Privacy Policy & Responsible Use of AI

1 Our Commitment to Privacy

EclimAi Limited (“EclimAi”, “we”, “our”, or “us”) develops artificial intelligence technology for intelligent building and HVAC optimisation.

Privacy is a fundamental design requirement of the EclimAi platform. Our systems are intentionally designed so that the core AI inference and HVAC control loop operates locally within the customer premises and does not depend on cloud processing.

This means that the functions required to analyse occupancy, make AI-driven optimisation decisions, and communicate those decisions to the building’s HVAC or Building Management System operate within the customer’s local environment.

EclimAi may provide an optional cloud-connected dashboard to customers who wish to remotely visualise selected operational information. The dashboard is not required for the AI system to perform occupancy detection, HVAC control, or energy optimisation. Where the optional dashboard is enabled, only limited operational telemetry required for the dashboard and associated monitoring functionality is transmitted securely to EclimAi’s cloud infrastructure.

Our privacy and AI governance approach is based on:

privacy by design and by default;
data minimisation;
purpose limitation;
security by design;
transparency;
fairness;
accountability;
human oversight; and
responsible use of artificial intelligence.

This Privacy Policy explains how EclimAi handles information through our website, applications, optional cloud services, edge AI systems, and related business activities.

2 Scope

This Privacy Policy applies to:

the EclimAi website;
the EclimAi web application;
the optional EclimAi customer dashboard;
EclimAi edge AI systems deployed within customer premises;
business enquiries and demonstration requests;
customer and technical-support communications;
limited operational telemetry transmitted where optional cloud functionality is enabled; and
personal information otherwise processed by EclimAi in connection with providing our services.

Customers, property operators, employers, and building owners may have separate privacy obligations concerning their own CCTV systems, employees, occupants, visitors, building systems, or other information under their control.

3 Information We Collect

3.1 Website and Business Information

EclimAi may process limited personal information when an individual voluntarily interacts with us, including:

name;
business email address;
telephone number;
organisation or company name;
job title;
information provided in enquiries;
customer-account information; and
support communications.

We collect only the information reasonably necessary for the relevant business purpose.

3.2 Technical Information

When users access the EclimAi website or web application, EclimAi or its infrastructure providers may process standard technical information necessary to operate and secure the service, such as:

IP addresses;
browser and device information;
timestamps;
authentication events;
security logs;
application events; and
diagnostic information.

This information is not used to identify building occupants or train EclimAi’s proprietary occupancy-detection models.

4 How We Use Information

Where EclimAi processes personal information, we may use it to:

respond to enquiries and demonstration requests;
establish and administer customer relationships;
provide authorised customer accounts;
deliver technical support;
operate and secure our website and applications;
identify and respond to security incidents;
maintain required compliance and business records;
fulfil contractual obligations;
comply with legal or regulatory requirements; and
communicate with customers and prospective customers where permitted by applicable law.

EclimAi does not sell personal information.

Personal information collected through our website, customer relationships, or production deployments is not used to train EclimAi’s proprietary computer-vision occupancy models.

5 Responsible Use of Artificial Intelligence

EclimAi is committed to developing and operating artificial intelligence responsibly, securely, transparently, and in a manner designed to protect the privacy and rights of individuals.

5.1 Purpose of EclimAi AI

EclimAi uses computer vision and machine-learning technologies to estimate zone-level occupancy conditions within buildings. Occupancy information is then used as an input to intelligent HVAC control and optimisation.

The objective of the technology is to improve:

building energy efficiency;
HVAC performance;
occupant comfort;
utilisation of building resources; and
reduction of unnecessary energy consumption and carbon emissions.

The system is designed to understand whether a building zone is occupied and the degree of occupancy. It is not designed to determine the identity of the occupants.

