1. Controller and scope
Face search is available only for supported events and only after separate explicit consent. Biometric consent is never required to view or upload to the ordinary gallery.
2. Data and purpose
Your selected selfie is processed in memory to locate possible matches in event photos and, on supported plans, in frames sampled temporarily from event videos. Neither the selfie nor extracted video frames are written to persistent storage.
- Face-match representations, confidence scores and video timestamps
- Versioned consent record and text hash
- Hashed technical records used to prevent abuse
3. Legal basis and international transfer
Biometric processing relies on explicit consent. When enabled, face comparison may use AWS Rekognition in an EU region and may constitute an international transfer under applicable law. The required transfer mechanism and safeguards must be completed before production activation.
4. Retention, security and withdrawal
The selfie is not retained. Match links are limited by the event lifecycle and retention policy. You can withdraw consent from the guest gallery; links that identify you and personal clips are queued for deletion, with completion recorded in an audit log.
5. Your rights
You may request access, correction, deletion or restriction through the support address. Withdrawal does not invalidate lawful processing performed before withdrawal.