Privacy & biometric data
Only to find you in photos uploaded to your events. We never share your data.
1. Who we are
This photo finder for your events is operated by Eventz Studio ("we", "us"). Eventz Studio is the data fiduciary responsible for the personal data described in this policy.
2. What we collect
| Data | Why |
|---|---|
| Email address | Your sign-in identity. We email you a one-time code; there are no passwords. |
| Name | Shown on your account. You can edit it at any time. |
| One selfie | Used to create a face template so we can find you in event photos. |
| Face template and identifiers | A mathematical representation of your face, kept in the face-matching service, plus the ID that links it to your account. |
| Photo matches | Which event photos you appear in, and any "this is me" or "not me" feedback you give. |
| Consent record | The version of this consent you accepted. |
| Sign-in codes | Stored only as a keyed hash, valid for 10 minutes, with a limit of 5 attempts. |
Event photos are uploaded only by event administrators. Like any event photography, they may show you and other attendees.
3. How and why we use it
We use your data for one purpose only: to find and show you the photos from your events that you appear in, and to let you download them. We also use your email to send sign-in codes. We do not use your data for advertising, profiling, or any other purpose, and we never sell it.
4. Legal basis and consent
We process your personal data on the basis of your consent, in line with India's Digital Personal Data Protection Act, 2023 (DPDP Act). Before we take a selfie, you are asked to give explicit consent on a dedicated consent step. Without it, no face data is created. You can withdraw consent at any time (see Your rights). Withdrawing does not affect processing that took place before you withdrew.
5. Biometric data handling
- Your selfie is processed by Amazon Rekognition to create a face template. That template is compared against faces detected in the event photos.
- We keep only face identifiers and match results in our database, not face images or templates. The template itself stays inside the face-matching service.
- Matches are shown only to you, after you sign in. Photos can only be opened through short-lived private links.
- When you update your selfie, your old face data is removed and replaced, and your photos are scanned again.
- When you delete your face data, your selfie, face template, identifiers and matches are deleted.
7. Where your data is stored
Photos, selfies and face templates are stored and processed in the AWS Asia Pacific (Mumbai) region, ap-south-1, in India. Sign-in emails pass through our email provider, which may route messages outside India.
8. Retention
- Sign-in codes expire after 10 minutes and are purged after about a day.
- Face data (selfie, template, identifiers and matches) is kept until you delete it or the event album is removed.
- Event photos and their face data are deleted when the event album expires or is removed by the administrator.
- Account details (name, email, consent record) are kept while you use the service. Contact us to have your account removed.
9. Security
- Photos and selfies are stored in a private S3 bucket with server-side encryption and are never public.
- Photos are viewed only through time-limited signed links.
- Sign-in uses one-time codes, stored only as keyed hashes, with expiry, attempt limits and rate limiting.
- Forms are protected against cross-site request forgery, and pages use a strict content security policy.
No system is perfectly secure, but we work to protect your data and limit access to it.
11. Your rights and controls
Under the DPDP Act you have rights to access, correct and erase your personal data, to withdraw consent, and to seek grievance redressal. You can exercise most of these yourself from Account:
- Access: see your details, your selfie and all your matched photos. Download any photo from My Photos.
- Correction: edit your name, or update your selfie at any time.
- Erasure / withdraw consent: use "Delete face data" to delete your selfie, face template and matches immediately.
- Fix a wrong match: mark a photo as "Not me" to hide it.
For anything else, such as deleting your whole account, email us (see Contact).
12. Children
This service is intended for adults. Children should not create an account or upload a selfie. A parent or guardian may contact us about a child's data, and we will act on verifiable requests.
13. Changes to this policy
We may update this policy. The "last updated" date above will change, and if a change affects how face data is used, we will ask for your consent again before continuing.
14. Contact
Eventz Studio: privacy@eventz.studio · eventz.studio