法律及许可Legal & Licenses

人脸特征、人员照片、GPS、视频、语音、开锁记录和设备日志可能属于个人信息、敏感个人信息或生物识别数据。部署方必须依据实际使用地区确认合法处理依据，并完成必要的告知、同意、权限控制、保存期限和删除机制。

人员识别功能默认关闭。只有在完成适用的隐私与生物识别合规评估后，才应在 config/person-recognition.json 中将 enabled 设置为 true。

Face features, personnel photos, GPS, video, audio, unlock records, and device logs may constitute personal, sensitive, or biometric data. The deployer must establish a lawful basis and implement applicable notice, consent, access control, retention, and deletion requirements in every operating jurisdiction.

Person recognition is disabled by default. Set enabled to true in config/person-recognition.json only after completing the applicable privacy and biometric-data assessment.

SFace 与 YuNet 按随附的 OpenCV/OpenCV Zoo 许可及模型说明使用。发布产品时应保留相应版权与许可文件。

默认 ArcFace 公共预训练模型仅供研究和测试，不得直接用于商业部署。商业使用必须取得模型权利方的有效商业授权，并在配置中选择已授权模型目录及 licenseMode: "commercial"。该配置标记不能代替真实授权文件。

SFace and YuNet are used subject to their accompanying OpenCV/OpenCV Zoo licenses and model notices. Preserve the applicable copyright and license files in distributed products.

The default public ArcFace pretrained model is for research and testing only and must not be used directly in a commercial deployment. Commercial use requires a valid license from the model rights holder, an authorized model directory, and licenseMode: "commercial". This configuration label does not replace an actual license agreement.

Node.js 依赖、OpenCV、ONNX Runtime、ZLMediaKit、OpenLayers 及其他第三方组件分别受其自身许可约束。修改或再发布组件时，必须保留适用的版权声明、许可证和修改说明。

OpenStreetMap 数据通常要求正确署名并遵守 ODbL；高德地图及其他地图服务受各自服务条款、密钥权限、坐标规则和使用地区限制约束。部署方应根据实际选择显示正确的地图署名。

Node.js dependencies, OpenCV, ONNX Runtime, ZLMediaKit, OpenLayers, and other third-party components remain subject to their own licenses. Preserve applicable copyright notices, license texts, and modification notices when modifying or redistributing them.

OpenStreetMap data generally requires attribution and ODbL compliance. AMap and other map services are governed by their own terms, key permissions, coordinate rules, and geographic restrictions. The deployer must display the attribution required by the selected provider.

部署方负责设置最小权限、强密码、API Key 管理、HTTPS、设备通信密钥、备份、日志审计及安全更新，并应向用户提供数据访问、更正、导出和删除渠道。

系统关闭某项功能不会自动删除此前产生的数据。若需要停止处理并清除历史人员特征、照片、录音、录像、GPS 或日志，应按照适用法律和组织的数据保留制度执行受控删除。

The operator is responsible for least-privilege access, strong passwords, API Key governance, HTTPS, device communication keys, backups, audit logs, and security updates, and should provide applicable access, correction, export, and deletion channels.

Disabling a feature does not automatically erase data created earlier. If processing must cease and historical face features, photos, audio, recordings, GPS, or logs must be removed, perform a controlled deletion under applicable law and the organization’s retention policy.