What Vitrine does, where it does it and what it doesn't do.
The image is analyzed and discarded: an uploaded video is deleted right after the analysis, and the live camera image is discarded on the spot. Only one line of numbers per person who walked by is kept. This page explains the design, the limits of the models and what the store needs to do before using Vitrine.
The path of a piece of data
Video or camera → server
The uploaded video (or the connected camera image, over an encrypted channel) reaches the Vitrine server, which detects people, follows each one for a few seconds and estimates the profile from the face. All in memory; the uploaded video is deleted when it finishes.
Frames and faces
No frame with people, face crop or facial "signature" is stored or sent. All that remains of an uploaded video is a single background image of the scene, built from the median of many frames (people walking by disappear from it) and blurred, so the store owner can check the window and door areas. A track is just a number that only lasts while the person is in view.
One anonymous line
Example: "3:32 pm, pair, woman 25–34, looked 1.4 s, stopped 8 s, went in". It stays in the store's database, visible only to those with access to it.
Free test ("Start with the test" page)
In the free test, the short video (up to 20 seconds) is sent to the Vitrine server, analyzed and deleted right after. Anyone requesting the result provides an email and gives consent; the server creates a copy of the video with the boxes and labels already applied and the faces blurred, and that copy stays available at the result link for 30 days, along with the numbers. After that, the video and the numbers at the link are deleted. The email is kept for contact purposes and can be removed on request.
What we measure and how
| Measure | How it is obtained | What it is not |
|---|---|---|
| Walked by | A track seen for 1 s or more in front of the store | A unique person: someone who comes back counts again |
| Looked | Head turned toward the window in 2 or more face readings (~0.7 s) | Exact gaze direction, attention or intent |
| Stopped | 2 to 60 s almost still in the window zone | Proven interest |
| Came in | 0.4 s or more in the door area, after being seen outside | A purchase (that requires register data) |
| Inconclusive | At the window or by the door, the end wasn't seen: the person disappeared behind someone, was seen for less than 1 s or the recording ended. Disappearing while walking down the corridor counts as walking by | A hidden path: it is not forced into any outcome |
| Group and relationship | People side by side at the same pace for 2 s or more; the relationship comes from the gender and age mix | Actual kinship or relationship |
| Gender and age range | Appearance estimate from the face, combining several readings; without minimum confidence it stays "not estimated" | Biological sex, gender identity or verified age |
| Shopping bag and backpack | A bag detected next to the body in part of the observations | A purchase made at another store |
What is neither collected nor inferred
- No facial recognition: there is no face database and no matching against a list of people.
- No biometric vectors, photos, videos or face crops are stored.
- No ethnicity: the age model also estimates ethnicity, and the code discards that output before anything is recorded.
- No emotion, sexual orientation, income or "customer type".
- No identification across visits, days, cameras or stores.
- In the portal: no advertising cookies and no audience analytics tools. The hosting provider may log technical access data, such as IP.
Limits of the models
- Gender and age are statistical estimates of appearance (CenterFace to find the face, FairFace to estimate). They get individual cases wrong and can be biased by age, lighting and skin tone.
- The model has not been validated for children and cannot be used to verify legal age. The "child" tag comes from height or the 0–12 range and can also be wrong.
- A small face, in profile, from behind or in low light stays "not estimated". We don't fill the gap with a guess.
- The tracker can lose or swap people in crowds, reflections or occlusion. Those cases tend to end up as "inconclusive".
- Accuracy can only be measured at the store: the pilot should be compared with a manual count of 1 to 2 hours.
What the store needs to do before turning on the camera
Even without recording images, analyzing faces in memory is processing of personal data. The technical controls help, but they don't replace a legal review of the operation.
- Identify the data controller (the store) and a contact channel for privacy.
- Define the specific purpose, for example: measuring window appeal and store entries in aggregate.
- Record the legal basis and the necessity assessment with a lawyer; don't assume legitimate interest.
- Consider children and teenagers walking by and their best interests.
- Frame the camera on the necessary area only, avoiding more public sidewalk than needed.
- Put up the notice below before the monitored area.
- Secure the mini-PC (account, disk, network) and the camera (password, firmware). The camera or recorder may record on their own, outside Vitrine.
- Validate zones and numbers with a manual count before using the results.
Notice template for the store
Adapt the fields in brackets; don't use it with blank fields.
This area uses automated image analysis to measure foot traffic in front of the window, stops, entries and aggregate estimates of age range and appearance, for the purpose of [validated purpose]. The system does not record images and does not recognize people's identity. Estimates may be wrong and do not determine actual sex or age. Controller: [company name]. Information and rights: [contact channel].
Rights and incidents
Since there is no identification, it is not possible to find "a person's data" in the database. The store should explain the design to anyone who asks, without creating a face database to try to fulfill the request.
In an incident: turn off capture, restrict access, assess the risk and the notification obligations with legal support.