Privacy notice and your rights

The studio that photographed your event decides why and how its guests’, couples’ and clients’ data is used. It is the Data Fiduciary for that data: its galleries, guest lists, reminders, face-search settings, contracts and invoices.

Snabb runs the service for the studio as its Data Processor, under a written agreement (the Data Processing Addendum), and does not use guests’ data for advertising, for training models or for anything the studio has not asked for. Snabb is itself the Data Fiduciary for studio staff accounts, studio billing, support, platform security logs and this website.

You can contact either. A request about an event goes to that studio when you give the event code in the form below; otherwise it comes to Snabb, and we pass it on or help the studio answer it.

• Guests: a selfie, only while your search runs; which event photos you appear in; the favourites, downloads and shares you make; the age answer you give; optionally your name, phone number or email; feedback and video wishes you choose to leave.
• Parents and guardians: name, relationship to the child, and an email address if you verify by code; a record that you consented for the child.
• Couples: the gallery PIN, your selections, comments, feedback and album approvals.
• Studio clients: enquiry, booking, contract, invoice and payment details.
• Studio staff: account, sign-in and activity records.
• Technical: IP address and browser on consent and security records; a private, HttpOnly cookie that keeps a guest signed in to their own photos; your age answer in this browser tab only. No advertising trackers.

Consent is asked for one purpose at a time, in a notice shown before the camera opens, in English, Hindi or Tamil. Each notice has a version and a fingerprint; we record which one you saw and agreed to. The Hindi and Tamil wording is a draft awaiting legal and translator review; the English text prevails until then.

• You take three photos of yourself on the event page. They are sent to the service, compared with the faces found in that one event’s photos, and then discarded. Your selfie is never stored, and neither is the face signature computed from it.
• Face signatures are made only from the studio’s own event photos, which may include your face, kept only for that event, and deleted with the event at its deletion date. When you withdraw consent or your data is erased, the signatures of your face that matched you stop being searchable at once and are deleted from the face service. A studio can also delete an event’s whole face index and keep its photos.
• You see only photos matched to you. Uncertain matches are shown to you alone, for you to confirm or reject.
• To stop someone using another person’s photo, the service checks for replayed or identical captures and asks for a random head movement. It keeps only a coded fingerprint of the frames, never the images, for about an hour (one day at the most). These checks are not a full “liveness” test, and we do not claim they are. A studio can mark an event high-risk, in which case every guest also confirms an email address before searching.
• On WhatsApp, face search is for adults only, after you confirm you are 18 or over and have read the notice.
• You can withdraw at any time with the Withdraw consent button on your photos page. It deletes your matches, actions and links at once. Stopping reminders is a separate button.

Under the Act a child is anyone under 18, and a child’s data needs the verifiable consent of a parent or lawful guardian (s.9; Rules r.10). Before the camera opens we ask who the search is for. For a child, a parent or guardian must consent first, in one of three ways: by being present and searching on the child’s behalf with a signed declaration; by being verified in person by the studio at the venue; or by a one-time code sent to their email. “I’m not sure” does not allow a search.

We do not keep a child’s selfie or a face signature made from it (signatures from the studio’s event photos, which may include a child, are deleted for the child’s matches on withdrawal), do not send children reminders, do not include children in per-person analytics, and do not track, profile or target advertising at children. A studio can turn off children’s search for an event. A parent or guardian’s consent lasts 24 hours at most and covers one child.

Data is erased when its purpose ends, when you withdraw consent or when you ask, unless a law requires it to be kept (s.8(7)). Invoices are the main exception: they are kept 8 years from the end of the financial year, as tax law requires, with optional details removed if you ask for erasure.

• Access (s.11): a summary of your data and how it is used. Guests can download their own data from their photos page at any time.
• Correction and erasure (s.12): correct, complete or update your data, or have it erased. Send the request with the form below (or write to the grievance officer); the studio acts on it and you get a reply.
• Withdraw consent (s.6(4)): use the same form, naming the event, or write to the grievance officer. Withdrawal stops the processing from then on.
• Grievance redressal (s.13): complain to the grievance officer below. If you are not satisfied, you may complain to the Data Protection Board of India.
• Nominate (s.14): name someone to exercise your rights if you die or cannot.

Use the form below. We check your email with a one-time code first, so no one else can make a request in your name. We aim to answer within 30 days; the Rules allow up to 90 days for grievances (r.14). You may be asked for more detail to find your records — for a guest, the event code and the email or phone you used.

A studio may also show its own contact details on its event pages. Requests about an event are passed to that studio.

Data may be processed outside India. Our database is hosted by Neon in Singapore, and some of the services below run in other countries. The Act allows this except to countries the Central Government restricts by notification (s.16; Rules r.15); we will stop any transfer to a restricted country. These services process data for Snabb:

Photos are stored privately and shown only through short-lived signed links. Access is limited by role, every sensitive action is logged, one-time codes and tokens are stored only as hashes, and the consent record cannot be altered after it is written (s.8(5); Rules r.6).

If a breach affects your data, the responsible studio or Snabb will tell you without delay: what happened, the likely consequences, what is being done and what you can do. The Data Protection Board is told without delay, with a detailed report within 72 hours (s.8(6); Rules r.7). There is no automated Board interface; reports are made through the Board’s own channels.