Privacy Policy

Last updated: 24 August 2026 — operated by Erbacci LLC (Wyoming, USA)

This policy is kept consistent with the Ring Privacy & Legal questionnaire and DumpWatch's actual behavior. If we change behavior, we update both.

1. Summary

• We connect to your Ring account via Ring's official Partner OAuth — we never see your Ring password.
• We analyze motion events and still snapshots from the cameras you designate, only to detect illegal dumping at a bin/dumpster area.
• Data minimization: for normal activity (someone simply using the bin with nothing dumped) we store only a detection label and timestamp — no image is kept. Snapshots are stored only as part of a confirmed illegal-dumping incident.
• Evidence (before/during/after snapshots, optional short clip reference) is kept for 90 days, then auto-deleted. You can export an evidence packet anytime; the exported copy is yours.
• We do not record audio, do not view live video, and do not run facial recognition or any biometric identification (no face, gait, or body-based identification of individuals).
• We never auto-share evidence with any agency, never correlate data across customers, and never sell your data.

2. Who this is for

DumpWatch is a business tool for property owners and managers. It is distributed through the Ring App Store in the United States, and its companion iPhone and Android apps are published worldwide. It is not directed to children and is not intended for anyone under 13.

3. What we collect

4. How we use it

• Dumping detection: snapshots are analyzed by AI vision. The primary analyser is a vision model running on equipment owned and operated by Erbacci (not a third-party AI service). When that equipment is unreachable, times out, or cannot answer confidently, the frame is analyzed instead by Anthropic Claude (Haiku 4.5) running inside Amazon Bedrock, with Amazon Rekognition beneath it. Frames are downscaled before analysis. We identify objects and scenes, not individuals.
• Where that analysis runs: the Erbacci-operated equipment classifies both frames we rely on — the one taken while a person is present and the follow-up taken after they leave, which is the frame that evidences an incident. Its answer is the one the product acts on; Amazon Bedrock is called only when that equipment fails to answer. This step is inference-only and in-memory: nothing is stored on that equipment, and no model is ever trained or fine-tuned on your data. Any error, timeout or low-confidence answer falls back automatically to the AWS analysis described above. The route this frame travels — and the countries involved — is set out under “Where processing happens”.
• Privacy zones: we read the privacy-zone configuration you set on your Ring device and mask (black out) those regions in every frame before it is analyzed by AI. If we cannot read that configuration, the frame is not analyzed at all.
• AI training: your images and data are never used to train or fine-tune any AI model. Under the AWS Bedrock and Amazon Rekognition terms, content sent for analysis is not used to train base models.
• Data minimization: analysis frames are discarded immediately after classification; images are persisted only as part of a confirmed-incident evidence packet, never for normal activity.
• Evidence: a confirmed incident produces a timestamped, integrity-hashed evidence packet you can review and export.
• Analytics: per-site incident counts and repeat-location summaries, computed only from your own sites — no cross-customer analysis.
• Email we send: we use your email address only for transactional, account-related messages — never marketing. These are: passwordless sign-in codes; alert/notification emails about confirmed incidents on your sites; and service notices about your account and subscription (free-trial-ending reminders, a "trial ended — monitoring paused" notice, a subscription-activated confirmation, and a prompt to reconnect if the Ring connection is lost); and, only if you ask for it from the setup page, a one-off message containing the links to install the DumpWatch apps. You can turn off non-critical service emails in your dashboard settings. We never send marketing or promotional email, and never use your Ring data for advertising or marketing.

5. Sharing with authorities

We never share your footage or evidence with police or any agency automatically. You decide whether to export an evidence packet and to whom. We do not run license-plate recognition, and there is no shared cross-customer database of people or vehicles.

6. Third parties / sub-processors

Most processing happens inside our own Erbacci-managed AWS account (EU region, eu-west-1); the one exception is the first-party AI analysis described under Where processing happens. We use the following sub-processors:

• Amazon Web Services — Lambda, S3, DynamoDB, Amazon Rekognition, and Amazon Bedrock — for compute, encrypted storage, and AI analysis.
• Resend (resend.com) — our email delivery provider, which receives your email address and the message content to send sign-in codes and alert/notification emails. Amazon SES is configured only as an inactive fallback and is not currently used to send email.
• Anthropic, accessed only through Amazon Bedrock, which receives a downscaled snapshot for classification and does not store it or use it for training.
• Apple (APNs) and Google (FCM), reached through Amazon SNS, which receive a device push token and the alert text (no images) to deliver mobile notifications.
• Contabo GmbH (Germany) — infrastructure provider hosting an Erbacci-managed relay server used solely to terminate TLS and forward analysis requests through an encrypted tunnel. It performs no processing of its own, has no logical access to request content, and retains no image. The machine that performs the analysis is Erbacci-owned equipment — first party, not a third-party service.

We use no data brokers and no advertising networks.

Where processing happens

All storage — snapshots, evidence packets, incident records, your account — is and remains exclusively in AWS, EU region (eu-west-1).

The AI analysis described above is the only processing that happens outside AWS. On that path the downscaled, privacy-zone-masked frames travel over TLS to an Erbacci-managed relay server in the EU (Germany), and from there through an encrypted WireGuard tunnel to an Erbacci-owned machine located in Dubai, United Arab Emirates, where it is held in memory only for the moment the check takes. No image is written to disk, cached, or retained anywhere on that path — only a short label comes back. The transfer is transient and encrypted end to end, and it exists to reduce how much of your footage needs full analysis at all.

To be explicit about what this equipment decides: its answer is the result. It is not a filter in front of a cloud service — it classifies both frames we rely on, and both a “dumping” and a “nothing happened” outcome can come from it. Amazon Bedrock and Amazon Rekognition are called only when it fails to answer — on error, timeout, or an unclear response — in which case the frame is analyzed in AWS instead.

7. Retention

8. Your rights & deletion

You can delete all your data instantly from the DumpWatch dashboard (self-service deletion action), and we confirm the deletion to you. Disabling DumpWatch or removing a camera in the Ring app purges that account's or device's sites, incidents, and stored evidence within 24 hours. You can also email info@erbacciltd.com (honored within 7 days). Any remaining evidence auto-expires after 90 days. We keep an internal audit record of deletion requests for compliance. UK/EU GDPR and US (CCPA/CPRA) rights — access, erasure, portability — are supported.

9. Security

• TLS 1.2+ in transit; S3 with AES-256 encryption and public access fully blocked; DynamoDB encrypted; least-privilege access controls; signed-webhook verification. Erbacci staff do not view your images — analysis is automated, and only you (the property owner) review the evidence packet.

10. Contact

info@erbacciltd.com