Animal Detect
Data handling and hosting summary
For IT security and data protection review
Version 1.0, October 2026
Questions: Eugene Galaxy, CEO
eugene@animaldetect.com
Company
- Legal entity
- Animal Detect ApS, Denmark (EU)
- Company reg. (CVR)
- 42063894
- Registered address
- Højbro Plads 10, 1200 København K
- Contact
- support@animaldetect.com
- Website
- www.animaldetect.com
- Supervisory authority
- Datatilsynet (Denmark)
The service
A web application that sorts wildlife camera images and videos with AI. It removes empty frames and names the species. It runs in the browser; there is no phone app to install.
Images arrive by browser upload (for example from SD cards) or directly from connected cameras. Results export as CSV, COCO or Camtrap DP, together with the original files.
GDPR roles
- The customer organisation is the data controller for its images. Animal Detect is the data processor.
- A data processing agreement (GDPR Art. 28) is available on request. We can use the European Commission's standard clauses for controllers and processors (Decision (EU) 2021/915).
- Content is private by default. Only members the organisation invites can see it.
People in images
- The AI detects people and vehicles. Members see a blurred copy; videos with people are hidden behind a placeholder.
- This filter is on by default for every organisation. Only the organisation owner can switch it off.
- The unblurred original is stored in EU storage next to the blurred copy, and is deleted when the customer deletes the image or project.
- Images and videos with people or vehicles are never used to train our AI.
Where data is processed
| What | Provider | Location |
|---|---|---|
| Image and video storage | Google Cloud Storage | Germany (europe-west3, Frankfurt) |
| AI detection, primary | Animal Detect's own server | Denmark |
| AI detection, backup | Google Vertex AI | Belgium (europe-west1) |
| Thumbnails, privacy blur, video previews | Google Cloud Run | Germany (europe-west3, Frankfurt) |
| Web application | Vercel | Germany (fra1, Frankfurt) |
| Database and user accounts | Supabase | Germany (eu-central-1, Frankfurt) |
| Direct camera ingest (email/FTP cameras only) | Google Compute Engine | Belgium (europe-west1) |
| Usage analytics, disabled if cookies rejected | PostHog | EU |
| Account emails (name, email address) | Resend | Ireland (eu-west-1) |
| Abuse protection (IP address, short-lived) | Upstash | Ireland (eu-west-1) |
The primary AI server is reached through an encrypted tunnel (Tailscale). Google, Vercel, Supabase, PostHog, Resend and Upstash are companies headquartered in the United States; data is hosted in the EU regions listed. Any transfer outside the EU/EEA is covered by the EU Standard Contractual Clauses, and by the EU-US Data Privacy Framework where the provider is certified.
Security
- Encrypted in transit (HTTPS/TLS) and encrypted at rest by the hosting providers.
- Animal Detect staff access customer content only to operate, secure or support the service.
- Personal data breaches are reported to the supervisory authority and affected customers as GDPR requires.
- Animal Detect ApS holds no ISO 27001 or SOC 2 certification of its own. We build on the providers above; their certifications are linked below.
Retention, AI training, billing
- Retention: content is kept until the customer deletes it or its project. Processed content is stored 12 months, then exported, renewed or deleted. Raw usage logs are deleted after 90 days.
- AI training: the organisation owner decides whether copies may be used to improve our AI and can switch it off at any time. Location and camera metadata are always removed first.
- Billing: quoted per organisation and invoiced yearly. No card or subscription required.