Effective 2026-05-01

Computer Vision Privacy Disclosure

slug: cv-privacy-disclosure title: Computer Vision Privacy Disclosure documentType: cv_privacy_disclosure version: "2.0" appContext: platform requiredForRole: "none" displayOrder: 11 mustAcceptToUse: false effectiveDate: 2026-05-01 jurisdiction: WA summary: | How the on-device computer vision system inside OOHAi advertising equipment works — what data is and is not collected from passers-by and passengers.

11 — Computer Vision Privacy Disclosure

Effective Date: 1 May 2026 Controller: OOHAi Media Pty Ltd as trustee for the OOHAi Media Unit Trust ("OOHAi Media", "we", "us", "our"). Joint controller (vehicle-mounted equipment): OZ Ride Pty Ltd (ABN 52 694 735 487) for the limited purpose of operating the Player Tablet inside a Vehicle that is connected to a Trip. Governing law: Western Australia, Australia. Defined terms: Capitalised terms not defined in this document have the meaning given in 00 — Definitions.

This Computer Vision Privacy Disclosure explains in detail how the privacy-first computer vision technology inside OOHAi advertising equipment operates, what data is and is not collected, and how we ensure the privacy of pedestrians, passengers, and the general public who come into the field of view of that equipment.

This disclosure applies to the computer vision sensors deployed on:

  • Player Tablets (passenger-facing in-car displays mounted in Driver Vehicles).
  • Car Toppers (roof-mounted digital displays), where deployed.

It does not cover any data we collect from Riders who book Trips on the OZ Ride platform — that is governed by the Privacy Policy.

1. Privacy-first by design

Visual data captured by the computer vision sensor is processed entirely on the device and discarded immediately after processing. No video, no photographs, and no biometric template ever leaves the device. Only aggregated, non-identifying impression metrics are transmitted off-device.

2. Technology overview

2.1 What the sensors do

The computer vision sensor detects whether a face is present in the device's field of view, performs face detection (not facial recognition), and counts impressions. Demographic estimates (age range, gender, attention duration, predominant emotion) are inferred locally for advertising-effectiveness measurement and are aggregated immediately on-device.

The sensors do not identify any specific individual.

2.2 How it works, step by step

  1. Capture. The camera produces a video frame in device memory.
  2. Local inference. An on-device TensorFlow Lite / Google ML Kit pipeline (server/services/cvEngine.ts orchestrator + native FaceAnalysisModule.kt on Android) detects faces and infers demographic estimates from the frame.
  3. Discard. The frame is overwritten in memory immediately after inference. There is no fs.write of the frame.
  4. Aggregate. A counter (e.g., impressionsLastHour++) is incremented in local memory.
  5. Transmit. Periodically — typically once per minute — only the aggregate counts are sent off-device to OOHAi servers. The transmission contains no images, no biometric templates, and no individual records.

3. What data is NOT collected

The following data is never collected, stored, or transmitted from the equipment:

  • No video footage. Frames are processed in memory and overwritten before the next frame.
  • No photographs or screenshots.
  • No raw visual data is ever uploaded to OOHAi servers, Cloudflare R2, AWS S3, or any third party.
  • No facial recognition, facial template, or biometric identification.
  • No personally identifying information about a viewer.
  • No tracking of an individual across time, location, or multiple sightings.

4. What data IS collected

The only information transmitted from the equipment is:

  • Aggregate impression counts — anonymous numeric tallies of detected impressions, reported by hour and by geographic zone.
  • Geographic zone — suburb-level location of the equipment at the time of the impression. Not precise GPS.
  • Timestamps — hourly aggregates, not exact seconds, except for diagnostic events.
  • Equipment status — device health metrics (power, connectivity, brightness).
  • Anonymised demographic distribution — the share of impressions in each age band (e.g., 18–25, 26–35) and gender category, aggregated across many viewers. Individual records are never transmitted.
  • Anonymised attention metrics — average dwell and gaze duration in aggregate.
  • Anonymised emotional response indicators — aggregate engagement signals (e.g., share of viewers smiling). Individual emotional records are never transmitted.

A representative report to an Advertiser would read: "Your campaign received 5,000 impressions in Perth CBD between 8:00 and 10:00 on weekdays, with 60% of viewers in the 25–34 age range and an average attention duration of 3.2 seconds." No individual viewer can be identified from any such report.

5. Data flow architecture

Camera frame ─▶ On-device CV pipeline (TFLite + ML Kit) ─▶ Counter +1
                                                            │
Frame overwritten in memory ◀───────────────────────────────┘
                                                            │
                          (every ~60s)                      ▼
              Aggregate report ─▶ TLS ─▶ OOHAi advertising backend
                                       (campaign analytics + billing)

No step in this pipeline persists a frame, an image, or a biometric template.

