Version 1.0 — Effective October 15, 2026 — Posted at defendeye.com/homepage/privacy-policy-2/

This Privacy Policy explains what personal information DefendEye collects, how we use it, who we share it with, and the choices you have. It covers the website defendeye.com (the “Website”); the DefendEye Cloud and the Appless control interface (together, the “Cloud”); the OverWatch drone system and its support services (the “System”); and our sales, support, and business communications. The DefendEye Terms and Conditions at defendeye.com/homepage/terms-and-conditions-us/ (the “Terms”) govern the System and the Cloud. Where this Policy and Section 11 of the Terms differ about Customer Data, the Terms control.

Summary

This summary helps you read the Policy. The full Policy controls.

• What we collect. The business contact details you give us, the account and login data needed to run the Cloud, and technical data from the System (serial numbers, firmware versions, diagnostics, flight telemetry).
• Customer video belongs to the customer. Video, images, and flight logs captured by an agency’s drones belong to that agency. We host them in Amazon Web Services data centers in the United States and keep recordings for 30 days by default. DefendEye staff do not view them; they are available only inside the agency’s own Cloud portal (Section 8).
• No selling, no AI training on your video. We do not sell personal information. We do not use customer video or images to train artificial-intelligence models unless the customer opts in in writing.
• Remote ID. Each OverWatch drone broadcasts Standard Remote ID messages, as FAA rules require. Anyone within radio range can receive them.
• Your rights. You can ask us to access, correct, or delete your personal information at support@defendeye.com (Section 9).

1. Who we are

“DefendEye”, “we”, and “us” means the following companies:

• Defendeye USA, Inc., a Delaware corporation, 1025 E. Hallandale Beach Blvd., Suite 1720, Hallandale Beach, FL 33009, USA. It operates the Cloud, sells the System in the United States, and is responsible for the personal information of United States customers and of Cloud users.
• Defendeye P.S.A., Gromadzka 46A, 30-719 Kraków, Poland (KRS 0001022929, NIP 6812097814). It operates the Website, develops the System, and is responsible for the personal information of Website visitors and of customers outside the United States. For people in the European Economic Area, the United Kingdom, and Switzerland, Defendeye P.S.A. is the data controller.

The two companies are affiliates and share personal information with each other as described in Section 6. Contact for privacy matters: support@defendeye.com, or either postal address above. We have not appointed a data protection officer; privacy questions go to that email.

2. Three kinds of information

We treat information differently depending on what it is:

• Personal information about you, whether you are a Website visitor, a customer or reseller contact, a Cloud user, or a support contact. This Policy applies to it in full.
• Customer Data: video, images, detections, locations, flight logs, and other content captured or uploaded by a customer’s System. The customer (for example, a police department) owns and controls it and decides how it is used, kept, and disclosed. We process it as the customer’s service provider under the Terms. If you are a member of the public who appears in a customer’s video, contact that agency: we cannot identify you and we do not control that footage (Section 8).
• Usage Data: technical and diagnostic information about how the System and the Cloud perform, which does not identify a person once it is separated from account data. We use it to run, secure, and improve the System.

3. What we collect

3.1 Information you give us

• Contact and demo requests: name, email, phone, agency or company, title, and your message.
• Orders and billing: business contact details, billing and shipping addresses, purchase-order numbers, tax-exemption certificates, and payment status. When you pay online, Stripe, Inc. processes the payment. Card numbers go to Stripe, not to us.
• Cloud and Appless accounts: name, work email, phone, agency, role (administrator, operator, or viewer), a badge or ID number if your agency enters one, and login credentials. The agency administrator creates and manages these accounts.
• Terms acceptance records: when you click “I agree” in the Cloud, we record your user name, agency, date, time, IP address, the Terms version, and the serial numbers of the System you accepted for. We keep these records as evidence of acceptance.
• Support and warranty: your contact details, serial numbers, descriptions of the problem, photographs, log files, and return-shipping details.
• Training: attendance and completion records for operator onboarding.
• Job applications, if you apply through the Website or by email: your résumé and the information in it.

3.2 Information collected automatically

• Website: IP address, browser and device type, pages visited, referring page, and date and time. Today the Website uses only the cookies needed to operate it, with no analytics or advertising trackers. If we add an analytics or marketing tool, we will name it here and, where the law requires it, ask for your consent before it sets cookies. The Website loads fonts from Google Fonts, so Google receives your IP address when a page loads. We do not respond to “Do Not Track” browser signals.
• Cloud and Appless: IP address, browser and device type, login times, session information, and an audit log of actions in the Cloud (logins, video views, downloads, shares, and settings changes) with the user and the time. When someone opens a shared video link, the Cloud may record the time, IP address, and browser used.
• System telemetry: the serial numbers of each drone and Ground Control Module, firmware and software versions, battery, motor, and sensor statistics, error reports, the drone’s GPS position and altitude, flight time, distance from launch, cellular-modem identifiers (such as the IMEI and SIM number) where the Cloud records them, signal data, and the AI-detection metadata (bounding boxes) sent with the video stream. Flight positions and detection metadata are part of the customer’s Customer Data; the diagnostic parts are Usage Data.
• Email: whether our service and marketing emails are opened or clicked, where our email provider reports it.

