CamTrackTAAD Solutions Ltd
Privacy
Last updated: 7 September 2026
This notice explains how TAAD Solutions Ltd uses personal information when you visit taad.solutions or camtrack.io, use auth.camtrack.io to create or sign in to a CamTrack account, download or license CamTrack, or contact us.
On this page
Who is responsible
TAAD Solutions Ltd is the controller of this information. We are registered in England and Wales, company number 17424610. Our company information page gives our registered office address.
For a privacy question, account closure, rights request or complaint, email info@taad.solutions or write to our registered office. Product support is available at support@camtrack.io.
Your account and sign-in
For a password account, we collect your username, name and email address. We create an inactive account while you verify the address, then ask you to choose a password. We store the password as a secure hash, along with your account identifier, verification status, first-verification time and account status. Temporary verification information lets you finish a signup or reset a password securely. If your verification link expires, account recovery can send a fresh link to finish the same pending account. This does not restart an existing trial.
If you choose Google sign-in, we receive a Google account identifier, name, email address and verification information. We keep the connection and authorization information supplied for that sign-in, which can include access or refresh tokens. We do not receive your Google password. Google handles your interaction with its sign-in service under its Privacy Policy. You can use a password account instead.
We use account information to provide the account, authenticate you and deliver the CamTrack service you request. Our lawful basis is performing our agreement with you or taking requested steps before that agreement. Without the information required for sign-in and verification, we cannot provide account access. You do not have to contact us or choose Google sign-in to visit the public information pages.
Trials, installations and updates
Your one-year trial starts on the first successful sign-in from the installed CamTrack application. We associate your account identifier with that start date, the trial expiry and licence status. Each installation creates a random installation identifier; we record that identifier and its first and most recent successful licence checks. It is not derived from a hardware serial number or a hardware fingerprint. Additional installations for the same retained account use the same trial dates.
The application stores a sign-in refresh token, signed licence, installation identifier and offline-use state in macOS Keychain or Windows Credential Manager. A separate local integrity record helps detect changes to licence state. These records normally remain after uninstalling CamTrack. Contact us for help removing them; signing out of a download page does not remove them.
Update checks identify the supported operating system and processor architecture. An installer request identifies the requested file, platform and version. We do not maintain a separate per-user download-history table, although request information can occur in server logs.
We process this information to provide downloads, apply the agreed trial/licence conditions and supply requested updates. Our lawful basis is performing our agreement with you. Software automatically checks sign-in status, licence dates and the permitted offline opens; a failed check can prevent the application from opening. Contact support if you believe a check is wrong so a person can review it. We do not use these checks for advertising profiles.
CamTrack's account, licensing and update requests do not upload your images, project files or analysis results. Analysis takes place on your computer. You can separately choose to send files when asking for support.
Website delivery and account security
Our servers receive connection information needed to deliver the service, including IP address, request time, requested path and response status. Identity-service security events can also include your account identifier, username/email, browser information, approximate location/network derived from the IP address, and details of the sign-in or account action. We use this to investigate faults, protect accounts and respond to abuse. Our lawful basis is our legitimate interest in operating a secure, reliable service.
Signup and recovery use Cloudflare Turnstile to distinguish people from automated abuse. Cloudflare receives browser/network signals such as IP address, browser information, TLS fingerprint and the site origin. We send the challenge response and client IP for verification. Cloudflare acts as our processor when protecting this site and as a separate controller when improving its detection service; its Turnstile Privacy Addendum explains those roles. Our purpose is account security and abuse prevention, based on our legitimate interests.
Public information pages use no advertising cookies, analytics cookies, tracking pixels or embedded social-media widgets. Fonts and images are served with the website. Account avatars are generated locally from initials. We do not sell personal information or share it for third-party advertising.
Browser storage
Account pages use browser storage to maintain sign-in and protect requests:
| Storage | Purpose and lifetime |
|---|---|
CamTrack sign-in handoff cookie (__Host-camtrack-auth) | Connects the sign-in response to your browser; up to 10 minutes, removed after successful return. |
CamTrack download-session cookie (__Host-camtrack-session) | Provides access to downloads; up to 8 hours, removed when you sign out of that download session. |
Identity session (authentik_session) | Maintains identity-service sign-in and unfinished flows. The default login uses a browser-session cookie with a 24-hour server limit; signup/recovery sign-in sessions last up to 8 hours. A later sign-in can establish a new session. |
Request protection (authentik_csrf) | Helps prevent another site submitting account actions in your name; up to 364 days. |
Known sign-in device (authentik_device) | Helps recognise a previously used sign-in device; up to 30 days. This is separate from CamTrack's random installation identifier. |
Browser settings can remove or block stored information, but sign-in and protected downloads may then stop working. Browser session restoration can affect when a session cookie disappears. Google and Cloudflare describe their own browser processing in the provider notices linked above. Signing out of CamTrack's download page ends that download session; it does not necessarily end a separate identity-service or Google session.
Enquiries and support
When you contact us, we receive your email address, any name you provide, and the contents and attachments of your message. We use them to answer your enquiry and provide support. Our lawful basis is taking steps you request before an agreement, performing an existing agreement, or our legitimate interest in responding to business correspondence, as appropriate to the message.
Please send only what is necessary for your enquiry, including only relevant project files or images. Contacting us does not automatically give us access to other files on your computer.
Who receives information and where it is processed
Information is accessible to authorised people operating TAAD Solutions Ltd and its services. Our application servers are in the United Kingdom: a company-operated server in England and an OVHcloud instance in London supplied by OVH Limited. We replicate account and licensing records between them for continuity. Authentik is the identity software running on our infrastructure. Mail travels through the providers used by you and us. Google and Cloudflare receive information for the sign-in and security functions described above. We may disclose necessary information where required by law or to establish, exercise or defend a legal claim.
