Privacy

We set no cookies and use no advertising or marketing trackers. We do count page views, using Cloudflare Web Analytics: each page loads a small script from Cloudflare that records the page visited, the page you came from, and coarse details such as country and browser, and it sets no cookie and no identifier that follows you to any other site. The contact form is protected by Cloudflare Turnstile, which loads from Cloudflare on that page only and looks at signals from your browser to tell people from automated scripts; it is not used for advertising. These two Cloudflare services are the only parties outside Roboblackbox that your browser contacts on this site. Our web host keeps standard server logs (IP address, requested page, time) for up to thirty days for security and capacity; we do not analyse them for marketing. If you email us, we keep your message and reply in our mailbox for as long as the conversation is useful, and we delete it when you ask. If you use the contact form, we store your name, work email, company, and message, and email you a link to confirm that the address is yours; only after you confirm do we send your message to our team's mailbox so that we can reply. We keep it on the same terms as an email. We do not sell, rent, or share contact details with anyone.

A Roboblackbox appliance sits at the operator’s site and records available robot publications. The architecture brings together robot publications, facility states, video-derived observations, and operator declarations through authorized, supported integrations. Camera footage is retained on site and referenced by the record; the recorder does not ingest raw video. Camera footage and video-derived observations remain distinct evidence types. The raw record stays on the appliance. Three kinds of data leave the site on their own, all agreed at signing: a small heartbeat (about 500 bytes a minute: health, versions, disk, clock); the fingerprint of each sealed record (a hash, not the content), so that we can later show the record was not changed; and, at the close of each period, the findings and summaries the appliance derived from the record (counts, rates, hours of motion, the worst example of each finding with a reference into the record). No raw messages and no positions of people are in those summaries. If the recorder crashes or an update rolls back, the appliance also sends a diagnostic bundle of its own service logs. Nothing else leaves unless the operator asks for it.

The camera architecture retains video at the operator-controlled site. Video footage and video-derived observations are separate evidence types. Derived observations may include anonymous person-class tracks and estimated distances, with processing context and uncertainty; a track does not establish a person’s identity. Camera access, retention, and the scope of derived summaries are defined with the operator for the authorized recording scope.

No orders, inventory, customers, or business data are included in the documented robot capture scope. No names, badges, or identities of people on the floor are collected as telemetry. The fleet’s own perception may publish a person position; the record preserves it as published, without linking it to an identified person. The purpose is operational evidence, not worker productivity monitoring.

Robot-published information and facility controller/device states retain their source attribution. Camera video remains separate from video-derived object tracks, estimated speeds, and distance observations. Operator declarations record attributed rules, changes, and effective dates; they are context supplied by the operator, not independent measurements.

The operator controls authorized access. The telemetry retention and outbound-data commitments below describe the robot-publication record. Camera footage and perception-track retention are defined separately for the authorized recording scope.

Beyond the three streams and the failure bundle above, only with the operator's action: an incident window the operator asks us to preserve and upload, or a report the operator exports. Where a site is operated by one company and the robots by another, both must consent. Every export is recorded in the appliance's own record with who requested it and when.

The operator sees everything on its appliance. We see the heartbeat, the fingerprints, the derived findings and summaries, and whatever the operator has uploaded. An insurer or broker sees a document only when the operator shares it. We never provide underwriters with a live view of an operator's fleet, and we never sell or license fleet data to anyone, including for training models.

The appliance keeps seven days of raw records by default and preserves incident windows until the operator releases them. Derived findings and record fingerprints are kept for the life of the service. When a pilot or contract ends, the operator keeps its record and we take the box; uploaded data is returned or deleted at the operator's choice, and our copy of the fingerprints stays so the returned record can still be verified.

If you are a person whose position may have been recorded at a site running Roboblackbox, the operator of that site is the controller of that record; we act on its instructions. For questions about this site or about our handling of data: privacy@roboblackbox.com. Roboblackbox, LLC, a Delaware company, Seattle, Washington.