3.3 Information from others

• Resellers and channel partners (AT&T, FirstNet, GetWireless, and other authorized resellers) send us the order, shipping, and contact details we need to deliver, activate, and support your System.
• Carriers and connectivity providers: shipment tracking and delivery records, and the activation status of the cellular service in your Ground Control Module.
• Public sources: agency websites, directories, and professional networks, used for sales outreach to public-safety and government buyers.

3.4 What the drone broadcasts

Each OverWatch drone broadcasts Standard Remote ID messages as FAA rules require (14 CFR Part 89): the drone’s serial number, its position, altitude, and velocity, the take-off (control station) location, and a time mark. Anyone within radio range with a Remote ID receiver can receive these messages. DefendEye does not collect them from the air and cannot control who receives them.

4. How we use information

• To sell, deliver, activate, and support the System and the Cloud, including onboarding, returns, and warranty service.
• To run the Cloud: create and secure accounts, stream and store video for the customer, enforce the customer’s sharing settings, and keep the audit log that the customer relies on for evidence and public-records purposes.
• To keep records of Terms acceptance, orders, invoices, and warranties.
• To secure the System and the Cloud: detect and investigate unauthorized access, abuse, or attacks; verify signed firmware; and monitor for misuse of shared links.
• To improve the System: analyze Usage Data and diagnostics, fix bugs, and develop new features. We do not use Customer Data video or images to train artificial-intelligence models unless the customer opts in in writing.
• To communicate: service notices (safety, security, and compliance updates, outages, and changes to the Terms or this Policy), responses to your requests, and, for business contacts, information about products and events. You can opt out of marketing at any time (Section 9).
• To comply with law: export-control and sanctions screening, tax and accounting records, aviation and other regulatory requirements, and lawful requests from authorities (Section 7).
• To protect rights and safety: enforce the Terms, pursue or defend claims, and protect people and property.

5. Legal bases (EEA, UK, and Switzerland)

Where the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies, we rely on: performance of a contract (orders, accounts, support); our legitimate interests (securing the Cloud, improving the System, business communications with professional contacts, and defending claims), balanced against your rights; legal obligations (tax, export control, and responding to authorities); and consent, where we ask for it (for example, marketing emails to individuals who are not existing business contacts). You can withdraw consent at any time without affecting earlier processing.

6. Who we share it with

We share personal information only as follows:

• Service providers that process data for us under contract: Amazon Web Services (cloud hosting in the United States); Stripe (payments); email, customer-relationship, support-ticket, and e-signature providers; shipping carriers; and professional advisers (lawyers, accountants, and auditors).
• Resellers and channel partners: when you buy through AT&T, FirstNet, GetWireless, or another authorized reseller, we exchange order, shipping, activation, and support information with them. Their privacy policies govern the information they hold. The cellular service in your Ground Control Module is provided by the carrier under its own terms and privacy policy.
• Our affiliate: Defendeye USA, Inc. and Defendeye P.S.A. share account, order, support, and diagnostic data so that engineering and support staff in the United States and Poland can serve you. Customer Data (video, recordings, and flight logs) is not shared with either company’s staff: it is accessible only inside the customer’s own Cloud portal, to users the customer administrator authorizes (Section 8).
• Authorities and legal process: see Section 7.
• Business transfers: if DefendEye is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred to the successor, who must honor this Policy.
• At your direction: for example, when a customer administrator shares a live video link or asks us to connect the Cloud to a third-party platform such as a computer-aided dispatch or evidence-management system.

We do not sell personal information, do not share it for cross-context behavioral advertising, and do not give advertisers access to it.

7. Requests from government and law enforcement

Customer Data belongs to the customer. If we receive a subpoena, warrant, court order, public-records request, or other demand for Customer Data, we will direct the requester to the customer and notify the customer promptly, unless the law prohibits notice. We disclose Customer Data only when legally compelled, and then only what is required. For personal information about Website visitors and account holders, we respond to lawful requests and may disclose information to prevent fraud, abuse, or imminent harm.

