting a recording should not be assumed to delete every separately stored derivative, conversation or export. Use the available controls for each relevant category and contact support where assistance is required under the Data Processing Addendum.

You are responsible for deletion from systems you independently control and for preventing connected sources from recreating information that should be removed. We must carry out deletion and return obligations for information under our control as provided by the Data Processing Addendum and law. Restricted backups and legally required retention are handled under those provisions, not as permission to continue ordinary use of deleted information.

9. Evidence, preservation and rights requests

If you need information for an investigation or claim, arrange timely lawful preservation before ordinary retention expires. Check export completeness, timestamps, relevant context and chain-of-custody requirements. The services do not themselves establish evidential admissibility, authenticity or compliance with a court's procedures. Do not alter or describe material in a misleading way.

You are responsible for responding to individuals' requests about surveillance you control and for giving them a usable contact route. Verify identity proportionately and protect other people's information when supplying access. Notify us promptly when our assistance is needed; our assistance and direct legal obligations are governed by the Data Processing Addendum and applicable law. Neither these terms nor your agreement with an individual removes a right to complain to a regulator or seek a statutory remedy.

10. Operation, access control and emergencies

You must maintain and test the cameras, microphones, network, storage, power and site conditions within your control. Check recording status, capacity, time settings and alert delivery, and plan for interruptions. These duties do not excuse defects or failures for which we are responsible under the agreement or law.

Unless expressly included in an Order, we do not provide staffed surveillance monitoring or emergency dispatch. Recording, detection, delivery and retrieval are subject to the applicable service terms; no additional continuous-recording or successful-detection guarantee arises from these terms. The Services are not supplied as certified life-safety systems unless the applicable capability and required certification are expressly identified in an Order. They are not a substitute for public emergency services. The safety limitations in the Customer Terms apply to CCTV, audio, biometric, Door and Gate Access and Duress features.

Where you connect doors, gates, duress devices or similar systems, establish suitable local response procedures, test the complete workflow and maintain legally required emergency access and safe egress, including a local unlock or override where required. Do not make an Agent, model output, internet connection or hosted notification the only means of responding to an emergency, obtaining emergency access or safely exiting. Supported access-control and incident workflows may be used for their agreed ordinary purposes with those independent emergency safeguards. You are responsible for the response personnel and emergency arrangements you select. Use the appropriate public emergency service for an immediate threat.

11. Compliance and contact

You must stop an unlawful use and reasonably cooperate with requests necessary to investigate a suspected breach, protect affected people or meet legal obligations. Restrictions or suspension are governed by the Customer Terms and applicable law. We may require deployment information or evidence of required authorisation before enabling a restricted feature.

The Customer Terms govern contractual remedies, indemnities and limitations of liability. Nothing here makes you responsible for our unlawful conduct or binds a person who has not agreed to these terms.

For assistance, preferably log a support ticket. You may also contact Performance Hub Inc, 251 Little Falls Drive, Wilmington, DE 19808, USA, telephone +1 (302) 244-5288. This support route is not an emergency-response service.