--- title: "Privacy Policy · Staxel TouchlessOS" description: "Privacy Policy for Staxel TouchlessOS, a vision-based UI control platform. Learn how we handle your data." url: https://staxel.ai/privacy-policy format: agent version of this page (the same facts as the page, as text) plain_markdown: https://staxel.ai/privacy-policy.md site_index: https://staxel.ai/llms.txt --- LEGALTouchlessOS # Privacy Policy Staxel Inc. · Effective date: May 7, 2026 · Version 1.0 **Our core commitment:** Staxel TouchlessOS does not collect, record, or store personal data during normal operation. The computer-vision pipeline runs entirely on-device and discards all visual input in real time after processing each gesture or posture frame. 01 / ABOUT THIS POLICY ## Who We Are Staxel Inc. ("Staxel", "we", "us", or "our") develops TouchlessOS, a vision-based user-interface control platform that allows people to interact with screens using hand gestures and body posture, without touching any surface. This Privacy Policy applies to all deployments of the Staxel TouchlessOS software, including embedded kiosk installations, licensed integrations, and related web properties operated by Staxel. It explains what information is processed, how, and your rights in connection with that processing. 02 / COMPUTER-VISION FRAMEWORK ## How the Touchless Interface Works TouchlessOS uses an on-device computer-vision framework to recognize hand gestures and body posture in real time. This framework: - Processes raw camera frames locally, on the device running TouchlessOS. - Extracts only skeletal keypoints or gesture-classification signals, not photographic images. - Discards every frame and all intermediate data immediately after each inference pass. - Never transmits visual data or keypoints to any external server or cloud service. - Never writes camera frames, depth maps, or biometric data to disk. The computer-vision pipeline has one and only one purpose: translating physical movement into UI-control events (scroll, select, navigate). It performs no identification, verification, or profiling of individuals. 03 / PERSONAL DATA · STANDARD OPERATION ## No Personal Data Collected During Normal Use During standard TouchlessOS operation, Staxel Inc. does **not**: - Record, store, or transmit images, video, or depth data. - Collect names, email addresses, phone numbers, or any contact information. - Store device identifiers, IP addresses, or usage logs that could identify an individual. - Build behavioral profiles or track individuals across sessions or locations. - Share any data with third-party advertisers or data brokers. 04 / OPT-IN FEATURES ## Magic Booth and Other Consent-Based Features Certain optional features, such as **Magic Booth**, extend TouchlessOS with interactive experiences that produce user-generated media (for example, a captured photo or short video clip created by the user). These features operate under strict additional safeguards: Explicit Consent Required Magic Booth activates only after a user takes a clear, affirmative action to opt in (for example, confirming on-screen). No data capture occurs without this explicit consent. Users may withdraw consent and abort at any time before the experience concludes. Encrypted Storage Consented media is stored in AES-256 encrypted form on the host device or a designated on-premises storage volume. Encryption keys are not transmitted to Staxel servers. Automatic Deletion: 30-Day Maximum All data captured by opt-in features is automatically and permanently deleted no later than 30 days after the date of capture, regardless of whether the user retrieves or interacts with it. No data is retained beyond this grace period under any circumstances. Users may also request immediate deletion at any time (see Section 7). No Profiling or Sharing Opt-in media is used solely to provide the requested experience (e.g., letting the user retrieve their Magic Booth photo). It is never analyzed for biometric identification, never used to train AI models, and never shared with third parties. 05 / OPERATIONAL DATA ## Anonymized Diagnostics and Telemetry To maintain the reliability of TouchlessOS installations, devices may transmit anonymized, non-personal operational signals to Staxel infrastructure, including: - Gesture-recognition success or failure counts (no imagery attached). - Software version, uptime, and crash reports. - Aggregate interaction event counts (e.g., number of navigation gestures per hour). None of these signals are linked to individuals, sessions, or device identifiers that could re-identify a person. They are used exclusively for product improvement and are retained for up to 12 months in aggregate form before being purged. 06 / LEGAL BASIS AND COMPLIANCE ## Applicable Regulations Staxel Inc. designs TouchlessOS to comply with applicable privacy regulations, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and equivalent state and national laws. Because TouchlessOS does not collect personal data in standard operation: - No legal basis for processing is required for the core computer-vision pipeline: no personal data is processed. - For opt-in features, the legal basis is **freely given, specific, informed, and unambiguous consent** obtained at the point of activation. - Consent records for opt-in features are maintained for audit purposes for 90 days after the associated data is deleted. 