How AegisProtect collects, uses, and protects your information.
Version 1.3.4 · Last updated October 10, 2026
AegisProtect is operated by AegisProtect Limited, a company incorporated in Jamaica with its registered office at 613 Belle Air Phase 3, Block B, Section 2, Runaway Bay P.O., St. Ann, Jamaica. AegisProtect is the data controller for the personal data described in this policy, as that term is used in section 2 of the Data Protection Act, 2020.
You can contact our Data Protection Officer at privacy@aegisprotect.io.
This policy covers personal data we process when you use either or both of:
Both products may be used independently or together. Where a section applies to only one product, that product is named in the heading.
Section 2 of the DPA defines some categories as sensitive personal data, which require a condition under section 24 in addition to the section 23 condition every processing needs. Where we rely on consent for these, section 24(1)(a) requires it to be given in writing — so each is captured as its own recorded, withdrawable acceptance rather than bundled into a single agreement:
stripeCustomerId and stripeSubscriptionId only.Every processing of personal data needs a condition under section 23. Processing of sensitive personal data needs a condition under section 24 as well, because section 22(1) requires both.
| Purpose | Condition under s.23 | Additional s.24 condition (sensitive data only) |
|---|---|---|
| Identity verification at onboarding | Performance of contract, s.23(1)(b), for the verification result | Written consent, s.24(1)(a), for the selfie and ID document |
| Operating the alarm and dispatch service | Performance of contract, s.23(1)(b) | — |
| Dispatching an incident to public emergency services (in Jamaica, the JCF via AIMS) | Vital interests, s.23(1)(d), plus consent, s.23(1)(a), for the data shared | Administration of justice, s.24(1)(g), where the shared data is sensitive |
| Dispatching an incident to a licensed private security partner (paid tiers) | Performance of contract, s.23(1)(b), plus consent, s.23(1)(a) | Written consent, s.24(1)(a) |
| Recording duress audio during an active alert | Consent, s.23(1)(a) | Written consent, s.24(1)(a) — withdrawable on its own under s.24(6) |
| Audio capturing other people present during your alert | Vital interests, s.23(1)(d) | Vital interests where consent cannot reasonably be obtained, s.24(1)(c) |
| Keeping a recording that is needed for legal proceedings | Legal obligation or legitimate interest, s.23(1)(c) / s.23(1)(f) | Legal proceedings and legal rights, s.24(1)(f); administration of justice, s.24(1)(g) |
| Notifying emergency contacts | Consent, s.23(1)(a), at enrolment for each contact | — |
| Subscription billing | Performance of contract, s.23(1)(b) | — |
| Fraud prevention and platform abuse | Legitimate interest, s.23(1)(f) — balanced against your rights | — |
| Anonymized service-improvement analytics | Legitimate interest, s.23(1)(f) — no individual-level decisions made | — |
| Compliance with legal obligations | Legal obligation, s.23(1)(c) — including lawful requests from public authorities or court orders | — |
We do not process your data for advertising or marketing without separate, granular consent that you can withdraw at any time.
| Category | Retention period | Why |
|---|---|---|
| Account profile, contact details | While account is active, then 30 days post-deletion request | DPA right to erasure with operational wind-down window |
| Account credentials (password hash) | While account is active, then deleted on account deletion | No retention rationale beyond service operation |
| Authentication / session logs | 30 days rolling | Security incident investigation |
| Government ID document photo (raw image) | Deleted as soon as verification finishes, whatever the result. If verification never finishes (for example, the app is closed after the photo is taken), a storage rule deletes it, normally within two days | We don't need the image once Textract has produced the structured summary |
| Identity verification result (face-match score, and the name, date of birth, address, document type and expiry date read from your ID) | Until account deletion, then deleted with the rest of your data | An alert can only be raised once your identity is verified, so we keep the result for as long as your account is open |
| Verified selfie photo | Until account deletion, then deleted with the rest of your data | Required for responder identification during a live incident |
| Property alarm event history | 7 years post incident, then anonymized | Audit, investigation, and legal-defence retention |
| Geofence boundary | While the geofence is configured, deleted when you remove it | Operational |
| Geofence crossing events | 1 year from when we receive them, then automatically deleted | Shown live to your circle when they happen; kept for incident reconstruction if a customer disputes a dispatch decision |
| Duress alert record (start and end times, most recent position, how the alert ended, who responded, the messages we sent, your status updates, responder notes) | Until account deletion, then deleted. An alert under a recorded legal hold is kept only for as long as the proceedings need it. The responders' own record that they attended is kept without your name, contact details or location | So you can look back at your alerts, and so we can review how an alert was handled and answer any dispute about it |
| Duress alert route (location points during an alert, only if you chose to keep your route) | 90 days from when each point reaches us, then automatically deleted. Kept longer only under a recorded legal hold, and only for as long as the proceedings need it | Lets a responder see which way you were heading and work out where to meet you, and lets an alert be reviewed afterwards |
| Duress audio recordings | 90 days, then automatically deleted. Deleted sooner — within 24 hours — if you withdraw your audio consent. Kept longer only under a recorded legal hold, and only for as long as the proceedings need it | Preserves an evidence record for responder follow-up and any investigation or dispute. The period is set by what that purpose actually needs, per the fifth data protection standard (s.28(1)(a)), which imposes a necessity test rather than a fixed maximum. Access is limited to the responders handling that alert, and every playback is logged |
| Emergency contact records | While the protected person is on a plan, deleted on removal or account deletion | Operational |
| Customer support tickets | 3 years from closure | Industry standard, complaint-handling continuity |
| Anonymized analytics | Indefinite once anonymized | No personal data after anonymization |
We share personal data only with the third parties listed below, only as needed to deliver the service, and only under data-protection agreements where the third party is acting as our processor. The current list also lives in the standalone Sub-processor list (see Section 14).
