Privacy Policy

1. Information We Collect

We collect information you provide directly to us, as well as data generated through your use of our platform:

• Account Information: Name, email address, password, billing/payment details.
• Event Photos and Metadata: Event photographs uploaded by organizers, bib numbers, timestamps, and derived detections.
• Biometric Search Inputs: Selfies voluntarily uploaded to use the Face Search feature.
• Technical & Usage Data: IP address, browser type, device information, usage analytics, and communication preferences.

2. How We Use Your Information & Legal Basis

We use the information we collect to provide, maintain, and improve our services:

• Process and organize your event photos using AI technology
• Provide customer support and respond to your requests
• Send you technical notices and security alerts
• Improve our services and develop new features

We process your personal data strictly in accordance with Regulation (EU) 2016/679 (GDPR) based on the following legal grounds:

• To Provide and Maintain Services: Processing account details, processing payments, and hosting galleries.
  Legal Basis: Performance of a contract (Art. 6(1)(b) GDPR).
• AI Image Organization: Indexing photos, extracting bib numbers, and matching sponsor logos on behalf of event organizers.
  Legal Basis: Legitimate interest of the organizer/platform (Art. 6(1)(f) GDPR) or instructions from the Controller (Art. 28 GDPR).
• Biometric Face Search: Scanning uploaded selfies to locate matching event photographs.
  Legal Basis: Explicit consent (Art. 9(2)(a) GDPR).
• Security & Platform Improvement: Monitoring system stability, preventing fraud, and delivering technical notices.
  Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

3. Information Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties except as described in this policy:

• With your consent or at your direction
• To comply with legal obligations
• To protect our rights and prevent fraud
• With service providers who assist us in operating our platform

Specifically, we share data with trusted service providers acting strictly within the EU or under valid international transfer safeguards: Multi-cloud hosting & image processing (Hetzner Online GmbH, AWS EMEA, Google Cloud EMEA), Security & Content Delivery (Cloudflare, Inc.), Email Communications (Brevo / Sendinblue), and Payment Processing (Stripe).

4. Data Security

We implement appropriate technical and organizational measures under Art. 32 GDPR to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include end-to-end TLS encryption in transit, AES-256 encryption at rest for stored objects and backups, strict logical tenant isolation, and automated data deletion pipelines.

5. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this policy, unless a longer retention period is required by law.

6. Data Deletion Policy

You may request the deletion of your personal data and account at any time. To do so, please use the account settings provided within our platform or contact us directly at [email protected].

• Going to your account settings within our platform and selecting the option to delete your account.
• Or by contacting us directly at [email protected] with your deletion request.

Upon receiving your request, we will permanently delete your account data from our systems within 30 days, unless we are required by law to retain certain information for a longer period.

7. Your Rights

Under applicable data protection laws (including the GDPR), you have the following rights regarding your personal information:

• Access and Update: The right to access, rectify, or update your personal data.
• Erasure:The right to request the permanent deletion of your account and associated personal data (“Right to be forgotten”).
• Object and Restrict: The right to object to or restrict the processing of your personal information based on legitimate interests.
• Data Portability: The right to request a copy of your personal data in a structured, commonly used format.
• Withdraw Consent: The right to withdraw your consent at any time where processing is based on consent (such as for the optional Face Search feature).
• Lodge a Complaint: The right to lodge a complaint with a supervisory data protection authority.

Photo Removal & Opt-Out: If you appear in an event photograph and wish to have your image removed or blurred, you can click the “Report Photo / Request Removal” button directly under the image or contact us directly at [email protected].

8. Face Search Feature & Biometric Data

When you use the optional Face Search feature, you explicitly consent to the temporary scanning and extraction of a mathematical biometric face template from your uploaded selfie (pursuant to Art. 9(2)(a) GDPR).

The uploaded photo and the derived biometric template are processed transiently (in-memory) solely for the immediate search operation. We do not permanently store, aggregate, or build profiles from your selfie or face template, and we do not share biometric data with third parties. Once the search results are displayed, the uploaded selfie and biometric vector are permanently discarded.

9. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience on our platform and analyze usage patterns.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the “Last updated” date.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at [email protected].