We keep encrypted account-backup copies on both UK servers and on the operator's Mac for recovery verification. Correspondence is stored by our UK mail server and synchronised to the operator's Mac, iPhone and iPad. Company documents and any correspondence deliberately saved with them may also be held in our company document folders and self-hosted Nextcloud service. Access by our operator can take place while travelling; these arrangements do not mean every copy is always physically in the UK.
OVH Limited uses group companies and service providers for hosting support and maintenance. Its data-processing agreement distinguishes the selected UK datacentre from remote processing and provides for safeguards where its UK-hosted services involve transfers to countries without UK adequacy recognition.
Google LLC and Cloudflare, Inc. can process sign-in or security information outside the UK, including in the United States. Google's controller terms and Cloudflare's data-processing addendum provide contractual transfer safeguards, including standard contractual clauses adapted for UK transfers. The providers also describe their use of recognised transfer frameworks in Google's transfer information and Cloudflare's Privacy Policy. Those terms and notices explain the relevant arrangements; you can contact info@taad.solutions for further information or a copy of the applicable safeguards, with confidential material redacted where necessary.
How long information is kept
We use the following ordinary retention periods. A record becomes due for deletion when the period ends. Account records are checked daily; an authorised operator reviews due accounts and carries out deletion after checking recent activity and any justified exception. We may need a limited exception for a particular unresolved legal obligation, dispute or security incident. We restrict such records to that purpose, review the need and remove them when the reason ends.
| Information | Ordinary retention |
|---|---|
| Unverified password signup | 7 days from first creation, including its pending verification record. Requesting another email does not restart this period. |
| Verified account that has never started a desktop trial | Until 12 calendar months have passed since your last successful website sign-in, starting at verification if there has been no later use. |
| Trial account, licence and linked installations | Until 12 calendar months have passed since your latest successful website sign-in or authenticated online CamTrack licence check from a copy activated by your account. A check confirming that your trial has expired also restarts this retention period. You can request earlier closure. |
| Security events | 90 days from the event, followed by background expiry. |
| Routine operational logs | Up to 30 days, often less under storage limits. |
| Enquiries | 24 months after resolution or the last substantive correspondence, whichever is later. Unneeded project/image attachments are removed within 90 days after the enquiry is closed. |
| Temporary CamTrack login/download state | Valid for 10 minutes / 8 hours respectively; consumed or signed-out records are removed earlier, and expired records receive minute-based cleanup. |
We record successful website sign-ins and authenticated online licence checks to apply this inactivity period; your first successful CamTrack activation counts. This does not extend or restart your one-year trial. Offline use, failed or anonymous requests, unrelated bot traffic, token refresh alone, background page/download requests and support enquiries do not restart the account-retention clock. The separate seven-day period for unverified signup is not extended by requesting another verification email.
Identity authorization codes last one minute, access tokens fifteen minutes, and desktop refresh tokens up to ninety days with rotation. Email verification/recovery links are short-lived, about thirty/fifteen minutes. Related account records are governed by the account periods above. An expired token is unusable even if an outage or cleanup backlog delays physical deletion of its record.
We retain up to seven successful encrypted account-backup generations per server, with an ordinary maximum age of thirty days, including peer and operator verification copies. Older account records can remain in these protected copies until the archive expires. OVHcloud also provides a separate daily server snapshot: its Standard backup description states twenty-four-hour routine retention and a thirty-day archive period after service cancellation. We keep backup data out of ordinary use; a restore must reapply completed erasures before account services reopen. A sleeping or disconnected operator device catches up when it returns. Failed expiry jobs require investigation and retry; we do not treat a failure as an indefinite retention exception. If a specific incident requires a temporary exception, we restrict access and review it weekly.
The account-backup job does not back up our mailbox. Correspondence review covers the mail server, synchronised devices, sent and deleted mail, and deliberately saved attachments or exports. The mail service also makes a local daily copy of its preferences, calendars and contacts. We review relevant retained copies when handling erasure; deleting a CamTrack account alone does not delete separate correspondence.
Account closure and deletion
Contact info@taad.solutions to request closure or erasure. We may ask for proportionate information to verify that the account is yours. We aim to remove ordinary active account data within seven days of verified closure and explain any information that must be kept for a specific lawful reason.
Full account erasure removes the identity, linked sign-in connections/authorizations, licence, installation records and account/download sessions from our active systems and replicas. It does not delete a separate Google account, emails already held by your mail provider, or files and credentials on your own computer. A disconnected installation cannot be remotely wiped; an already issued offline licence remains subject to its existing expiry and offline-open limit.
We retain a restricted record of the former account UUID and erasure status solely to prevent an old backup restoring the deleted account. It contains no email address or email hash for recognising another trial. We remove that record after all recoverable older copies are gone and a further thirty-day verification period has passed, normally within sixty days of erasure. A documented older archive can extend that period.
If you later create an account after full erasure, it receives a new identity and may be eligible for a new trial. Recovering or reinstalling under an existing account keeps its existing trial dates.
Your rights
Depending on the circumstances, you can ask to access or correct your information, have it erased, restrict its use, or receive a portable copy. We respond without undue delay, normally within one month, and explain if the law permits extra time or requires us to retain particular information. Contact info@taad.solutions.
You have the right to object to processing based on our legitimate interests. Tell us about your circumstances so we can consider your objection and explain our response.
You can complain to the UK's Information Commissioner's Office through its complaints service. You can contact us first, but you do not have to do so to raise a concern with the ICO.