Skip to content
SENSOLYTICA

Brief for the solicitor

What Sensolytica does, what the drafts say, and the 15 questions we need answered before any of it is published.

Prepared 12 October 2026 for the reviewing solicitor, by the engineering team, not by a lawyer. UK GDPR, Data Protection Act 2018, PECR

What it is

Shore nodes on harbour walls and roadsides measure how vessels and vehicles move through a monitored zone. When something passes, a node records about ten seconds of video, measures speed by radar and uploads frames and figures. Drive units on electric outboards read the motor controller and add rpm, current, run time and position with its accuracy. Software proposes what it saw; a person at the authority confirms or rejects every breach against the frames before it counts. The authority is the controller; Sensolytica is the processor.

What the system does

Who is who

Controller
The authority: a harbour authority, council or transport operator. It decides why and how sensing happens at its sites.
Processor
Sensolytica. We run the platform and the units on the authority's instructions.
Sub-processors
Supabase (database and sign-in, UK region), Cloudflare R2 (evidence storage), Resend (email), Stripe (payments), Anthropic (reading ambiguous captures, only where the authority turns it on).
Where data lives
United Kingdom. Anthropic processes frames in passing and keeps none of them.

What is collected

Shore node SN-1
About ten seconds of video and up to six key frames per pass, only when something moves through a zone. Radar speed, a vision estimate, position and time.
Drive unit DU-1
Rpm, current, voltage, temperatures, faults, run time and position (with its GPS accuracy) from a unit that reads an electric outboard's motor controller, with the owner's consent.
Outside feeds
AIS position reports, joined to the record but not sealed by us.
Identifiers
Vessel names and registration marks, where legible. Personal data when they can be linked to a person.
Not collected
No facial recognition, no biometric identification of people, no audio, no linking to any register by us.

How long it is kept

Evidence
The authority sets it: 6, 12, 24 or 36 months, 24 by default. Enforced by a scheduled job.
Anonymisation
Passes within the limit lose their identifiers after 30 days by default.
Audit trail
Seven years, so an enforcement decision can still be explained.

Decisions

Automation
Nothing counts automatically. A person confirms every breach against the frames.
The on-site agent
A local model reads captures and writes advisory notes. It cannot set a verdict, send a message or change a record.
Reversibility
Every verdict can be changed with a reason; the earlier one stays in the audit trail.

Questions to answer before go-live

By document. Answers as tracked changes against the drafts, or notes against each number.

Terms of service

Drafted in-house, not reviewedRead the draft
  1. Is a liability cap of twelve months' fees defensible when the output is used in enforcement?
  2. Should we warrant the accuracy of a speed reading at all, or only that the equipment is maintained and calibrated to a stated standard?
  3. Do we need a schedule that survives being attached to a council's own framework agreement?
  4. On termination, should evidence be handed back, kept for the retention period, or deleted on request?

Privacy notice

Drafted in-house, not reviewedRead the draft
  1. Should the authority publish its own notice from a template we supply, so the controller is plainly them?
  2. Is public task under Article 6(1)(e), with the authority naming its statutory power, the right basis to describe?
  3. How should a subject access request be handled when a clip shows several vessels and other people?
  4. Does Article 22 need addressing, given a person confirms every breach?

Drive unit consent

Does not exist yet
  1. An outboard maker fits DU-1 at the factory. Who must the owner consent to, and when: the maker, Sensolytica, or each authority whose waters the vessel enters?
  2. Can a fitted unit report to an authority at all without the owner's fresh consent?

Data processing agreement

Does not exist yet
  1. A standalone Article 28 agreement, or a schedule to the terms?
  2. Which sub-processors must be named, and what notice should adding one need?
  3. What audit rights over us are reasonable for a council?

DPIA template

Drafted in-house for authorities to completeRead the draft
  1. Is it right for a processor to supply this, or does it look as if we are doing the controller's assessment for them?
  2. Should the three seeded risks stay, or should the table start empty?

What we are not claiming

  • We do not claim the drafts comply with anything. They are a starting point.
  • We do not claim a reading is admissible in any particular proceeding. That depends on the authority's process and on calibration.
  • We do not give legal advice to customers, and the DPIA template says so on its face.
Anything that changes what the software does, rather than what a document says, comes back to engineering first. Prepared 12 October 2026; not legal advice.