5.2 Core AI Inference and Control Remain On-Premises

The fundamental privacy architecture of EclimAi is based on local edge computing. The core processing path is:

Local Camera / Sensors
Local Edge AI Processing
Occupancy Estimation
Local HVAC Optimisation
Local Building / HVAC Control

These functions operate within the customer’s premises. The EclimAi system does not require the cloud to:

analyse occupancy imagery;
calculate occupancy;
execute the core AI inference process;
determine HVAC optimisation decisions;
communicate those optimisation decisions to the local HVAC system; or
maintain normal autonomous HVAC optimisation.

The core AI inference and core AI control pathway therefore continues to operate independently of the optional EclimAi cloud dashboard.

5.3 Optional Cloud Dashboard

EclimAi may provide customers with an optional cloud-connected dashboard for convenient visualisation of selected operational information. This dashboard is supplementary to the core EclimAi system. A customer does not need to enable the cloud dashboard for EclimAi to perform AI-driven HVAC optimisation.

Where the optional dashboard is enabled, limited telemetry may be securely transmitted from the customer environment to EclimAi’s AWS-hosted services. Depending on the deployment, this telemetry may include information such as:

device-health status;
service-health status;
aggregated occupancy values;
aggregated HVAC operational values;
system status;
energy-performance metrics;
alarms or event codes; and
other limited operational values required to provide authorised dashboard functionality.

The optional telemetry pathway is separate from the core AI inference and control pathway. EclimAi does not transmit raw customer camera footage to AWS for AI inference or model training as part of normal system operation.

The optional dashboard does not perform the core occupancy-detection or HVAC-control decision-making required for EclimAi’s energy optimisation functionality.

5.4 No Facial Recognition

EclimAi does not use facial recognition technology. The EclimAi occupancy system is not designed or used to:

identify an individual;
recognise a person’s face;
create facial templates;
match faces against identity databases;
perform biometric identification;
perform biometric authentication;
track named individuals across a building;
identify employees, occupants, or visitors;
determine an individual’s identity from their appearance;
conduct emotion recognition; or
create behavioural profiles of identifiable occupants.

The identity of an occupant is neither necessary nor relevant to EclimAi’s HVAC optimisation process.

5.5 No Biometric Profiling

EclimAi does not use biometric characteristics to identify or authenticate building occupants.

We do not create biometric profiles of occupants and do not operate the EclimAi platform as an employee-monitoring, surveillance, identification, or behavioural-profiling system.

5.6 No Audio Processing

EclimAi’s proprietary occupancy-detection system does not require audio. Audio is not used as an input to EclimAi’s proprietary vision-based occupancy-detection model.

5.7 Privacy-Preserving Image Processing

Camera imagery required for occupancy analysis is processed locally within the customer environment. EclimAi incorporates preprocessing techniques intended to minimise unnecessary visual information before occupancy outputs are generated.

These techniques may include Gaussian blurring and related image-processing operations, after which the system performs occupancy detection using detection regions and numerical occupancy representations rather than occupant identity.

The objective is for the AI system to determine that a human presence or occupancy event exists without needing to determine who that individual is.

5.8 Training Data Is Separated from Customer Production Data

EclimAi maintains a separation between customer production environments and the datasets used to develop its proprietary computer-vision models. EclimAi does not use the following customer information to train its proprietary occupancy-detection models:

customer CCTV footage;
customer occupant images;
personally identifiable occupant information;
biometric information;
customer-specific building telemetry;
customer HVAC operational information; or
proprietary customer building information.

Customer production data is not automatically incorporated into EclimAi’s AI training datasets.

5.9 Synthetic and Public Benchmark Training Data

EclimAi develops and augments its occupancy-detection models using datasets that are separate from customer production environments. These include:

Synthetic Data. EclimAi uses synthetically generated imagery representing office, commercial-building, and occupancy scenarios. Synthetic training data enables EclimAi to represent a wide range of environments and occupancy conditions without relying on customer CCTV footage.

Public Benchmark Datasets. EclimAi may also use established public computer-vision benchmark datasets, including datasets such as COCO and CrowdHuman, where appropriate for transfer learning, augmentation, validation, or improvement of object-detection capabilities.