6. Regulatory compliance

6.1 Australian Privacy Principles (APPs)

This disclosure and the underlying architecture are designed to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles set out in Schedule 1 to that Act:

  • APP 1 (Open and Transparent Management). This disclosure provides clear information about the data practices of the computer vision system.
  • APP 3 (Collection). No Personal Information is collected from members of the public through the equipment.
  • APP 5 (Notification). This disclosure informs the public about the technology and is signposted by a QR code or notice inside each Vehicle that hosts a Player Tablet.
  • APP 6 (Use and Disclosure). Only anonymous, aggregate data is used for advertising analytics. Aggregate data is not Personal Information under the Act.
  • APP 11 (Security). On-device processing ensures security by design. Visual data does not exist in any system long enough to be subject to a data-breach risk.

6.2 Privacy by Design

The system implements all seven Privacy by Design principles: proactive not reactive; privacy as the default; privacy embedded in the architecture; full functionality without compromising privacy; end-to-end security; visibility and transparency (this document); and respect for user privacy.

Because no Personal Information is collected from passers-by or passengers — only aggregated counts that cannot identify any individual — individual consent is not required under the Privacy Act 1988 (Cth). The aggregate data we receive does not constitute "personal information" as defined in section 6 of the Act.

The aggregate impression metrics we transmit are processed under our legitimate operational interest in measuring advertising effectiveness, balanced against the privacy interest of the public through the privacy-first technical architecture above (APP 6). Because the data is not Personal Information, no further lawful-basis analysis is required.

7.1 Anonymisation

All data is processed on-device and aggregated before transmission. The data cannot identify any individual. This anonymisation ensures the data does not constitute Personal Information under the Privacy Act 1988 (Cth).

7.2 No Sensitive Information

The CV sensors estimate aggregate engagement and emotional response indicators. This data is:

  • not linked to any individual,
  • not stored as Personal Information (raw frames are immediately discarded),
  • only used in aggregate form,
  • processed entirely on-device before any transmission.

It therefore does not constitute "sensitive information" as defined in the Privacy Act 1988 (Cth).

7.3 Notice in the Vehicle

A QR code and printed notice are displayed inside each Vehicle that hosts a Player Tablet, linking to this disclosure. By using OZ Ride or OOHAi services, or being in view of OOHAi advertising equipment after reviewing this disclosure, you acknowledge the collection of anonymised, aggregated data as described.

8. Retention

Data typeRetention
Visual data (raw frames)Zero — discarded in memory immediately after on-device inference
Aggregate impression counts (off-device records)25 months for advertising billing reconciliation, then aggregated indefinitely as non-identifying campaign analytics. Same as the "Audience Data" entry in clause 8 of the Privacy Policy
Equipment status / diagnostic logs12 months

Because no Personal Information is held, the right of access (APP 12) and right of correction (APP 13) do not apply to specific impression records. They do apply to operational records that may incidentally include the Driver's Vehicle identifier — those are governed by the Privacy Policy.

9. Third-party access

9.1 Advertisers

Advertisers receive only aggregate, anonymous impression reports through the Advertiser Portal. No Advertiser ever has access to raw sensor data, video, images, biometric templates, or any information that could identify an individual.

9.2 Drivers

Driver Partners do not have access to computer vision data, settings, or outputs through the Driver App or any other interface. The sensor configuration is managed centrally by OOHAi Media operations.

9.3 Law enforcement

Because no video, image, or biometric template is stored at any point, OOHAi Media cannot provide visual data to law enforcement, regulators, or any third party — even in response to a lawful request. The only data we hold is aggregate impression counts which contain no identifying information.

10. Frequently asked questions

Can OOHAi identify me from my face? No. The system performs face detection, not facial recognition. No biometric template is generated or retained.

Are photographs being taken without my consent? No. No images are captured. Frames are processed in memory and overwritten before the next frame is read.

Is my data being sent to the cloud? No visual data is sent anywhere. Only aggregate counts (anonymous numeric tallies) are transmitted.

Can advertisers see who viewed their ads? No. Advertisers see aggregate reports only.

Can police get video footage from OOHAi equipment? No — there is no footage to provide. The architecture does not record.

As a passenger, am I being recorded during my Trip? No. The Player Tablet camera is used for impression detection only. No video is recorded and no images are taken.

11. Contact

Questions about the OOHAi computer-vision technology or this disclosure:

  • OOHAi Media privacy: privacy@oohai.com.au
  • OAIC: oaic.gov.au, 1300 363 992

End of Computer Vision Privacy Disclosure.

This is the consumer-facing rendering of the v2 legal framework. The authoritative source is maintained at docs/legal/v2/ in the OZ Ride engineering repository. Material changes are notified at least 14 days in advance via in-app message and email per the relevant agreement.