ZURU Tech Italy S.r.l. ("ZURU", "we", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share and protect personal data when you use the Octopus Home mobile app (the "App") and the services we provide through it, including the connection to your Octopus security cameras and video doorbell (the "Cameras").
ZURU Tech Italy S.r.l., Via Sandro Sandri 1, 20121 Milano (MI), Italy, is the data controller. Our Terms of Use also apply to your use of the App.
01Personal data we collect
| Category | What | When |
|---|---|---|
| Account | Email address; the country you choose at sign-up; one-time sign-in codes | When you sign up or sign in |
| Cameras and setup | Camera name, room, model, device ID, MAC address, firmware version, online status, settings; the name of the Wi-Fi network the Camera joins (the Wi-Fi password is sent to the Camera and not stored by us) | When you add, set up or change a Camera |
| Camera content | Live video and audio streamed to your phone; event pictures and event records (time, type such as motion, person, sound or doorbell ring); recordings kept on the Camera's SD card and played in the App | While your Cameras are in use |
| Talk-back audio | Your voice, sent live to the Camera while you use Talk; not recorded by us | When you tap or hold Talk |
| Saved media | Pictures and clips you save go to your phone's photo library and stay on your phone | When you take a picture or record a clip |
| Notifications | Push token and your alert and Do-Not-Disturb settings | When you allow notifications |
| Device and technical | Phone model, operating system and app version, IP address, language, time zone, logs needed to run and fix the service | While you use the App |
| Support | Your email and what you tell us | When you contact us |
We do not collect your name, phone number, password, profile picture, contacts, precise location for tracking, or payment details. We do not use your data for advertising and we do not sell it. The App contains no analytics or crash-reporting software.
02Phone permissions
The App asks for a permission only when you use the feature that needs it. You can turn any of them off in your phone's settings; the feature that needs it will then stop working.
| Permission | Used for |
|---|---|
| Camera | Scanning the QR code on a Camera when you add it |
| Microphone | Talking through a Camera or answering the doorbell |
| Bluetooth | Finding and setting up nearby Cameras |
| Location (while using the App only) | Reading the name of your Wi-Fi network (iPhone) and listing nearby Wi-Fi networks (Android) during Camera setup. Used only on your phone and only during setup. We do not store or track your location |
| Local Network (iPhone) | Finding and connecting to a Camera on your Wi-Fi network during setup |
| Photos | Adding pictures and clips you take to your photo library. The App has add-only access and cannot see your other photos |
| Notifications | Camera alerts and doorbell rings, including a full-screen ring on the lock screen |
03Why we use your data
| Purpose | Data | Legal basis (EU) |
|---|---|---|
| Create and run your Account, sign you in, delete it on request | Account | Performing our contract with you (Terms of Use) |
| Connect, stream from and control your Cameras; show events and SD-card recordings | Cameras and setup, Camera content, talk-back audio | Performing our contract |
| Send alerts and doorbell rings | Notifications, event records | Performing our contract |
| Keep the App and Cameras secure, deliver updates, investigate faults | Device and technical, Cameras and setup | Our legitimate interest in a secure, working service, and our legal security obligations |
| Service messages, such as changes to the Terms or this Policy | Account | Performing our contract |
| Answer support requests | Support | Performing our contract, or our legitimate interest in helping you |
| Meet legal obligations and protect our rights | Any data needed | Legal obligation; legitimate interest |
We do not use your data for marketing, profiling or automated decisions that significantly affect you. If we ever want to, we will ask for your consent first.
04Who we share it with
We share personal data only with the service providers below, who process it on our behalf under written agreements, and only as needed to run the App.
| Recipient | Role | Data |
|---|---|---|
| Tuya | IoT cloud platform and app SDK: connects your Cameras, streams video, stores event records and pictures, sends alerts, delivers firmware updates. A Tuya user account is created for you when you sign up and closed when you delete your Account | Cameras and setup, Camera content, Notifications, Device and technical, a random account identifier we generate. We do not send Tuya your email, name or phone number |
| Amazon Web Services (AWS) | Hosts ZURU's own Octopus servers, which run your Account and sign-in, in the United States (Ohio) | Account |
| Our email delivery provider | Sends your one-time sign-in codes | Email address |
| Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging, Android only) | Deliver alerts and doorbell rings to your phone | Push token, notification content |
| ZURU group companies | Support and operations, for example ZURU PTY LIMITED for Australian product compliance | As needed for that task |
We may also disclose data when the law requires it, to protect people's safety, or in connection with a sale or reorganisation of the Octopus business, in which case this Policy continues to apply to your data.
We do not share your Camera content with anyone else. Others see it only if you share pictures or clips yourself from your phone.
05Where your data is stored
Camera data is stored by Tuya in the data centre that serves the country you choose when you sign up: Tuya's Western Europe data centre, in the EU, for EU countries and Australia, and Tuya's Eastern America data centre, in the United States, for New Zealand. You choose the country once and it cannot be changed later. Account data is stored on ZURU's servers, hosted by Amazon Web Services in the United States (Ohio). Push notifications pass through Apple and Google services worldwide.
