Legal

Privacy policy.

Effective date: January 1, 2026. Operated by ExecLayer, Inc.

Privacy Policy

Effective date: January 1, 2026 · Last updated: January 1, 2026

This Privacy Policy describes how ExecLayer, Inc. ("ExecLayer," "we," "us," or "our") collects, uses, and handles data in connection with the QueueFlow Sentinel service (the "Service"). This policy applies to all users of the Service, including account holders, authorized operators, and administrators.

QueueFlow Sentinel operates under strict privacy constraints. The data handling scope of the Service is designed to be narrow, verifiable, and auditable.

1. Data Scope

QueueFlow Sentinel is a metadata-only operational monitoring service. The data scope of the Service is narrow and fixed.

QueueFlow Sentinel — Metadata Only

Sentinel operates exclusively on event metadata. The following data categories are processed:

  • Event timestamps
  • Event type identifiers (e.g., motion detected, doorbell press)
  • Device identifiers
  • Activity frequency and interval metrics
  • Account and location identifiers for multi-site aggregation

Sentinel does not access, receive, process, store, or transmit any of the following:

  • Live video streams
  • Recorded video or video clips
  • Image snapshots or thumbnails
  • Audio streams or audio recordings
  • Biometric data of any kind

2. Absolute Exclusions

The following exclusions apply to the Service. These are architectural constraints, not policy preferences.

Capability Status
Facial recognition Never
Identity tracking Never
Biometric analysis Never
Behavioral profiling of individuals Never
Identity database creation Never
Audio processing or storage Never
Device commands or control Never
Automated enforcement decisions Never
Video/media access Never
All Service outputs are designed to support human judgment. The Service does not execute actions, automate decisions, or replace human operational review.

3. How We Use Data

3.1 Operational Signal Generation

The primary purpose of data processing is to generate operational signals for your organization. This includes evaluating event metadata against policy thresholds, aggregating signals across locations for portfolio-level visibility, and producing audit logs of all evaluation decisions.

3.2 Service Operation

We also process limited data to operate and maintain the Service, including account authentication and access control, usage metering for billing, system monitoring and error logging, and security incident detection.

3.3 What We Do Not Do With Your Data

We do not sell, rent, or share your data with third parties for advertising, marketing, or data brokerage purposes. We do not use your operational data to train machine learning models for third-party use. We do not provide your data to law enforcement except as required by valid legal process, in which case we will notify you unless legally prohibited from doing so.

4. Data Retention

4.1 Event Metadata

Event metadata is retained for the duration specified in your subscription agreement. Default retention is 90 days. Extended retention is available on higher-tier plans. Upon account termination, metadata is deleted within 30 days.

4.2 Audit Logs

Audit logs documenting all evaluation decisions (allow, suppress, flag) and the inputs and rule state that produced each decision are retained for a minimum of 12 months, regardless of subscription tier or status.

4.3 Account Data

Account information (name, email, organization, billing) is retained for the duration of the subscription and for up to 12 months following termination for legal and accounting purposes.

5. Data Security

We implement technical and organizational security measures to protect data processed by the Service. These include encryption of data in transit (TLS 1.2+), encryption of data at rest (AES-256), role-based access controls on all production systems, audit logging of administrative and system access, and regular security reviews. For additional detail, see our Data Handling documentation.

6. Third-Party Integrations

The Service connects to third-party camera platforms through their authorized APIs. Data received from third-party platforms is subject to both this Privacy Policy and the privacy policies of the originating platform. ExecLayer does not control and is not responsible for the data practices of third-party platforms.

The Service operates externally to connected platforms via read-only API access. The Service does not embed into, modify, or extend the native experience of any connected platform.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your data:

  • Access. You may request a copy of the data we hold about your account and organization.
  • Correction. You may request correction of inaccurate account data.
  • Deletion. You may request deletion of your data, subject to legal retention requirements and the audit log minimum retention period.
  • Portability. You may request your data in a structured, machine-readable format.
  • Objection. You may object to processing of your data for purposes beyond Service delivery.

To exercise any of these rights, contact james@queueflow.tech. We will respond within 30 days.

8. Children's Privacy

The Service is designed for business and organizational use. It is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. The Service does not identify, track, or profile individuals of any age.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes — particularly any expansion of data categories processed or changes to the absolute exclusions in Section 2 — will be communicated to account holders via email at least 30 days before taking effect. The effective date at the top of this page indicates the date of the most recent revision.

10. Contact

For questions about this Privacy Policy or our data handling practices, contact:

ExecLayer, Inc.
Email: james@queueflow.tech
Support: support@queueflow.tech