01 Who processes your data

Inversiones Globales en Tecnología, Intech Global, S.A. ("picspot", "we") operates the picspot.cam site and the app at https://app.picspot.cam. For anything privacy related, write to [email protected].

Throughout this policy we distinguish two roles. The organiser creates a gallery and uploads the photos from their event. The attendee opens that gallery link and searches for themselves. We process data from both, but not in the same way or for the same reasons.

For the photos an organiser uploads, the organiser decides what gets published and for how long; we process them on their instructions in order to provide the service.

02 What data we process

Account data: The organiser's name, email address and password, plus their brand or production company name if they provide one.
Gallery photos: The images the organiser uploads and whatever metadata the file carries: date, camera model and, if the photo includes it, location data.
Biometric data: Numeric representations of the faces appearing in those photos. They are vectors, not face crops, and they exist only to group one person's photos within a gallery.
Search selfie: The photo an attendee takes to search for themselves. It is processed on the spot to compute its vector and then discarded; we do not store it.
Usage data: Pages viewed, browser and operating system, and IP address. We use them to keep the service running and to detect abuse.
Billing data: What we need to charge for a photo pack. Card details are handled directly by our payment provider; we do not store them.

03 How face search works

When a gallery is published we analyse its photos and compute one vector per detected face. When an attendee takes a selfie, we compute that selfie's vector and compare it against the gallery's to return the photos they most likely appear in.

Face vectors are biometric data and get heightened protection. These are the rules we apply:

The scope is the gallery. One event's vectors are never cross-referenced with another's, or with any global index of people.
The attendee's selfie is discarded once its vector is computed. It is not stored and never gets added to the gallery.
We do not use faces, photos or vectors to train our own models or anyone else's.
We do not sell or share biometric data with anyone for advertising or profiling.
When a gallery is deleted, its vectors are deleted with it.
A match is a statistical estimate, not a certified identification. False positives and false negatives are possible.

04 What we use the data for, and on what legal basis

Providing the service: Creating and hosting galleries, applying the brand frame and generating download links. Legal basis: performance of the contract with the organiser.
Face search: Computing and comparing face vectors so an attendee can find their photos. Legal basis: the attendee's explicit consent, which we ask for before the selfie is taken.
Billing and invoicing: Processing payments and issuing invoices. Legal basis: performance of the contract and our tax obligations.
Security and abuse prevention: Detecting unauthorised access, fraud or prohibited content. Legal basis: our legitimate interest in keeping the service safe.
Service communications: Billing notices, storage expiry warnings and incident reports. Legal basis: performance of the contract.
Analytics and product improvement: Understanding how the site is used so we can improve it. Legal basis: your consent, which you can withdraw at any time.

05 The attendee's consent

Before an attendee takes the selfie we explain what we are going to do with it and ask for their explicit consent. Without that consent no vector is computed and no search is run.

It can be withdrawn at any time by writing to [email protected]. Withdrawing it does not affect the lawfulness of processing carried out beforehand, and on its own it does not delete the gallery photos: that is what the photo removal below is for.

An attendee never needs an account to search. They open the link, consent and search.

06 How long we keep each thing

Search selfie: Discarded as soon as the search finishes. Never stored.
Face vectors: For as long as the gallery is published. Deleted when it is unpublished or removed.
Gallery photos: The organiser decides. On the Pro plan they stay available for 12 months from publication, unless deleted sooner.
Account data: For as long as the account is active. If you close it, we delete or anonymise the data, except what we must keep by law.
Billing data: For the period required by applicable tax and commercial law.
Security logs: A limited period, only as long as we need to investigate incidents and prevent abuse.

07 Who we share data with

We do not sell personal data. We share the minimum necessary with providers working on our behalf, under contract and only for the purposes in this policy:

Infrastructure and hosting for galleries and backups.
Payment processing and invoicing.
Transactional email delivery.
Site usage analytics.
Support tools for handling your questions.

We may also disclose data where a law or a competent authority requires it. If you want the current list of providers, ask [email protected] and we will send it.

08 International transfers

Some of those providers may process data outside your country. When that happens we rely on the mechanisms set out in applicable law, such as standard contractual clauses or an adequacy decision, and we require safeguards equivalent to those in this policy.

09 Your rights

Whether you are an organiser or an attendee, you can exercise these rights over your data:

Access the data we hold about you.
Correct anything inaccurate.
Delete it, including your photos in a gallery.
Object to a processing activity or ask us to restrict it.
Receive it in a portable format.
Withdraw your consent at any time.
Not be subject to automated decisions with significant legal effects. Face search only groups photos: it makes no decision about you.

Write to [email protected] saying which right you want to exercise. We answer within the period set by applicable law and, if needed, we will ask for something to confirm you are who you say you are. If you think we handled your request poorly, you can complain to the data protection authority in your country.

10 How to ask us to remove your photos

Anyone appearing in a gallery can ask for their photos to be removed, even without an account and even if they did not organise the event.

You can ask the organiser, who controls the gallery, or write to [email protected] with the gallery link and a way to identify the photos. We will handle the request and notify the organiser.

11 Minors

You must be of legal age to open an organiser account. The service is not aimed at minors and we do not knowingly collect their data.

At events where minors are photographed — school graduations, for instance — it is the organiser's job to hold permission from whoever has parental responsibility or guardianship before publishing the gallery. If we find that a minor's face has been processed without that permission, we remove it.

12 Security

We encrypt traffic in transit and storage at rest, restrict internal access to the people who need it, and log those accesses. Gallery links can be protected and given an expiry date.

No system is infallible. If a breach affects your data, we will notify whoever needs to be notified within the periods set by applicable law.

13 Cookies

We use the cookies needed for the site to work and to remember your preferences, such as language. Analytics cookies are only set if you accept them, and you can change your mind at any time from your browser.

14 Changes to this policy

If we update it, we will change the date shown at the top. When a change is significant — a new purpose for biometric data, say — we will tell you by email or in the app before it takes effect.

15 Contact

For anything about privacy, write to [email protected]. For everything else, [email protected].