This means your data may be processed outside the country where you live. When it is, we protect it as the law requires:
- EU: your Camera data stays in the EU. Your Account data is transferred to the United States, where we rely on the EU–U.S. Data Privacy Framework when the recipient is certified, or on the European Commission's Standard Contractual Clauses (GDPR Article 46).
- New Zealand: we take reasonable steps to ensure recipients protect your data in a way comparable to the Privacy Act 2020 (Information Privacy Principle 12). For New Zealand accounts, Camera data and Account data are stored in the United States.
- Australia: we take reasonable steps to ensure overseas recipients handle your data consistently with the Australian Privacy Principles (APP 8). For Australian accounts, Camera data is stored in the EU and Account data in the United States.
We also comply with any data localisation rules that apply where you live.
06How long we keep it
| Data | Kept until |
|---|---|
| Account | You delete your Account in the App |
| Event pictures and records in the cloud | You delete the event or your Account, or earlier when older events are removed automatically by our platform provider |
| SD-card recordings | On the Camera's SD card until overwritten, formatted or deleted by you; we do not hold a copy |
| Pictures and clips you save | On your phone, under your control |
| Sign-in codes | 10 minutes |
| Technical logs | 30 days |
| Support messages | 12 months after the request is closed |
When you delete your Account, we delete your Account data, close your Tuya account and unbind your Cameras. Some data may stay in backups for up to 30 days, or longer if the law requires us to keep it.
07Your rights
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct data that is wrong;
- delete your data — you can also do this yourself in the App (Account → Delete account);
- and, if you are in the EU, restrict or object to our processing, or receive your data in a portable format.
To make a request, email privacy@octopushome.com from the address linked to your Account. We may need to confirm your identity. We respond within 30 days (20 working days in New Zealand), free of charge.
If you are unhappy with how we handled your data, please contact us first. You can also complain to your data protection regulator:
| Where you live | Regulator |
|---|---|
| New Zealand | Office of the Privacy Commissioner |
| Australia | Office of the Australian Information Commissioner |
| EU | Your national data protection authority, or Italy's Garante per la protezione dei dati personali |
08Children, security and changes
Children. The App is not intended for children. You must be 18 or older to create an Account. If we learn that we hold data about a child without the required consent, we delete it.
Security. We use physical, administrative and technical safeguards, including encryption in transit, access controls and regular reviews. Sign-in uses one-time codes, so there is no password to steal. No system is completely secure; tell us straight away if you think your Account has been compromised.
Security updates and vulnerability reporting. We provide security updates for the App and the Cameras until at least 17 July 2028. Report vulnerabilities to privacy@octopushome.com. We acknowledge reports within 3 business days and aim to give a preliminary response within 14 business days.
Changes to this Policy. We will publish any update on this page with its date. If a change materially affects how we use your data, we will tell you in the App and ask you to review it before it applies.
09Contact us
ZURU Tech Italy S.r.l.
Via Sandro Sandri 1, 20121 Milano (MI), Italy
Privacy requests and security vulnerabilities: privacy@octopushome.com
General questions: hello@octopushome.com
AUStatement of Compliance — Cyber Security (Security Standards for Smart Devices) Rules 2025 (Australia)
ZURU PTY LIMITED declares that the products listed below comply with the mandatory security requirements of the Cyber Security (Security Standards for Smart Devices) Rules 2025, made under the Cyber Security Act 2024 (Australia).
Products covered
| Product | Brand | Model | Batch | Security support until |
|---|---|---|---|---|
| Outdoor camera | Octopus | SC256-WQ5 / 17116 | All batches | July 17, 2028 |
| Video doorbell | Octopus | SC162-WCD3A / 17117 | All batches | July 17, 2028 |
| Indoor camera | Octopus | SC316-WB4A / 17118 | All batches | July 17, 2028 |
Requirements met
These products meet the requirements outlined in Schedule 1, Part 1 of the Cyber Security (Security Standards for Smart Devices) Rules 2025:
| Requirement | Provision |
|---|---|
| Passwords | Sections 2(1) to 2(3) of Schedule 1, Part 1 |
| Reports of security issues | Sections 3(1) to 3(3) of Schedule 1, Part 1 |
| Defined support periods and security updates | Sections 4(1) to 4(7) of Schedule 1, Part 1 |
Compliance has been verified through independent testing against AS ETSI EN 303 645:2025 (Cyber security for consumer Internet of Things: Baseline requirements) and ETSI TS 103 701 V2.1.1, carried out by Attestation of Global Compliance (Shenzhen) Co., Ltd (reports AGC17420260601ER01, AGC17420260602ER01 and AGC17420260603ER01, issued July 20, 2026 — result: Pass).
Reporting security issues
Security issues affecting these products can be reported to privacy@octopushome.com. We will acknowledge receipt of your report within 3 business days and aim to provide a preliminary response, including our assessment and next steps, within 14 business days (see "Children, security and changes" above for our full vulnerability disclosure process).
Support periods
The defined support periods listed above will not be shortened after publication. This product list will be updated as new smart devices are released.
This statement was last updated on August 31, 2026.