Privacy Policy

1. Who are we?

EgoVista (hereinafter “EgoVista” or “we”) is a French simplified joint-stock company (société par actions simplifiée) in the process of being registered, publisher of the egovista.app platform.

EgoVista acts as a data controller within the meaning of Article 4.7 of Regulation (EU) 2016/679 (GDPR) for all processing of personal data described in this policy.

For any question relating to the protection of your personal data, you may contact us at:

• E-mail: privacy@egovista.app

2. Who is this policy for?

This privacy policy is addressed to:

• contributors: any natural person who uploads egocentric videos to the Platform;
• buyers: any research laboratory or company that uses the contact form or purchases datasets;
• visitors: any person browsing the Platform;
• third parties appearing in videos filmed by contributors.

3. What data do we collect?

3.1 — Data provided directly by you

• Contributors: first name, last name, email address, filming environment, video description, video file.
• Buyers: name, professional email, organization, project type, estimated volume, target environments, timeline, free-form message.

Note: bank details (IBAN) will be collected once the payment system is activated. This section will be updated accordingly.

3.2 — Data collected automatically

• IP address, user-agent, connection and upload timestamps
• Aggregated browsing data (if analytics is enabled)

3.3 — Data derived through AI processing

Videos uploaded by contributors are subject to automated processing, carried out in the following order:

• Extracted frames: images extracted at 10 fps by FFmpeg (local processing).
• Anonymization: automatic blurring of third-party faces detected via MediaPipe Face Detection (threshold 0.8, local processing). This step takes place BEFORE any data is sent to external services.
• Body pose data: 33 body keypoints and 21 keypoints per hand, extracted by MediaPipe (local processing). These data constitute derived biometric data within the meaning of Article 9 of the GDPR.
• Segmentation masks: contours of hands and manipulated objects identified in the anonymized frames, generated by EgoHOS (specialized egocentric segmentation model, ECCV 2022, 5 classes per frame: left hand, right hand, object manipulated by the left hand, object manipulated by the right hand, object manipulated by both hands). Executed on a dedicated European GPU via RunPod (Amsterdam, EU). No raw video containing identifiable faces is transmitted — only previously anonymized frames are sent.
• Action labels: textual descriptions of the observed actions, generated by Gemini 2.5 Pro via Vertex AI (europe-west4, Netherlands).

3.4 — Data relating to third parties

Egocentric videos may capture images of third parties (passers-by, household members, colleagues). EgoVista systematically performs automatic blurring of the faces of such third parties before any other annotation processing and before any release to a buyer.

4. Why and on what legal basis do we process your data?

The table below summarizes all our processing activities, in accordance with Articles 13 and 14 of the GDPR:

⚠ LAWYER CHECKPOINT — The “legitimate interest” legal basis (Art. 6.1.f) used for segmentation (EgoHOS via RunPod) and labeling (Gemini via Vertex AI) must be validated by a lawyer prior to publication. Note: anonymized frames are processed on EU-only infrastructure (RunPod Amsterdam for segmentation, Vertex AI europe-west4 for action labeling). No data leaves the EU, and frames are deleted from the inference bucket after processing.

4.1 — Focus: processing of biometric data

Body pose data (body and hand keypoints) constitute derived biometric data within the meaning of Article 9 of the GDPR.

The processing of these data is based on your explicit consent (Article 9.2.a of the GDPR). You may withdraw your consent at any time by contacting us at privacy@egovista.app.

5. Transfers of data outside the European Union

Important: face anonymization systematically takes place BEFORE any frames are sent to external services.

As of April 2026, action labeling runs on Vertex AI europe-west4 (Netherlands), replacing the previous Google AI Studio backend. Combined with EgoHOS segmentation already running on RunPod Amsterdam, no personal data is transferred outside the EU for annotation purposes. The transfers listed below concern peripheral services only.

You may obtain a copy of the Standard Contractual Clauses by contacting us at privacy@egovista.app.

6. Retention period

6.1 — General rules

• Identification data: retained for the duration of the contractual relationship, then 3 years after the last activity.
• Browsing data / logs: 13 months (CNIL recommendation).
• Aggregated analytics data: 26 months maximum.

