Privacy Policy

Babbar Operations LLC ("Babbar Ops," "we," "us," or "our") operates the Babbar Ops website and the Babbar Ops portal and services (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, and protect information.

Babbar Ops provides Services primarily to public safety agencies and other organizational customers. Individual users typically access the Services only as Authorized Users acting under the authority of a Customer.

If you use Babbar Ops through an agency or organization, that agency or organization may control how the Services are configured and used. In that case, we process certain information on their behalf as a service provider and processor (see Section 5), and your agency's policies may also apply.

1. Scope

This Privacy Policy applies to:

• Visitors to our public website
• People who request a demo or contact us
• Authorized Users of the Babbar Ops portal (when accessed through a customer account)

This Privacy Policy does not cover third-party websites or services linked from our Services.

2. Key definitions

• Customer: The agency, organization, or entity that contracts for the Services.
• Authorized User: An individual permitted by a Customer to access the Services (e.g., field team, incident command, leadership).
• Customer Data: Data submitted to or generated within the Services by or on behalf of a Customer or its Authorized Users.
• Personal Information: Information that identifies, relates to, or could reasonably be linked with an individual (as defined by applicable law).

3. Information we collect

A) Information you provide directly

Website / sales

• Name, email address, phone number (if provided)
• Agency/organization name, role/title (if provided)
• Messages you send us (demo requests, emails)

Support

• Information you provide when contacting support (issue descriptions, screenshots, attachments, logs you choose to share)

B) Information processed through the Services (portal use)

Account and access information

• User identifiers (name, email, username)
• Role/permissions assigned by the Customer
• Authentication signals (e.g., SSO/MFA status)

Incident plan content (real time collaboration)

• The Services may process incident plan inputs (e.g., notes, assignments, map objects) in real time for collaboration.
• Incident content is written to the Customer’s own instance and kept there as a Customer record. See section 7 for retention.
• Customers may choose to export incident content to PDF. Exported PDFs become Customer records and are governed by the Customer's own policies (including any evidence/records retention requirements). Generated exports are stored in the Customer's instance alongside other incident content.

Live video and stream-related information

Babbar Ops transmits live video for real time situational awareness only. The Services do not record, capture, or retain live video. Video passes through the Services transiently to enable live viewing and is not written to storage by Babbar Ops. Any recording of an operation, if performed, is done by the Customer's own systems and is outside the Services. The Services may process stream connection metadata (e.g., stream ID, timestamps, health/quality metrics) and device and network signals necessary to deliver video reliably.

C) Information collected automatically

Device and usage data

• IP address, device identifiers, browser type, operating system
• Pages/screens viewed, feature usage, and timestamps
• Diagnostic events (crashes, performance metrics)

Cookies and similar technologies (website)

We may use cookies and similar technologies for:

• Security (e.g., fraud prevention, CSRF protection)
• Basic functionality (e.g., session management)
• Analytics (to understand how the website is used)

You can control cookies through your browser settings. Some cookies are required for the website to function.

4. How we use information

We use information to:

• Provide, operate, and maintain the Services
• Authenticate users and enforce role based access controls
• Support live operations reliability (e.g., stream health monitoring and delivery)
• Provide auditability and troubleshooting (e.g., access and security event logs)
• Respond to requests, provide support, and communicate with you
• Improve the Services (bug fixes, usability, performance)
• Comply with legal obligations and enforce our terms

5. Our role and content captured in video

Our role. For Customer Data — including any individuals or property captured in live video — Babbar Ops acts as a service provider and processor that handles such data solely on the Customer's behalf and at the Customer's direction, and not for its own purposes. The Customer is the controller of Customer Data and is responsible for determining the lawful basis for its collection and use, for providing any notices required of it, and for operating the Services in compliance with applicable surveillance, privacy, civil rights, and recording laws.

Individuals captured in video. Live video may incidentally capture identifiable individuals, vehicles, locations, and property, including persons who are not Authorized Users or Customers. Babbar Ops does not use this content for any purpose other than transmitting it to the Customer's Authorized Users in real time, does not analyze it to identify individuals, and does not retain it. Because such content is captured and used under the Customer's authority and operational control, requests concerning individuals appearing in video should be directed to the relevant Customer agency, which controls the operation and any resulting records. Babbar Ops will reasonably support Customers in responding to such requests as required by the Customer Agreement and applicable law.

Agency records. Babbar Ops is not the custodian of agency public records. Determinations regarding public records requests, evidence preservation, disclosure obligations, retention schedules, and legal holds remain the responsibility of the Customer.

