Privacy policy

Neccessory LLC ("Neccessory", "we") runs the website neccessory.com, the console at console.neccessory.com, the documentation at docs.neccessory.com, the Cloud API and the Web and iOS SDKs. This policy explains what personal data we process on each of them.

We act in two roles. We decide how data is processed for visitors of our website, for the live measurement on our home page, for console account holders, for correspondence, for site analytics and for payments. For measurements that an organization runs in its own product through our API or SDKs, the organization decides why and how people are measured and collects their consent, and we process the data on its behalf.

If measurement is built into another company's app or website, that company must explain to you how your data is handled. This policy describes what Neccessory does in that process and does not replace the company's own notice.

• On the device. The browser or app computes the result itself. Camera frames are not sent anywhere. To start, the Web SDK downloads the measurement engine and models from neccessory.com and the face tracker from the jsDelivr CDN; your browser makes these requests. The iOS SDK has no network path for images. The finished result leaves the device only if the organization's product sends it.
• Cloud, live stream. The browser sends downscaled face patches of 36 by 36 pixels, up to 30 per second, together with technical quality data such as head angle, face size, brightness and movement. The camera video itself stays in the browser. The patches are held only in the memory of the measurement session and are not written to logs, results or storage.
• Face snapshot for emotion or gaze. Only when emotion or gaze is requested, the browser also sends a 448 by 448 pixel photo of the face, up to twice a second. A person can be recognized from it. It is processed in memory in the same way and is not stored.
• Cloud, uploaded files. When an organization uploads a recorded video or a batch of frames, or when the Web SDK resends frames as a file after a dropped connection, the file is kept in storage only until processing ends, whatever the outcome, and never longer than one hour.

We do not create templates for recognizing people, do not try to identify anyone and do not use face images to train models.

A stored result contains the readings (heart rate, heart rate variability, breathing rate, stress index and, if requested, blood pressure, SpO₂, emotion, gaze, head pose, fatigue and blinks), their confidence and signal quality, the duration, the pulse wave and the intervals between heartbeats, the versions of the software and models, whether it was computed in the cloud, the user reference and request ID sent by the organization, the cost in tokens and whether it was a test measurement. It contains no images.

These readings are data about health. The organization that runs the measurement is responsible for having a lawful basis and your consent for it.

Results are kept until the organization deletes the measurement or deletes its organization. There is no automatic expiry.

An organization can create a link to a result report. The report is encrypted in the browser with a key that is only in the link; we store only the encrypted copy, and the link expires after 1 to 168 hours, 72 by default. An organization can also have results sent to web addresses it chooses.

• The measurement on our home page is a real cloud measurement. It starts only after you press the start button next to the text that explains it; that press is your consent.
• The camera video and the face frame stay in your browser. Downscaled face patches go to our server in the EU, as described above. If you turn on emotion, a face snapshot is also sent. These images are not stored.
• We do not ask for your name or email. The result is saved in Neccessory's own demo organization as a sample measurement and is not linked to you.
• Your IP address is used in server memory only to limit how many measurements can be started from one address. It is not saved with the result.
• You can stop the measurement at any time.

• Sign-in: your email address and password. The sign-in provider stores the password in hashed form; we never see it.
• Organization: its name, website and country.
• Optional health parameters you may enter in your profile (age, sex, height, weight, blood type, allergies, chronic conditions). They are used only for your own measurements in the Playground, and you can clear them at any time.
• An application for on-device access, if you send one: platforms, company name, website and size, contact name and email, use case, expected volume and notes.
• Active sign-in sessions: browser, platform, IP address, start and last activity time. You can see and end them in the console.
• API keys, of which we store only a hash of the secret; a log of API calls (key, endpoint, status, latency, request ID, error, quality level, without IP addresses); a log of actions in the console; and the history of your token balance.

Token packs are sold by Paddle.com, our online reseller and the Merchant of Record for all our orders. Paddle collects and processes your name, email, billing address, payment details and tax information under its own privacy notice at paddle.com. We never see your card details.

When you open the checkout, we pass Paddle your organization ID and your account email so the payment is credited to the right organization. After the payment, Paddle tells us the transaction ID and which pack was bought, and we add the tokens to your balance.

We never send Paddle face images, measurement results or any other biometric or health data.

The contact form on this site does not send data to our server: it opens your email app with a prepared message to support@neccessory.com. We receive only what you send by email, and we keep correspondence as long as needed to answer you and keep a record of our dealings with you.

• This website uses Google Analytics 4, Mixpanel and Amplitude to understand how the site is used. They record page views, which sections were viewed, scroll depth, clicks on navigation, buttons and outbound links, and whether the contact form was sent or had empty fields. They never receive the contents of the contact form or the readings of a measurement.
• These services set cookies or similar identifiers in your browser and receive your IP address and browser details. We store campaign tags and the referring page of your first visit in your browser's local storage.
• If the site asks for your choice about analytics, Mixpanel and Amplitude start only after you allow them, and Google Analytics runs with its storage turned off until you allow it. Advertising features are always off.
• The site also stores your language and your analytics choice in the browser. The console stores your sign-in session. The console and the documentation do not use analytics services. Fonts are served from our own domain.

• Render: hosts the website and the API, region Frankfurt, Germany.
• Supabase: database, file storage for uploads, console sign-in and account emails, region eu-central-1, Frankfurt, Germany.
• OVH: rented server for cloud processing, Germany.
• jsDelivr: delivers the face tracker code to browsers; it receives your IP address but no images.
• Paddle: payments, as reseller and Merchant of Record.
• Google, Mixpanel, Amplitude: website analytics.

Paddle, jsDelivr and the analytics services may process data outside the EU. Where they do, they rely on the safeguards described in their own terms, such as the European Commission's standard contractual clauses.

We do not sell personal data.

• Live stream patches and face snapshots: only in memory for the duration of the session.
• Uploaded videos and frames: until processing ends, never longer than one hour.
• Measurement results: until the organization deletes them or deletes the organization.
• Result report links: 1 to 168 hours, 72 by default.
• Organization data after a deletion request: 30 days, during which the deletion can be cancelled, then permanently erased.
• Account data: for as long as the account exists.
• Payment records: kept by Paddle under its own rules; we keep the transaction ID in the balance history.
• Analytics data: according to the retention settings of each analytics service.

The organization owner can delete any measurement in the console, and can export measurements in CSV and JSON.

When an organization requests deletion, its keys stop working at once and running cloud jobs are stopped. After 30 days its measurements, logs, jobs, webhooks, balance history and keys are permanently erased. The deletion can be cancelled within those 30 days.

To delete your console account itself, write to support@neccessory.com from the account email.

All traffic travels over encrypted connections (HTTPS and WSS). API key secrets are stored only as hashes, and every API request is signed with the key. On-device models are delivered encrypted. Shared result reports are encrypted with a key that we do not store.

Depending on where you live, you may have the right to access your personal data, correct it, delete it, receive a copy, restrict or object to its processing, and withdraw your consent at any time without affecting processing that has already happened. To use these rights, write to support@neccessory.com. You also have the right to complain to a data protection authority.

If you were measured inside another company's product, that company holds the relationship with you and the user reference that links results to you. Please send your request to that company first; we will help it answer.

We do not make decisions about you based solely on automated processing.

If your users are in Russia, contact us before connecting cloud mode.

We publish every new version of this policy on this page with a new date.

Neccessory LLC. For any question about your data, write to support@neccessory.com.