Event Face FinderCreate an event

Privacy

This policy explains how Event Face Finder handles account information, event photos, selfie searches and optional analytics, and how you can exercise your rights.

Last updated:

Who is responsible for your data

  • Event Face Finder is operated by Mathéo ROBERT, entrepreneur individuel, 26 rue du Vallon, 30900 Nîmes, France (SIREN 917577041). Contact: [email protected].
  • The organizer decides why photos are uploaded, who can access the gallery and which search, download and retention settings apply. The organizer is responsible for this event data; Event Face Finder processes it on the organizer’s behalf.
  • Mathéo ROBERT is responsible for the account, billing, security, support and optional analytics data used to operate Event Face Finder.

Information we process and why

  • Account and team details, email addresses, password hashes and session records let organizers sign in, manage events and receive service messages.
  • Event settings, uploaded and contributed photos, previews, import details and processing status let us deliver the gallery. When face search is enabled, the service creates numerical representations of faces in event photos.
  • Selfie search processes your selfie temporarily and records consent, search status and results. We do not save the selfie image in event storage or use it to train models. A query representation can be reused briefly in memory to avoid repeating processing.
  • Payment references, amounts and invoice information support payments, refunds and accounting. Stripe processes payment card details; we do not store full card numbers.
  • Support messages, privacy requests, technical logs and security records help us answer requests and protect the service. After browser consent, PostHog provides optional usage analytics, error diagnostics, performance measurements and session recordings.
  • If you request an email when event photos are ready, we store your address and notification choice. Promotional email consent is separate; notification emails include an unsubscribe link.

Legal grounds and your choices

  • Account and purchased service processing is necessary to perform our contract with you. Mandatory accounting records are kept to meet legal obligations. Account protection, abuse prevention and support are our legitimate interests, subject to your rights.
  • Optional browser analytics and guest photo alerts rely on consent. You can reject analytics, change your cookie choices or unsubscribe from alerts.
  • Selfie matching requires explicit consent for the selected event. Face representations used to identify a person are treated as sensitive biometric data. Organizers must establish a lawful basis for event processing and an applicable condition for biometric processing, including for people in uploaded photos. Your selfie consent does not provide consent on behalf of other attendees.
  • You may stop selfie search and withdraw consent through the event privacy request form, the organizer or support. Withdrawal does not affect earlier lawful processing. Gallery browsing remains available without selfie matching where the organizer enables it.
  • Matches are suggestions, can be wrong or incomplete, and are not used to make decisions with legal or similarly significant effects about you.

Who receives information

  • Organizers and authorized team members access event information according to their roles. Guests access photos according to gallery settings; public galleries may be viewed by anyone with the link.
  • Hetzner hosts the web application and database. Cloudflare provides network protection, Turnstile verification, photo storage and delivery. Scaleway provides photo processing and face search compute. Stripe handles payments and connected organizer payouts. Resend delivers service emails. PostHog provides optional product analytics and recordings.
  • Production photo buckets use Cloudflare R2’s EU jurisdiction; Scaleway processing is configured in Paris, France, and the analytics project uses PostHog’s EU service. These settings do not mean every provider’s support or operational processing is confined to the EU. Contact us for information about provider contracts and any applicable international transfer safeguards.
  • We may disclose necessary information to comply with law or a lawful authority request. We do not sell event photos or guest selfies.

Professional outreach

  • To suggest Event Face Finder to an event organizer or an event photographer, we may use the professional contact details they publish: on the event’s website or registration partner page, or on the photographer’s website or business social media profile. We also use public details about the event or the published work, such as its name, date and format. This processing relies on our legitimate interest in presenting a service related to your professional activity.
  • The first message says where we found your contact details. To stop receiving our messages, simply reply or write to [email protected]. Emails are sent from our Gmail mailbox (Google) and contain no open-tracking pixel. A message sent on a social network stays on that network.
  • When an email links to a presentation page for your event, the link carries an opaque identifier that displays the event’s name and date. It does not contain your email address.
  • We keep this information no longer than 90 days after the event concerned, or 90 days after our last message when no event is involved, unless you become a customer. If you object, we keep only your contact details on a suppression list so that we do not contact you again.

Retention and deletion

  • Standard event passes include 60 days of hosting. The event’s displayed retention end date controls availability. After expiry, guest access closes and deletion is scheduled after a seven-day grace period, unless a documented hold applies.
  • Event deletion removes photo objects, previews and stored face representations. Background cleanup can require retries; deletion is not instantaneous at the expiry time.
  • Account, payment, support and security records are kept for the period needed to operate the account, resolve requests, meet statutory recordkeeping duties or establish and defend legal claims. Ask support for the retention applicable to a particular record.
  • Browser storage has separate lifetimes described in the cookies notice. Copies downloaded by guests or retained in the organizer’s source systems are outside our deletion process.

Analytics and event content

  • Browser analytics starts only after acceptance. Private media and designated private text are blocked or masked in recordings. Capture filters remove sensitive fields such as access codes, signed media URLs and payment secrets.
  • Rejecting analytics does not prevent sign-in, uploads, gallery access, search, checkout or privacy requests. Analytics consent is separate from biometric consent.

Your rights and contact

  • Depending on the processing, you can request access, correction, deletion, restriction or portability, object to processing based on legitimate interests, and withdraw consent.
  • For event photos, use the event privacy request form or contact the organizer. For account data or help reaching the organizer, email [email protected]. Include the event link or account email; we may request proportionate verification.
  • Under the GDPR, the responsible controller must respond without undue delay and normally within one month. Complex or numerous requests may take up to two additional months where permitted; the extension must be explained within the first month.
  • You may complain to the CNIL in France or the competent data protection authority where you live or work.

Further information