Version 1.0 — 9 September 2026
This policy explains what the Suraag platform ("Suraag", "we") processes, where, for how long, and what rights the people concerned have. It is written for the organisations that use Suraag — police units and camera-owning businesses — and for the people whose images may appear in their footage.
Suraag is operated from Hyderabad, Telangana, India. Contact for anything in this policy: support@suraag.xyz.
1. Who is responsible for what
Suraag is a platform that an organisation ("the customer") uses on its own CCTV footage. In the language of India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"):
- The customer is the Data Fiduciary for the footage it uploads and for everything derived from it. The customer decides which cameras, which footage and for what purpose.
- Suraag is the Data Processor, processing that footage only on the customer's instructions and under the Data processing agreement.
- Suraag is the Data Fiduciary only for the account data of the people who sign in, for enquiries sent through our website, and for our own operational logs.
If you are a member of the public whose image appears in a customer's footage, your rights are exercised against that customer; section 8 explains how we help.
2. What is processed
Footage the customer uploads. CCTV or drone video that the customer already holds. The customer chooses what to upload; nothing is pulled from a camera without the customer's edge device or an operator uploading it.
Derived analysis. From that footage the platform produces and stores:
- detections — the class (person, motorcycle, car, auto-rickshaw, bag …), position and time of every object found, with a confidence score;
- crops — small JPEG cut-outs of each detected object, used as evidence thumbnails;
- embeddings — numerical vectors describing the appearance of a person or vehicle crop, used to find the same object in other footage. They are not reversible to an image;
- attributes — closed-set estimates such as helmet / no helmet, clothing colour, vehicle type, bag carried; and, where the customer enables it, a one-line caption;
- number-plate reads — plate text with a confidence score and up to three runner-up readings;
- face vectors — only where the customer has the face capability enabled and an administrator has enrolled reference photographs on a watchlist. Face vectors are the most sensitive data the platform holds and are gated, audited and human-reviewed (section 9);
- incident events (for example after-hours intrusion, unattended object, weapon candidate) and the alerts sent about them;
- enhancement and redaction outputs, each recorded with its method and parameters so that the original is never altered.
Account data. Username, bcrypt-hashed password, role and capabilities, organisation, e-mail address where one is given for invitations or password reset, and the time of last activity.
Device data. For edge devices and enrolled phones: device name, platform, the camera it feeds, a hashed device token, and a heartbeat roughly once a minute carrying the pending-upload count and the channel list — no footage.
Audit and operational logs. Every action in the console and the API is written to an append-only audit trail with the actor, action, target, timestamp and IP address. Audit entries are text only; they never contain images.
Website enquiries. Name, work e-mail, organisation, phone number and message sent through the contact form, with the submitting IP address and browser identifier.
3. Where processing happens
| Data | Location | Provider | Notes |
|---|---|---|---|
| Analysis metadata, crops, embeddings, plates, accounts, audit | Mumbai, India | Vultr (virtual server) | The customer's raw footage is stored on the Suraag server assigned to the customer, or on the customer's own premises for on-premises deployments. |
| GPU inference (detection, embedding, plate reading, attributes, enhancement) | RunPod GPU pod, region chosen per deployment | RunPod | Receives frames and object crops only while a job runs, in memory. No raw video file is transferred to or retained on the GPU provider. |
| Question phrasing and narration | OpenRouter (model: GLM-5.3-Flash) or a customer-chosen endpoint | OpenRouter / customer | Receives text only: the operator's question and a structured list of facts (counts, classes, colours, times). No images or crops are sent. Counts are never produced by the language model. |
| Alert delivery | Meta WhatsApp Cloud API; SMTP e-mail; SMS provider (MSG91 or Twilio) where configured; customer webhook | Meta, the customer's e-mail provider, MSG91/Twilio | An alert carries the alert type, camera, time and a link to the evidence crop valid for 48 hours. |
| Browser push notifications | Browser push relays (Google, Apple, Mozilla) | Browser vendors | The push payload is a fixed "New alert — open Suraag" with no content; the console fetches the alert over the authenticated API. |
| Backups of the analysis database | Suraag server (6-hourly), operator workstation, private repository | Vultr, GitHub (private) | Database backups only — never raw video. |
For government deployments the whole stack, including the language model, can run in the customer's own infrastructure with no external service in the loop.
4. Why, and on what lawful basis
- Law-enforcement customers process footage for the prevention, detection, investigation and prosecution of offences under the Bharatiya Nagarik Suraksha Sanhita, 2023 and the procedures of the State police. Section 17(1)(c) of the DPDP Act exempts such processing from most of the Act's obligations; the customer remains responsible for its lawful authority (FIR, case reference, legal authority recorded on the case file) and for retaining evidence as the court requires.
