Privacy Policy

Vioo SAS and its Moroccan subsidiary Vioo AI SARLAU (collectively "Vioo", "we", "us") operate an AI-powered retail intelligence platform that helps businesses understand customer behaviour through computer vision analytics. This Privacy Policy explains how we collect, process, and protect personal data in connection with our platform and website (vioo.ai).

We are committed to full compliance with the General Data Protection Regulation (GDPR – EU 2016/679) and Morocco's Law 09-08 on the Protection of Individuals with Regard to Processing of Personal Data, as overseen by the Commission Nationale de contrôle de la Protection des Données à caractère personnel (CNDP).

Parent Company

Moroccan Subsidiary

Information collected on vioo.ai is subject to the following data processing activities, declared to the Commission Nationale de contrôle de la Protection des Données à caractère personnel (CNDP):

In accordance with Law No. 09-08 enacted by Dahir 1-09-15 of 18 February 2009 on the protection of personal data, you have the right to access, rectify, and oppose the processing of your personal data by contacting us at privacy@vioo.ai.

Data Controller (for website visitors and prospective clients):

Data Processor (for our B2B clients): When our clients deploy Vioo cameras in their retail premises, our clients are the data controllers for in-store visitor data. Vioo acts as a data processor under a written Data Processing Agreement (DPA). We only process such data on documented instructions from our clients.

Vioo was built with privacy as a foundational principle, not an afterthought:

• No facial recognition. We do not identify, profile, or re-identify any individual by face.
• Real-time anonymisation. Camera streams are processed in real-time — either on a dedicated edge device deployed within your premises, or within a secure, isolated cloud processing environment — and converted immediately into anonymous movement trajectories and statistical aggregates. No raw video footage is persistently stored or retained beyond the processing pipeline. Exception: when a suspicious incident is detected, a short alert clip may be isolated, encrypted (AES-256), and stored securely in restricted cloud storage for a maximum of 90 days for operational verification. Access is strictly limited to authorised personnel.
• Data minimisation. We collect only what is strictly necessary for the analytics service.
• Purpose limitation. Data collected for footfall analysis is never used for any other purpose.

6.1 Website & Demo Request Form

When you submit a demo request on vioo.ai, we collect:

• First name, last name, email address, phone number
• Job title, country
• Message content
• IP address and browser metadata (standard server logs)

Legal basis: Legitimate interest (responding to a business enquiry) and, where applicable, performance of a pre-contractual step (Art. 6(1)(b) GDPR / Art. 4 Law 09-08).

6.2 Platform Users (Authenticated Accounts)

For users with a Vioo account (retail operators, security staff), we process:

• Name, email address, role, and organisational affiliation
• Login timestamps and session activity
• Alert review actions and decisions (audit trail)

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).

6.3 In-Store Analytics Data (Processed on Behalf of Clients)

Our platform processes anonymised movement data captured by cameras installed in client premises. This data consists of:

• Anonymous trajectory vectors and dwell time statistics
• Zone entry/exit counts
• Behavioural event classifications (e.g. queue alerts)

No biometric data is processed. The data controller for this processing is the deploying retail client.

6.4 Alert Clips (Processed on Behalf of Clients)

When the Platform detects a suspicious behavioural event (e.g. suspected theft or unauthorised consumption), a short video clip surrounding that event may be isolated and retained for operational review. These clips:

• Are encrypted at rest (AES-256) and stored in secure cloud storage (Microsoft Azure, France Central region)
• Are accessible only to authorised Client personnel and Vioo's operations team under strict need-to-know access controls
• Are retained for a maximum of 90 days, after which they are permanently deleted
• May contain identifiable imagery of individuals present at the time of the incident

Legal basis: Legitimate interest of the Client in loss prevention and security operations (Art. 6(1)(f) GDPR / Art. 4 Law 09-08). The Client, as data controller, is responsible for ensuring appropriate notice to End Visitors and a valid legal basis for this processing.

We do not sell, rent, or trade personal data. We may share data with:

• Sub-processors: Cloud infrastructure (Microsoft Azure), email delivery (Resend), and monitoring tools — all bound by GDPR-compliant DPAs.
• Professional advisors: Legal, financial, or audit firms under confidentiality obligations.
• Authorities: Only where required by applicable law or court order.

A current list of sub-processors is available on request at privacy@vioo.ai.

Our infrastructure is hosted in the France Central Region. Where data is transferred outside the EEA, we rely on the EU Standard Contractual Clauses (SCCs) as the legal transfer mechanism. For Morocco-based data subjects, transfers are governed by CNDP-approved safeguards under Law 09-08.

• Demo request data: 24 months from last interaction.
• Platform account data: Duration of the contract + 12 months.
• Audit logs: 36 months (security and compliance).
• Aggregated in-store analytics (multi-resolution timeseries — footfall counts, trajectory vectors, zone metrics): retained indefinitely as anonymised statistical data containing no personal identifiers.
• Alert clips: maximum 90 days from capture, then permanently deleted.

After the applicable retention period, data is securely deleted or anonymised.

Under GDPR and CNDP Law 09-08, you have the right to:

• Access — obtain a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion ("right to be forgotten")
• Restriction — limit processing in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — at any time, without affecting prior processing

To exercise any right, email privacy@vioo.ai. We respond within 30 days.

You may also lodge a complaint with your supervisory authority: the CNIL (France), your local EU DPA, or the CNDP (Morocco, www.cndp.ma).

We implement appropriate technical and organisational measures including:

• TLS 1.3 encryption in transit; AES-256 encryption at rest
• Role-based access control (RBAC) with tenant isolation
• Audit logging of all data access and alert review actions
• Regular security assessments and penetration testing

Our website uses strictly necessary cookies for session management and authentication. We do not use advertising or third-party tracking cookies. You can manage cookies through your browser settings.

We may update this policy to reflect changes in law or our practices. We will notify registered users by email and update the "Last updated" date above. Continued use of the platform after changes constitutes acceptance.