Retail wants the data. Customers don't want to be the data. Privacy regulators don't want a tape full of faces leaving the building. There's a path through this that makes everyone — including the analytics team — happy: anonymise on the edge, never upload pixels.

## The shape of the pipeline

- 01Camera feed into an on-prem device. Often a Mac mini, sometimes a Jetson, increasingly an N100.
- 02Detection model runs locally. Faces are detected, counted, classified into broad demographic buckets if asked — never identified.
- 03Pixels never leave the device. Only counts, dwell times, and aggregated metrics get pushed to the cloud.

## A typical deployment

| Component | Role | What it does NOT do |
| --- | --- | --- |
| Camera (IP or USB) | Capture raw frames | Never store or transmit raw video |
| On-prem inference box | Run detection / counting model | Never upload pixels, never identify individuals |
| Local queue / DB | Buffer aggregated metrics | Never hold image data longer than the inference window |
| Outbound webhook | Push aggregated counts to cloud | Only carries numbers — counts, dwell times, hourly bins |

Edge-first computer-vision pipeline for retail footfall.

## What clients actually ask for

- 01Footfall by hour, by entrance, by zone.
- 02Dwell time on a specific display or product.
- 03Coarse demographic mix for staffing decisions, not targeting.

> "
>
> Anonymise on the edge, never upload pixels. Every CV-in-retail project starts with that constraint, or it ends up in the news for the wrong reason.

## The conversation

The technology is mostly the easy part. The conversation about what gets stored, where, and for how long — that's where the work actually is. Do it before the cameras are ordered, not after.

Our standard kit list now starts with the privacy architecture before we spec a single piece of hardware. The deployment runs ten times more smoothly when the legal team has seen the data flow on day one rather than week ten.