Public datasets used within the model-development lifecycle are subject to EclimAi’s data-governance, provenance, validation, security, and responsible-AI review processes. Customer production imagery is not added to these datasets as part of normal operation.

5.10 Fairness and Bias Testing

EclimAi recognises that computer-vision systems can exhibit different performance characteristics across different populations, environments, lighting conditions, camera positions, clothing, body characteristics, and other variables. Training and validation datasets are therefore evaluated for potential performance disparities.

EclimAi performs testing intended to identify inappropriate performance differences associated with factors including racial and gender presentation. Where material disparities are identified, EclimAi may apply:

dataset balancing;
augmentation;
additional validation;
model adjustments;
threshold calibration; or
other appropriate engineering controls.

Race and gender are not used to identify, rank, profile, or make decisions about occupants during normal production operation. Bias testing is performed to evaluate and improve model fairness, not to categorise individual building occupants.

5.11 No Automated Decisions About Individuals

EclimAi’s AI makes decisions about building operation, not about the rights or status of individual people. The EclimAi platform is not designed to make decisions concerning an individual’s:

employment;
recruitment;
creditworthiness;
financial status;
insurance eligibility;
healthcare;
education;
access to public services;
legal rights; or
eligibility for products or services.

EclimAi uses occupancy conditions to determine appropriate building-level or zone-level HVAC operation. It does not use occupancy AI to create individual profiles or make decisions that produce legal or similarly significant effects on identifiable individuals.

5.12 Human Oversight

Appropriate human oversight remains available within the EclimAi system. Authorised customer personnel retain control of their building systems and can, according to the customer’s system configuration:

monitor system operation;
review system status;
adjust authorised parameters;
intervene where required; and
override automated HVAC control.

EclimAi does not remove the customer’s ultimate authority over its building infrastructure.

6 Data Minimisation

EclimAi follows the principle that information should not be collected or transmitted merely because it is technically possible to do so. Our system therefore seeks to minimise information at each stage of processing. In particular:

occupant identity is not required for HVAC optimisation;
facial recognition is not required;
biometric identification is not required;
audio is not required;
customer CCTV footage is not required for proprietary-model training;
customer building information is not required for proprietary-model training;
core AI inference does not require cloud processing; and
only limited operational telemetry is transmitted to the cloud where a customer enables optional dashboard functionality.

Where operational objectives can be achieved using aggregated or non-identifying information, EclimAi prefers those representations.

7 Customer CCTV and Building Data

EclimAi may integrate with camera systems and building infrastructure controlled by customers. Depending on the deployment, the customer, building owner, employer, landlord, property manager, or another relevant organisation may determine matters such as:

why CCTV cameras are installed;
camera placement;
applicable legal basis;
CCTV notices;
local video-retention periods;
access to camera systems;
building telemetry collection; and
other privacy obligations associated with the building.

The respective roles of EclimAi and the customer as controller, processor, or other responsible party depend on the specific deployment and applicable contractual arrangements.

Where EclimAi acts as a processor, EclimAi processes applicable personal data according to the customer’s documented instructions and applicable data-processing agreement.

8 Legal Basis for Processing

Where EclimAi acts as a data controller and GDPR applies, our legal basis for processing may include:

Contractual Necessity

Processing necessary to:

respond to requests relating to a contract;
establish a customer relationship;
provide contracted services; or
administer customer accounts.

Legitimate Interests

Processing necessary for legitimate interests including:

cybersecurity;
fraud prevention;
service reliability;
B2B customer support;
business administration; and
protection of EclimAi systems.

Such processing is undertaken only where those interests are not overridden by the rights and freedoms of the individual.

Consent

Consent may be used where required, including for certain:

marketing communications;
non-essential cookies; or
similar activities.

Consent may be withdrawn where processing is based on consent.

Legal Obligations

Information may be processed where necessary to satisfy applicable legal, regulatory, tax, compliance, or lawful government requirements.