- Business customers (shops, factories, societies, hospitals and so on) process footage of their own premises for the security of persons and property, which is a legitimate use under section 7 of the DPDP Act for data that the customer has already lawfully collected through its notified CCTV. The customer is responsible for CCTV signage and any notice its local rules require.
- Account data is processed to provide the service to the customer (contract).
- Website enquiries are processed on the basis of your request for contact; you can ask us to delete them at any time.
Suraag does not sell, rent or share personal data with third parties for their own purposes, and does not use customer footage or derived data to train models without a written agreement with that customer.
5. Retention
| Data | Retention |
|---|---|
| Live motion clips from edge devices, with their findings, crops and vectors | 14 days by default, configurable by the customer's administrator between 1 and 365 days; purged daily. |
| Footage uploaded by investigators and everything derived from it | Kept until an administrator deletes it. Footage referenced by a sealed report is evidence-locked and cannot be deleted. |
| Footage under legal hold | Kept regardless of retention setting until the hold is lifted by an administrator. |
| Sealed reports, evidence numbers and chain-of-custody hashes | Kept for the life of the customer account. |
| Audit trail | Kept indefinitely and never edited — it is the record a court may ask for. |
| Alert delivery records | Kept with the audit trail. |
| Account data | For the life of the account plus the audit trail entries that reference it. |
| Website enquiries | Until resolved, then up to 24 months, or on request. |
| Backups | Rolling; superseded backups are overwritten. |
On termination of the customer agreement, customer data is deleted as described in the DPA.
6. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Vultr Holdings (The Constant Company) | Server hosting for the platform and analysis data | Mumbai, India |
| RunPod, Inc. | On-demand GPU inference on frames and crops | Region chosen per deployment |
| OpenRouter, Inc. (routing to the selected model provider) | Language-model phrasing of questions and narration — text only | United States |
| Meta Platforms (WhatsApp Business Cloud API) | WhatsApp alert delivery | Global |
| MSG91 or Twilio | SMS alert delivery, where configured | India / United States |
| GitHub, Inc. | Encrypted-in-transit private storage of database backups | United States |
We will notify customers of a change to this list at least 30 days before it takes effect, as the DPA sets out.
7. Security
The measures in force are described in full on the Security page. In brief: TLS for every connection; tenant isolation enforced on the server for every query; role-based access with gated capabilities for face, weapon and re-identification features; bcrypt password hashing and hashed API and device tokens; SHA-256 hashing of every upload at intake with evidence numbers and a verifiable seal on every report; an append-only audit trail; malware scanning of uploads where the scanner is deployed; signed, expiring links for every image; and a documented backup and recovery routine.
8. Your rights
If you are a user of the platform, or a person whose image appears in customer footage, you may ask for:
- access to the personal data held about you;
- correction of inaccurate data;
- erasure, subject to the customer's legal obligation to retain evidence;
- a grievance to be heard — we respond within 30 days;
- nomination of another person to exercise these rights on your behalf, as the DPDP Act provides.
Write to support@suraag.xyz. Where the request concerns footage or analysis held for a customer, we will forward it to that customer within 5 working days and assist the customer in answering it; we cannot act on it ourselves because the customer decides what is retained. If you are dissatisfied with the outcome you may complain to the Data Protection Board of India once it is constituted.
9. Face recognition and other gated features
Face matching, weapon-candidate flagging and cross-camera re-identification are gated capabilities. They are off unless an administrator grants them to a named user. Every use is audited with a purpose and, where applicable, a case reference. A face match is always a candidate that a person must confirm or reject; the platform never treats a match as an identification and says so on screen. Reference photographs and face vectors are deleted together when a watchlist entry is removed.
10. Children
The platform is not directed at children. Footage may incidentally contain minors; the customer's obligations under section 9 of the DPDP Act apply to the customer's own processing.
11. Breach notification
If we become aware of a personal-data breach affecting customer data we will notify the affected customer without undue delay and in any case within 72 hours of becoming aware, with what we know about the nature of the breach, the data concerned, the likely consequences and the measures taken. We will support the customer's own notifications to the Data Protection Board and to affected persons as the DPDP Act requires.
12. Changes
We will post changes here with a new version number and date, and notify customers of material changes by e-mail to the administrator address on record.
13. Contact
Suraag · Hyderabad, Telangana, India · support@suraag.xyz