6. How we disclose information

We may disclose information in the following circumstances:

A) With the Customer and its administrators

Customer administrators can access and manage Authorized User accounts and permissions. Customers control who has access and which roles are provisioned.

B) Service providers (subprocessors)

We may share information with vendors that help us operate the Services (e.g., cloud hosting, monitoring, email delivery, customer support tooling). These providers are authorized to process information only as necessary to provide services to us and are bound by confidentiality and security obligations. Customers may request a current list of subprocessors by contacting us.

C) Legal, safety, and compliance

We may disclose information if we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or lawful governmental requests
• Protect the rights, safety, and security of our customers, users, or the public
• Prevent fraud, security incidents, or misuse

D) Business transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be disclosed as part of that transaction.

7. Data retention

Retention differs by data type. Live video is never retained. Incident content is the agency’s own record and is kept under the agency’s retention schedule.

• Incident content: The Customer’s record, held in the Customer’s own instance. Retention follows the Customer’s records schedule. Babbar Ops does not delete Customer records except at the Customer’s direction or where required by law.
• Exports (PDF): When a Customer exports incident content to PDF, the exported file becomes a Customer-controlled record subject to the Customer's policies. Generated exports are stored in the Customer's instance and retained on the same basis as other incident content.
• Live video: Not recorded or retained. Transmitted transiently for live viewing only.
• Access and audit logs: Retained for a minimum of 365 days, consistent with the CJIS Security Policy audit-retention requirement (AU-11), and for the longer period required where the logs are themselves Customer records subject to a public-records retention floor. Access and audit logs may include user identifiers, login events, authentication activity, IP addresses, role changes, administrative actions, stream connection events, and system security events.
• Website contact/demos: Retained as needed to respond and maintain business records.

Customers may request additional retention details and documentation.

8. Where we process information

Babbar Ops processes and stores information within the United States. Where a Customer's use of the Services involves criminal justice information, the applicable handling, security, and compliance requirements (including any CJIS-related obligations) are set out in that Customer's Customer Agreement. References to CJIS or similar requirements do not constitute a representation that the Services satisfy any particular compliance standard unless expressly stated in a written Customer Agreement.

9. Security

We maintain administrative, technical, and organizational measures designed to protect information, including (as applicable):

• TLS-encrypted transport for portal and dashboards
• Role-based access controls
• Access logging and auditing
• Least-privilege internal access and operational monitoring
• Encryption at rest under a customer-managed key. For Incident Command deployed in AWS GovCloud, media stored in Amazon S3 is encrypted with SSE-KMS under a customer-managed KMS key with automatic key rotation enabled, and all four S3 public-access blocks are enabled at the bucket level. The Aurora PostgreSQL cluster is encrypted at rest with the same customer-managed key, with deletion protection enabled by default.
• No static database password in the application path. Database access uses IAM authentication with short-lived credentials; the master credential is generated and rotated by AWS into Secrets Manager rather than stored in configuration.
• AI processing stays inside GovCloud. Where AI features are enabled on an Incident Command GovCloud deployment, inference runs on Amazon Bedrock in the AWS GovCloud (US-West) region using a GovCloud inference profile. It is not processed in a commercial AWS region.

These are the controls we operate, described precisely so an agency’s IT reviewer can verify them. They are not themselves a compliance certification. Where an agency requires a CJIS Security Addendum, that is executed as part of the Customer Agreement.

No system can be guaranteed 100% secure. Customers are responsible for managing user access, permissions, and configurations in line with their policies.

In the event of a confirmed security incident affecting Customer Data, Babbar Ops will notify affected Customers without undue delay, consistent with applicable law and the Customer Agreement.

10. Your choices and rights

A) Authorized Users (portal accounts)

If you access the Services through a Customer (e.g., your agency), contact your Customer administrator for requests to:

• Access, correct, or delete account information
• Change permissions/roles
• Export records (where applicable)

B) Website visitors

You can:

• Opt out of marketing emails via unsubscribe links (where provided)
• Control cookies in your browser settings

C) California privacy rights

If you are a California resident, you may have rights to request access to or deletion of certain Personal Information. We do not sell Personal Information, and we do not share Personal Information for cross-context behavioral advertising.

To exercise applicable rights, contact us at security@babbarops.com.

11. Children's privacy

The Services are not directed to children under 13, and we do not knowingly collect Personal Information from children.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will update the effective date at the top of this page. Material changes may be communicated through the website or the Services.

13. Contact us

Babbar Operations LLC
4120 Douglas Blvd, Ste 306-5065
Granite Bay, CA 95746
Email: security@babbarops.com