Where EclimAi acts solely as a processor, the relevant customer or data controller determines the applicable legal basis.

9 Sharing of Information and Service Providers

EclimAi may use third-party service providers where necessary to operate our business and technical infrastructure. These may include providers supporting:

cloud infrastructure;
cybersecurity;
authentication;
communications;
application hosting;
monitoring;
customer support; and
related business services.

Amazon Web Services (“AWS”) is used for portions of EclimAi’s cloud infrastructure, including functionality supporting the optional customer dashboard. Where the optional dashboard is enabled, only the operational telemetry necessary for relevant authorised functionality is transmitted to the applicable cloud environment.

EclimAi does not sell occupant information or personal data to advertisers, data brokers, or similar organisations.

EclimAi may disclose information where:

required by applicable law;
required by a valid legal or regulatory request;
necessary to protect the security or legal rights of EclimAi or others;
necessary in connection with a legitimate corporate transaction; or
explicitly authorised by the relevant individual or organisation.

10 International Transfers

Where personal information protected by GDPR is transferred outside the European Economic Area, EclimAi will use an appropriate transfer mechanism where required. Such mechanisms may include:

an adequacy decision;
Standard Contractual Clauses;
another legally recognised transfer mechanism; and
appropriate supplementary safeguards.

Customer-specific geographic and data-transfer requirements may also be governed through applicable customer contracts and Data Processing Agreements.

11 Retention and Deletion

EclimAi retains personal information only for as long as necessary for:

the purpose for which it was collected;
provision of contracted services;
security and operational requirements;
applicable retention schedules;
legal obligations; or
legitimate compliance requirements.

Information that is no longer required is deleted, anonymised, or securely disposed of in accordance with applicable EclimAi policies and procedures.

Camera Information

EclimAi does not maintain a central cloud repository of customer CCTV footage for proprietary-model training. Occupancy analysis occurs locally within the customer environment.

Retention applicable to a customer’s independent CCTV infrastructure is determined by the customer and its own legal, contractual, and operational requirements.

Optional Operational Telemetry

Operational telemetry sent to EclimAi’s cloud services where the optional dashboard is enabled is retained only for the period necessary to support the applicable:

dashboard functionality;
operational monitoring;
troubleshooting;
security requirements;
customer contract; or
compliance obligation.

12 Information Security

EclimAi maintains technical and organisational measures intended to protect the confidentiality, integrity, and availability of information. Depending on the relevant system and risk, these controls include:

encryption in transit;
encryption of protected information at rest;
role-based access control;
least-privilege access;
multi-factor authentication;
audit logging;
security monitoring;
vulnerability management;
patch management;
system hardening;
secure development practices;
change control;
access reviews;
incident response;
security testing; and
secure deletion and decommissioning.

Core AI processing occurring within customer premises further reduces the need to expose occupancy-processing information to external networks.

13 Data Protection Rights

Depending on applicable law and the circumstances of processing, individuals may have rights including:

the right to be informed;
the right of access;
the right to rectification;
the right to erasure;
the right to restrict processing;
the right to data portability;
the right to object;
the right to withdraw consent; and
applicable rights relating to automated decision-making.

Where EclimAi acts as the data controller, requests may be submitted through the contact details provided by EclimAi. EclimAi may need to verify the identity of a requester before acting upon a request.

Where information is controlled by a building owner, employer, landlord, property manager, or another EclimAi customer, the request should ordinarily be directed to that organisation. Where EclimAi acts as its processor, EclimAi will provide appropriate assistance to the customer in responding to valid data-subject requests.

14 AI Transparency and Questions

Customers and other relevant stakeholders may contact EclimAi with questions concerning:

the intended purpose of an EclimAi AI system;
the categories of information used;
the role of AI in HVAC optimisation;
local versus cloud processing;
the use of optional telemetry;
privacy safeguards;
model limitations;
human oversight;
fairness;
security; or
responsible-AI governance.