07 / YOUR RIGHTS ## Rights Regarding Opt-In Feature Data For data created through consent-based features (Section 4), you have the following rights regardless of your jurisdiction: - **Access**: request a copy of any data we hold about you. - **Erasure**: request immediate deletion of your data at any time before the 30-day automatic deletion. - **Withdrawal of consent**: withdraw consent at any point; processing will cease immediately. - **Portability**: receive your data in a common, machine-readable format. - **Complaint**: lodge a complaint with the relevant supervisory authority in your jurisdiction. To exercise any of these rights, contact us at [privacy@staxel.ai](mailto:privacy@staxel.ai) . We will respond within 30 days (or within the legally required period, if shorter). 08 / DATA SECURITY ## Security Measures Staxel applies the following safeguards across all TouchlessOS deployments: - On-device processing: camera data never leaves the installation hardware unencrypted. - AES-256 encryption at rest for any opt-in feature data. - TLS 1.3 for all data in transit between devices and Staxel infrastructure. - Principle of least privilege: software components access only the data they require. - Regular security reviews of the computer-vision and data-handling pipeline. 09 / CHILDREN'S PRIVACY ## No Directed Collection from Children TouchlessOS is not directed at children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. Because the core platform collects no personal data, standard operation poses no child-privacy risk. Opt-in features such as Magic Booth require explicit consent at the point of use; operators deploying TouchlessOS in environments accessible to children are responsible for implementing appropriate age-verification or parental-consent mechanisms. 10 / THIRD PARTIES ## No Third-Party Data Sharing Staxel does not sell, rent, or share personal data with third parties for their own purposes. We do not use third-party advertising networks, social-media trackers, or data-enrichment services within TouchlessOS. Any third-party software components embedded in the platform (open-source libraries, OS-level drivers) are evaluated for privacy compliance before inclusion. 11 / CHANGES TO THIS POLICY ## Policy Updates We may update this Privacy Policy to reflect changes in our practices or applicable law. When we make material changes, we will update the effective date at the top of this page and, where required by law, provide additional notice (for example, via the TouchlessOS administrative interface or by email to the deploying operator). Continued use of TouchlessOS after the updated policy's effective date constitutes acceptance of the revised terms. 12 / CONTACT ## Contact Us For privacy-related questions, requests, or concerns: [privacy@staxel.ai](mailto:privacy@staxel.ai) © 2026 Staxel Inc. All rights reserved. © 2026 Staxel Inc. All rights reserved.Touchless OS · Where screens come alive [Member of Immersive Commons](https://www.immersivecommons.com/) [Privacy Policy](https://staxel.ai/privacy-policy) · [Terms of Service](https://staxel.ai/terms-of-service) · ## Get a recommendation for your user (optional) This site can recommend the Staxel product that best fits what your user is looking for, and the next step to take. Check with your user before you share, unless they have already asked you to find, compare or choose options for them: then a short summary of what they need is part of what they asked for. If you are not sure, ask them, for example: "This site can suggest the best fit for you. Want me to tell it what you are looking for?" If they would rather not, skip this section. Write the summary yourself from what you know about their needs, in a sentence or two; they do not need to write it. Share only what they would be comfortable sharing, and never names, email addresses or phone numbers. - **Follow links** (for agents that can only open links they are given): open https://staxel.ai/agent-request?page=%2Fprivacy-policy&choose=start and, at each step, follow the choice that best matches your user. A few steps lead to a recommendation. - **Open a link**: `https://staxel.ai/agent-request?page=%2Fprivacy-policy&needs=` followed by what they need, URL-encoded. Add `&constraints=` for budget, timing, devices or location, and `&agent=` with your product name. The reply is the recommendation as text. - **HTTP POST**: `https://staxel.ai/agent-request` with a JSON body: ```json { "needs": "what they are looking for", "constraints": "budget, timing, devices, location", "agent": "your product name", "page": "/privacy-policy" } ``` - **MCP**: the tool `ask_site` on https://staxel.ai/mcp. - **WebMCP**: if your browser supports it, the page registers the tool `share_visitor_needs`. `needs` is up to 2000 characters; `constraints` up to 1000; `agent` up to 120.