6.2 — Videos and derived data

• Unvalidated or rejected videos: deleted within 90 days of the rejection.
• Validated but unsold videos: deleted within 30 days of a withdrawal request by the contributor.
• Sold videos: data integrated into a dataset delivered to a buyer can no longer be deleted by EgoVista at the buyer's end.

7. Your rights

7.1 — Right of access (art. 15)

You may obtain confirmation that your data is processed by EgoVista and receive a full copy.

7.2 — Right to rectification (art. 16)

You may request the correction of inaccurate or incomplete data.

7.3 — Right to erasure (art. 17)

• Unsold videos: full erasure within 30 days.
• Already sold videos: EgoVista will remove the video from its catalog. Data already delivered to a buyer cannot be deleted at the buyer's end. EgoVista will notify the buyer of the erasure request.
• Legal obligations: data required to comply with accounting or tax obligations is retained for the applicable legal period.

7.4 — Right to restriction of processing (art. 18)

You may request the restriction of processing in the cases provided for by the GDPR.

7.5 — Right to portability (art. 20)

You may receive your personal data in a structured, machine-readable format (JSON or CSV).

7.6 — Right to object (art. 21)

You may object to any processing based on EgoVista's legitimate interest.

7.7 — Withdrawal of consent

You may withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to the withdrawal.

7.8 — Right to lodge a complaint

You have the right to lodge a complaint with the CNIL, the French data protection supervisory authority:

• Website: www.cnil.fr
• Address: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

7.9 — How to exercise your rights?

Send your request by e-mail to privacy@egovista.app, specifying your identity and the right you wish to exercise. EgoVista will respond within one (1) month.

8. Security measures

EgoVista implements the following technical and organizational measures:

• Encryption in transit: all communications are encrypted via HTTPS/TLS.
• Encryption at rest: personal data stored in Supabase is encrypted.
• Access control: access to data restricted to authorized personnel, with strong authentication.
• Presigned URLs: access to video files on Cloudflare R2 is time-limited (1-hour expiration).
• Row Level Security (RLS): enabled on all Supabase tables.
• Prior anonymization: third-party faces are blurred BEFORE any frames are sent to external services.
• MIME validation: server-side verification of the uploaded file type.
• Rate limiting: throttling of requests to prevent abuse.

9. Profiling and automated decisions

EgoVista does not carry out any profiling or fully automated decision-making producing legal effects within the meaning of Article 22 of the GDPR.

Annotations generated by AI models (MediaPipe, EgoHOS, Gemini) do not constitute reference human annotations and produce no legal effect with regard to contributors.

10. Cookies

EgoVista does not use any advertising cookies or third-party trackers for commercial targeting purposes.

• Strictly necessary cookies: session and security cookies, exempt from consent.
• Audience measurement cookies: if an analytics tool is deployed, data will be aggregated and anonymized.

11. Protection of third parties appearing in videos

• Prior anonymization: MediaPipe Face Detection (threshold 0.8) systematically blurs third-party faces BEFORE any other processing.
• Contributor obligation: the Terms of Service require the filmer to inform the persons present and not to deliberately film minors.
• Third-party right to object: any person recognizing themselves in a video may request the removal of their image by contacting privacy@egovista.app within 30 days.

12. Minors

The Platform is strictly forbidden to persons under the age of 18. EgoVista does not knowingly collect personal data from minors. Should EgoVista discover that a minor has registered, their account will be immediately deleted and their data erased.

13. Changes to the privacy policy

EgoVista may modify this policy at any time. In the event of a substantial modification, registered users will be notified by e-mail at least thirty (30) days before the effective date.

The version in force is always accessible at egovista.app/privacy.

14. Applicable law

This privacy policy is governed by French law and Regulation (EU) 2016/679 (GDPR).

In the event of a dispute, the courts of Paris (tribunaux de Paris) shall have exclusive jurisdiction, subject to the consumer Contributor's right to bring an action before the court of their place of domicile.