EclimAi maintains internal technical, risk, compliance, model, lifecycle, and governance documentation to support accountability for its AI systems.

Material changes to AI models, datasets, infrastructure, or processing architecture are subject to applicable change-management, testing, security, privacy, and approval processes.

15 Cookies

EclimAi may use cookies or similar technologies required for secure operation of its website and applications.

Where non-essential analytics, preference, advertising, or similar cookies require consent under applicable law, appropriate consent controls will be used. Users may also manage certain cookie settings through their browser.

Where appropriate, more detailed information may be provided through a separate Cookie Notice.

16 Children

EclimAi’s website, products, and commercial services are intended for organisations and professional users and are not directed toward children.

EclimAi does not knowingly solicit children’s personal information through its website for marketing purposes. The EclimAi occupancy-detection system is designed to detect occupancy rather than establish the identity of an individual.

17 Third-Party Websites

Our website may contain links to independent third-party websites or services. EclimAi is not responsible for the privacy practices of those independent organisations.

Users should review the applicable third party’s privacy notice before providing personal information.

18 Regulatory and Governance Framework

EclimAi’s privacy and responsible-AI programme is designed with reference to applicable legal, contractual, security, and governance requirements, including, where applicable:

EU General Data Protection Regulation (GDPR);
applicable Irish data-protection legislation;
EU Artificial Intelligence Act;
ISO/IEC 27001 information-security principles;
ISO/IEC 42001 AI management-system principles;
applicable contractual requirements; and
other privacy and cybersecurity requirements relevant to EclimAi deployments.

The requirements applicable to a particular deployment are assessed according to the relevant jurisdiction, technology, contractual arrangement, and EclimAi’s legal role.

19 Complaints

Individuals may contact EclimAi with concerns regarding the processing of their personal information or the responsible use of AI within EclimAi services.

Where GDPR applies, individuals may also have the right to lodge a complaint with the applicable data-protection supervisory authority. EclimAi is established in Ireland. The Irish supervisory authority is the:

Data Protection Commission

6 Pembroke Row
Dublin 2
D02 X963
Ireland

EclimAi encourages individuals to contact us where appropriate so that we have an opportunity to investigate and address their concern.

20 Changes to this Privacy Policy

EclimAi may update this Privacy Policy to reflect:

changes to our products;
changes to our AI architecture;
changes to cloud or edge functionality;
changes to processing activities;
changes in applicable laws or regulatory guidance;
security improvements; or
changes to organisational practices.

The date of the latest revision will be displayed at the beginning of this Policy. Material changes may be communicated through additional notices where appropriate.

21 Contact

Questions regarding privacy, data protection, or EclimAi’s responsible use of artificial intelligence may be submitted through EclimAi’s published contact channels.

EclimAi Limited

Website: https://eclimai.com

EclimAi Responsible AI Commitment

Our AI is designed to understand buildings, not identify people.

EclimAi uses privacy-preserving, edge-based artificial intelligence to optimise the energy performance of buildings. Core AI inference and HVAC control always operate within the customer premises and do not depend on the cloud.

Customers may optionally enable a cloud-connected dashboard for convenient visualisation of limited operational telemetry. This dashboard is supplementary and is not required for occupancy detection, AI decision-making, HVAC control, or energy optimisation.

EclimAi does not use facial recognition, biometric identification, occupant profiling, customer CCTV footage, customer building telemetry, customer HVAC data, or personally identifiable occupant information to train its proprietary vision models.

Our computer-vision development process instead uses synthetically generated imagery and appropriate public benchmark datasets, including datasets used for transfer learning and augmented detection.

Privacy, security, fairness, transparency, human oversight, accountability, and responsible use of AI are fundamental requirements throughout the EclimAi AI lifecycle.

This Privacy Policy is provided for information purposes and describes EclimAi’s standard approach. Specific deployments may be further governed by the applicable customer contract and Data Processing Agreement.