Privacy & notices
This page states what IRIS actually does. Where it is marked as awaiting counsel, it is genuinely awaiting counsel — not filled in so the section would look complete.
It sees the room. It knows no one.
What is processed
IRIS analyses images of the people present in a venue, from cameras built into the tower. All analysis runs on the tower — images are not sent to any external service in order to be analysed.
The outputs are statistical: a unique attendance count, attention distributed across the zones of the room, and aggregate sentiment indicators at the level of the audience.
What never happens
- No identification. There is no list of names or known faces to compare anyone against.
- No profile of any individual, on screen or in the report. Outputs are aggregate only.
- No identity carried between events. Internal ids are session-scoped and destroyed at purge.
- Nothing that identifies a person leaves the venue. Where two towers cover one room they exchange an anonymous per-person signature over the venue's own network so one person is not counted twice; it goes no further than that room (apps/agent/nabd_agent/mesh/contract.py:43). If cloud sync is enabled, what leaves the venue is aggregate numbers; the server refuses anything shaped like per-person data and never writes it.
- No tracking across venues or across time. Each event is closed on itself.
The data lifecycle
Capture → finalize → issue a signed report → purge the raw data. Every transition is written to a hash-chained audit log, so a step deleted or altered afterwards is detectable.
By default, raw data is purged automatically when the report is issued. An operator can enable retention; when they do, the tower says so on its own screen and changes the notice it displays — and the period retained in that case is the operator's and the venue's decision.
Visibility in the room
IRIS is designed to be seen: a column standing at the front with a lit green seam. Coverage is set and reviewed before the event starts, so the operator knows exactly which part of the room is measured.
Attendee-facing signage, and the language it must carry, is the responsibility of the event organiser in their venue and under their jurisdiction's law.
Optional cloud processing
IRIS operates without internet. If an operator enables sync, what is sent is aggregate numbers only; the option is off by default and clearly optional.
A second, optional cloud-enrichment layer would change the privacy posture materially. For that reason it is off by default and requires an explicit decision and a written agreement with the provider before it can be enabled.
Data controller and contact details
with counselidentity, address and contact details of the data controllerLawful basis for processing
with counsellawful basis in each jurisdiction where the product will be soldRetention periods as a commitment
with counselretention periods as a contractual commitment, not as a default settingData subject rights and how to exercise them
with counselrights and the procedure to exercise them, and what they mean in an anonymous-by-design systemGoverning law and where to complain
with counselgoverning law, and the supervisory authority for complaintsWhat ships inside the device, and who made it.
IRIS ships third-party model weights on every device. Some of those licences require us to credit their authors — and that obligation is discharged by the full document below, and by nothing else.
| Component | Licence | By | Source |
|---|---|---|---|
| FairFace Modified — detailed in the full document. |
CC BY 4.0 | Kimmo Kärkkäinen, Jungseock Joo | github.com/joojs/fairface |
| YuNet | MIT | OpenCV Zoo | github.com/opencv/opencv_zoo |
| MediaPipe Face Landmarker | Apache-2.0 | github.com/google-ai-edge/mediapipe | |
| YOLOX (yolox-nano) | Apache-2.0 | Megvii BaseDetection | github.com/Megvii-BaseDetection/YOLOX |
| FSRCNN ×3 | Apache-2.0 | Saafke | github.com/Saafke/FSRCNN_Tensorflow |
| Real-ESRGAN (realesr-general-x4v3) | BSD-3-Clause | Xintao Wang et al. | github.com/xinntao/Real-ESRGAN |
| OpenVINO OMZ — face-reidentification-retail-0095 | Apache-2.0 | Intel / OpenVINO Open Model Zoo | github.com/openvinotoolkit/open_model_zoo |
The full document lists every model artefact in the device image — including any whose licence does not permit commercial use, and which therefore gates release until it is removed or licensed.