Privacy Policy

1. Who we are

Snaptagious ("we", "us") provides an event photo-sharing platform: hosts create an event and guests join via a QR code to add photos, videos and audio to a shared gallery.

The data controller is Deep Sukhman Singh, a sole trader based in the United Kingdom, registered with the UK Information Commissioner's Office under registration number ZC196459. A postal address is available on request. For any privacy matter, contact privacy@snaptagious.com.

When a business host (e.g. a company or club) runs an event, that host is the controller of their guests' data and we act as their processor; we are the controller for our own account and billing data.

Children.Some events — youth sports especially — involve photos of children. Where an event involves children, the host organising it (the club, school, coach or parent) is the controller responsible for having the appropriate consent to photograph and share those images; we process that content on the host's behalf to provide the gallery. A parent or guardian who wants a child's image removed can ask the host, or contact privacy@snaptagious.com and we'll help.

2. What we collect

• Host account details (name, email) via email, one-time code, Google or Apple sign-in.
• Event details a host creates (name, type, date, branding).
• Guest details entered on joining (name, optional phone number and/or email).
• Photos, videos and audio that guests upload to a gallery.
• Facial-recognition data — a mathematical face template — only if a guest explicitly opts in (see §5).
• Payment details are entered directly with Stripe; we never see or store card numbers.
• Basic technical/usage data needed to run and secure the service.

3. Legal bases (UK & EU GDPR)

• Contract — to operate the event and gallery a host has signed up for.
• Consent — for facial recognition, and for optional marketing email. Consent can be withdrawn at any time.
• Legitimate interests — to secure the platform, prevent abuse, and moderate content for safety.
• Legal obligation — to meet tax, accounting and other statutory duties.

Facial-recognition data is "special category" data; we rely on your explicit consent (UK/EU GDPR Art. 9(2)(a)) and process it only for the single event you opt into.

4. How we use information

To run the gallery; moderate uploads for safety using automated AI review; run opt-in features such as the scavenger hunt and face matching; process payments; and send event-related messages such as a gallery-expiry reminder. Automated moderation may hide unsafe content; it does not produce legal or similarly significant effects, and a host can review decisions.

5. Facial recognition (opt-in biometrics)

• Strictly opt-in. Nothing happens unless a guest ticks the consent box and takes a selfie. Everything else on the platform works without it.
• Over-18 only. By opting in, the guest confirms they are 18 or older.
• We keep a template, not your photo. The selfie image is deleted immediately after a face template is created; we store only the abstract template.
• Used for one event only. The template is scoped to that single event and is never used to identify you elsewhere, nor sold, leased or traded.
• Processed in the UK. Face matching runs on AWS in the UK (London) region.
• Deleted automatically. When the gallery expires the template and all media are permanently deleted, and in any case within 12 months of collection.
• Withdraw any time. A guest can delete their face data instantly from the event page, or by emailing us.
• Not for children. Face matching is for adults. The host is responsible for indicating whether their event may include under-18s (e.g. youth sports or school events); when they do, we disable the selfie opt-in and stop all matching for the whole event. Hosts are responsible for having any consent required for the people at their event.

Our full Biometric Data Retention & Destruction Policy is available on request from privacy@snaptagious.com.

6. Data retention & deletion

• Gallery media & face templates — deleted when the event gallery expires (the period set by the host's package).
• Selfie images — deleted immediately after the face template is created.
• Guest records — removed with the event on expiry.
• Host account & billing records — kept while the account is active and as needed for legal/accounting duties, then deleted.

Hosts and guests may request earlier deletion at any time (see §9).

7. Sub-processors we use

We share data only with the providers below, each under a data processing agreement and only as needed to run the service:

8. International transfers

Some providers process data outside the UK/EU (notably in the US). Where they do, transfers are protected by UK/EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and/or the EU-US Data Privacy Framework, as applicable.

9. Your rights

You have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent (including for facial recognition) at any time. Exercise any of these by emailing privacy@snaptagious.com.

If you are unhappy with how we handle your data you can complain to the UK Information Commissioner's Office (ico.org.uk), or your local EU supervisory authority.

10. Security

Data is encrypted in transit; access is restricted; a guest sees only their own uploads. We use reputable, security-certified providers (see §7). No system is perfectly secure, but we take reasonable measures to protect your data.

11. Cookies

We use only essential cookies needed to sign you in and keep your session — no advertising or third-party tracking cookies.

12. Changes & contact

We may update this policy; the "last updated" date above shows the latest version. Questions or requests: privacy@snaptagious.com.