When you trigger a panic, when your alarm cannot be cancelled within the entry-delay window, or when sensor activity indicates an active intrusion, fire, or CO incident, we transmit to the responder handling your incident the data they need to respond: your name, your home address, the nature of the incident, the location of the device that raised the alarm, and (on Personal Safety) your verified selfie, your location as it updates during the alert, and, if you chose to keep your route, the route so far.
Where you have consented to audio, short recordings of the active alert are stored by AegisProtect for the period stated in Section 5 and can be played back by the responders handling that alert. Playback is scoped to those responders: being a member of the right organisation is not enough, the record must show that responder was actually dispatched to your incident, and routine access ends a short period after the incident closes. A supervisor can reach past that scope where an incident genuinely requires it, but only by giving a reason that is recorded. Every playback — by anyone, including you — is written to an access log. Which responder receives the data depends on your tier and location:
us-east-2 (Ohio, United States). Adjacent: us-east-1 (N. Virginia) for the Alexa Smart Home skill Lambda.AegisProtect's infrastructure runs on AWS in the United States (us-east-2 primary; us-east-1 for one Alexa-related Lambda). Operating the service therefore involves transferring your personal data outside Jamaica.
We rely on two grounds under DPA section 22:
The DPA gives you the following rights, which we honour within the statutory timeframes:
A request for your own recording is an access request under section 6, and we answer it within the 30 days section 6(4) allows. It works differently from the rest of your data, and the reason is worth stating plainly.
A duress recording almost always contains someone else's voice — the person who threatened you, a bystander, a family member — and their voice is their sensitive personal data exactly as yours is. Section 8(2) provides that we are not obliged to comply with an access request where doing so would disclose information about another identifiable individual, unless that person consents or it is reasonable to proceed having notified them. So we do not release recordings automatically; a person reviews each request against that question and records the answer.
What you get immediately, because section 8(3) requires us to give whatever can be given without identifying anyone else: confirmation that a recording exists, how many segments it has, when it was made, and the date it is due for deletion. What you get after review: the recording itself, if releasing it is lawful. If we withhold it, we tell you which provision we relied on. We may also have to withhold a recording where releasing it would prejudice the investigation or prosecution of an offence (section 34(1)); that is assessed on the individual request, never applied as a blanket rule.
A release is time-limited. It answers the request you made; it is not standing access to the recording for the rest of its retention period.
If you are an OWNER_SECONDARY member of a Property site or a protected person on a Personal Safety subscriber's plan, you are a separate data subject with your own rights. Today the in-app Privacy settings act on the data of the logged-in account holder only — they do not yet traverse your relationship with someone else's account. To exercise your data rights in this case, contact privacy@aegisprotect.io with a brief description of your relationship to the account, and we will manually process your request within the statutory deadlines.
We are working on a self-service path for this case (tracked internally as gh:407). Until it ships, the contact-us path is the supported route.
AegisProtect's products are not directed at children under 18. The Property service requires the account holder to be 18 or older. The Personal Safety service may include a minor as a protected person on a parent's or guardian's subscription, with parental consent captured at enrolment (see the minor-consent screen described in our onboarding-consent-copy). We commit to notifying the family at the protected person's 18th birthday so that the now-adult can take over their own account or opt out.
We do not knowingly collect personal data directly from children under 18. If we learn that we have, we will delete it promptly.
On aegisprotect.io we use a small number of first-party cookies for session state and CSRF protection. We do not use third-party tracking cookies, advertising pixels, or session-replay tools. The mobile apps use device-local storage equivalent to cookies; the same restraint applies.
We may update this policy. Material changes require re-acceptance via the in-app consent flow before the change applies to your account. We will notify you by email and an in-app banner at least 14 days before any material change takes effect.
Non-material changes (a typo, a sub-processor address update) take effect on the date stamped at the top of this policy without re-acceptance.
A version history is maintained at aegisprotect.io/legal/privacy/history.
If you believe we have processed your personal data unlawfully, we want to hear about it first so we can put it right. Contact privacy@aegisprotect.io and we will respond within 30 days.
You also have the right to lodge a complaint with the relevant data-protection supervisory authority.
Our current list of sub-processors and the categories of data each receives is published at aegisprotect.io/legal/sub-processors and travels with each version of this policy in the same repository.
Document version: v1.3.4 Last updated: 2026-10-10