Privacy design · also the notice behind the QR code on our venue signage

What this camera does,
and what it cannot do.

In one paragraph

Alumbra is a small computer with a camera that watches an elevator waiting area. It counts how many people are waiting, roughly how old they are (in wide bands, when visible), whether a family with a child is present, and how long people look toward the screen. It uses those numbers to choose which announcement plays next and to report how many people saw it. It does all of this on the device itself.

What never happens

No image is ever stored or sent. Camera frames exist in memory for under 200 milliseconds while they are counted, then they are destroyed. The software is built without any capability to save or transmit pictures — there is no image encoder in the binary. This is verified by an automated audit on every release.
No one is identified. No face recognition, no biometric templates, no matching against any database, no recognizing a person who returns tomorrow — or five minutes later.
Nothing sensitive is guessed. The system does not infer ethnicity, health conditions, income, or emotions. Not because a setting is off — the models that would do this are not on the device, and we consider such inference indefensible in a healthcare setting.
Children are only counted as "a family with a child." No other attribute of a minor is estimated or reported.
Small groups are not described. When fewer than five people are present, the age-band breakdown is suppressed entirely (k-anonymity). A statistic about two people is a description of those two people, so it is not produced.

What is recorded

A log of aggregate events, each one a line of numbers: timestamp, headcount, group composition, suppressed-or-banded age mix, average attention, and which announcement played. A day of operation produces a few hundred kilobytes of text. That log is the complete and only record the system creates, and any report we publish can be reproduced from it.

[ ts · n=4 · family+solo · attn 58% · played: pediatrics ]

Legal basis (Thailand PDPA)

Processing at the moment of capture is designed to rely on legitimate interest (PDPA section 24(5)) for anonymous audience measurement, with notice given at the venue under section 23 — the signage that brought you here. The venue operates as data controller; nulabs processes on its behalf under a written agreement (section 40). A balancing record (DPIA-style) is prepared for each venue and reviewed by Thai counsel. The PDPC's dedicated CCTV guideline is expected in late 2026; this design follows the strictest current reading and will be aligned with the final guideline when published.

Questions or objections