8. Customer Data: video, images, and flight logs

• Where it lives. Nothing is recorded or stored on the drone or the Ground Control Module. Video and telemetry are encrypted in transit (TLS 1.3 with AES-256) and at rest (AES-256) and are stored in the DefendEye Cloud in Amazon Web Services data centers in the United States. A dedicated or customer-owned cloud deployment can be arranged under a separate order.
• How long. Recordings and flight logs are kept for 30 days by default and then deleted. A customer administrator can set a different retention period for its agency. The customer, not DefendEye, is responsible for the retention, evidence, and public-records rules that apply to it.
• Who can see it. Only users the customer administrator authorizes, and viewers of temporary links the administrator creates (links expire after 1, 8, or 24 hours, as the administrator selects). Downloads are limited to the administrator.
• What we do with it. Host, stream, store, secure, and support it, and nothing else. DefendEye employees, in the United States and in Poland, do not view or access customer video, recordings, or flight logs. Customer Data is available only inside the customer’s own Cloud portal, to users the customer administrator authorizes, unless the customer asks us in writing for help with specific data or the law compels disclosure (Section 7). We do not run facial recognition, do not identify members of the public, and do not use the footage for marketing or AI training without the customer’s written opt-in.
• Members of the public. If you believe you appear in footage captured by an agency’s drone, contact that agency. It is the records custodian and decides on access and retention. DefendEye cannot identify you and does not act on the agency’s behalf.
• Criminal justice information. Where a customer designates data as criminal justice information, we handle it under the CJIS Security Addendum or the data-protection addendum signed with that customer (Terms, Section 11.6).

9. Your choices and rights

• Click “unsubscribe” in any marketing email or write to support@defendeye.com. We will still send service notices that affect safety, security, or your account.
• You can block or delete cookies in your browser. The Website and the Cloud still work, except for functions that need a session cookie, such as signing in.
• Access, correction, deletion, portability, objection, and restriction. Email support@defendeye.com with enough detail for us to verify who you are. We answer within 30 days (45 days where the law allows it and we tell you). We may refuse or limit a request where the law permits, for example to keep Terms acceptance records, audit logs, or tax records, or where the data is controlled by a customer. If your request concerns data an agency controls (your account inside that agency’s Cloud, or footage), we will refer you to the agency or act only on its instruction.
• Cloud accounts. Agency administrators can edit and delete user accounts in the Cloud. Deleting an account does not delete the audit-log entries that record what that user did.
• No discrimination. We will not treat you differently for exercising a privacy right.
• EEA, UK, and Switzerland. You may also complain to your supervisory authority. For Defendeye P.S.A., the lead authority is the President of the Personal Data Protection Office of Poland (Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
• United States state privacy laws. Residents of states with privacy laws (including California, Colorado, Connecticut, Florida, Oregon, Texas, and Virginia) may have rights to know, delete, and correct personal information and to opt out of its sale, sharing, or use for targeted advertising or profiling. DefendEye sells to agencies and businesses and does not sell or share personal information, and has not done so in the preceding twelve months; we honor these rights to the extent they apply. For California residents, the categories we collect are identifiers, commercial information, internet activity, professional information, and, as part of Customer Data, geolocation data, for the purposes in Section 4. An authorized agent may submit a request on your behalf with written proof of authority.

10. Where we store and transfer information

We store Customer Data in Amazon Web Services data centers in the United States. Account, order, support, and business data may be stored and accessed in the United States and in Poland by DefendEye staff and by our service providers. If you are in the EEA, the UK, or Switzerland, transfers to the United States are made under the European Commission’s Standard Contractual Clauses (with the UK addendum where relevant) or another lawful transfer mechanism. Contact us for a copy.

11. How long we keep it

• Cloud recordings and flight logs: 30 days by default, or the period your agency administrator sets.
• Cloud accounts, audit logs, and Terms acceptance records: for the life of the customer relationship and 7 years afterward, because they document who used the System and who agreed to the Terms.
• Orders, invoices, warranty, and return records: 7 years after the transaction.
• Support tickets and correspondence: 3 years after the ticket is closed.
• Website inquiries and demo requests: 2 years from the last contact.
• Marketing contacts: until you opt out, or 3 years after the last interaction.
• Backups: encrypted backups roll off within 35 days after data is deleted from the live system.

When a retention period ends we delete or de-identify the data, unless a legal hold or a dispute requires us to keep it.

12. Security

We protect information with encryption in transit and at rest, access controls and least-privilege roles, cryptographically signed firmware, audit logging, and independent penetration testing. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Customers are responsible for their own devices, networks, credentials, and shared links. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires (for Florida residents, within the time set by section 501.171, Florida Statutes; for EEA residents, under the GDPR’s 72-hour rule). Report security issues at defendeye.com/homepage/security-vulnerability/.

13. Children

The Website, the Cloud, and the System are for professional use by adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, email support@defendeye.com and we will delete it.

14. Changes to this Policy

We may update this Policy. The effective date at the top shows the current version. For material changes we will post a notice on the Website and, for Cloud users, show a notice in the Cloud or email agency administrators at least 14 days before the change takes effect. Continued use after the effective date means you accept the updated Policy. Earlier versions are available on request.

15. How to contact us

Defendeye USA, Inc.

1025 E. Hallandale Beach Blvd., Suite 1720, Hallandale Beach, FL 33009, USA

Defendeye P.S.A.

Gromadzka 46A, 30-719 Kraków, Poland

Email: support@defendeye.com · Website: defendeye.com