Trust Center · Consent
The full consent framework, and what is in the box.
Customer consent and associate consent are different legal problems solved by different mechanisms. This page documents both, plus the physical signage kit that ships before capture is armed.
This page is not legal advice. Every deployment follows the retailer’s own counsel.
Customer side
Five things that exist before the first conversation is captured.
01
Notice at entry
A door decal states that conversations at service counters may be recorded for training and quality purposes, and carries a QR code to the full notice. It is placed before capture is armed, not after launch.
02
Notice at the point of capture
A counter card repeats the notice at every capturing position, in the customer’s line of sight rather than behind a display, in English and Spanish as standard.
03
Plain-language notice behind the QR
One page, no defined terms, no cross-references: what is captured, what is not, why, how long the audio is kept, who can hear it, and how to ask for deletion. It states explicitly that there is no video and no voiceprint.
04
Verbal disclosure in the greeting
One line, written into the greeting script and coached like any other behaviour, so a customer who never reads a sign is still told out loud.
05
An honoured opt-out
A customer who prefers not to be captured says so and the counter is stood down for that conversation. This is a floor procedure with a named owner per store, not a goodwill statement.
Associate side
Consent in the employment relationship, backed by what the hardware cannot do.
A policy an associate signed is only worth something if the device cannot behave differently to the policy. That is why these two sit together.
01
Consent inside the employment relationship
A written policy, an acknowledgement signed at onboarding, and an announcement made by store leadership as a coaching programme. Associates should learn about this in a meeting, not from a colleague noticing a device.
02
Firmware guarantees, not promises
Capture cannot run with the indicator unlit, and there is no covert mode to enable. Firmware is cryptographically signed and a device refuses an unsigned image, which is what makes the guarantee enforceable.
03
Company hardware in a company space
Nothing runs on a personal phone. Devices are rented, enrolled with a hardware-held identity, and confined to configured zones. Staff rooms and back offices are excluded.
04
Private by default
A daily prompt is visible to the associate and their direct manager. It is not a leaderboard and it is not circulated.
05
The right to dispute
Any score can be challenged, the audio behind it is made available, a human reviews it, and an overturned score is corrected in the record rather than annotated.
Technical detail
The signage kit, item by item
- Door decal
- One per public entrance. Weather-rated, removable adhesive, QR to the plain-language notice. English and Spanish as standard, additional languages on request.
- Counter cards
- One per capturing position, in a weighted stand sized for a jewellery or beauty counter. QR repeated on each card.
- Plain-language notice
- A single hosted page behind the QR, written at a general reading level. Version-controlled, with a change history you can inspect.
- Greeting script line
- One sentence, supplied in English, Spanish and Hinglish, written to be said naturally rather than read out.
- Associate policy pack
- The written policy, the onboarding acknowledgement, a manager briefing script, and a one-page FAQ for the floor.
- Store leader briefing
- A twenty-minute briefing deck covering how to announce the programme, and specifically how not to announce it as something being done to the floor.
- Zone map template
- Used during scoping to record which zones capture, which are excluded, and who signed off. It becomes part of your compliance record.
- Opt-out procedure
- A one-page floor procedure for standing a counter down at a customer’s request, with a named owner per store.
Two documents your counsel will want.
Both are written for a lawyer rather than a buyer, and both are sent by a person rather than downloaded from a form wall.
Review the consent design before you review the product.
It is the shorter conversation and it is the one that decides whether a pilot can start.