Biometric Data Policy & Consent
DRAFT — FOR ATTORNEY REVIEW. NOT YET IN EFFECT. Written to satisfy biometric-privacy statutes including the Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14), Texas CUBI, and GDPR Article 9. Placeholders in [brackets] must be completed before publication.
This is Fotoccasion's written policy on biometric identifiers and biometric information ("biometric data"), and the consent we ask for before collecting any. It is publicly available and part of our Privacy Policy.
What we collect and why
If — and only if — you choose to enroll a face, Fotoccasion creates a faceprint: a numeric representation (512 numbers) derived from a photo of a face. We use faceprints for exactly one purpose: recognizing enrolled event members in that event's photos and videos, so that (a) you can find the photos you appear in, and (b) the event's privacy controls (blur me / hide me / release) can be applied to the right person.
We also compute faceprints for faces detected in uploaded event media, solely to match them against members enrolled in that same event.
What we never do with biometric data
•We never sell, lease, trade, or otherwise profit from your biometric data (and BIPA prohibits it).
•We never disclose it to third parties except our storage/database infrastructure providers acting as processors under contract (see the sub-processor list), or when required by law or with your further consent.
•We never use it to train machine-learning models.
•We never match your face across unrelated events, and we never receive faceprints from — or provide them to — data brokers, advertisers, or law enforcement absent valid legal process.
Consent (what you agree to at enrollment)
Before any faceprint is created you are shown this consent and must affirmatively accept it (a recorded, versioned, timestamped act):
By adding a face you authorize Fotoccasion to create and store a faceprint (a numeric representation of the face) and to use it to recognize that person in photos and videos at events they join, as described in this policy. Faceprints are never sold or shared, and you can delete them at any time.
Enrolling a face profile for another person (for example, your minor child) requires that you are their parent or legal guardian, or have their authorization, and you consent on their behalf. For a child under 13, we require verifiable parental consent (COPPA) — we record and verify each request before the child's faceprint is created; until a request is verified, no faceprint is enrolled for that child.
Declining costs you nothing except automatic recognition — you can always use Fotoccasion without enrolling a face.
Retention and destruction schedule
Faceprints are permanently destroyed at the earliest of:
•Your deletion — you can delete any enrolled faceprint in the app at any time; destruction is immediate.
•Account deletion — deleting your account destroys all your enrolled faceprints.
•Purpose fulfilled — faceprints computed from event media are destroyed when the media or event they belong to is deleted.
•Inactivity backstop — no later than [3 years] after your last interaction with Fotoccasion, as BIPA requires. [ENGINEERING NOTE: automated purge job to be implemented before launch.]
Destruction means deletion of the stored embedding from our database (and any backups on their normal expiration cycle, no longer than [35 days]).
Storage and protection
Faceprints are stored in our primary database (Neon Postgres) and processed only inside our own application — no third-party facial-recognition service ever receives your images or faceprints. We protect biometric data using a reasonable standard of care at least as protective as the way we treat other confidential information: encrypted transport and storage, access restricted to production systems, media originals behind unguessable keys, and consent-gated delivery of any media in which recognition results are used.
Questions or requests
[COMPANY LEGAL NAME] · [privacy@fotoccasion.com]. You may withdraw consent at any time by deleting your faceprints in the app or contacting us; withdrawal stops recognition going forward.