Privacy Policy

thatsmypic (“we”, “us”, “our”) is an AI-powered event photo delivery platform. Photographers upload event photos; guests find their photos instantly using facial recognition. This policy explains how we collect, use, and protect your information.

Photographers (account holders)

• Account details provided through Clerk (name, email, authentication credentials)
• Event photos you upload for processing and delivery
• Subscription and payment information processed by Razorpay
• Usage data such as event count and photo volume

Guests (event attendees)

• A selfie photograph used solely for facial recognition matching
• Face embeddings — mathematical representations derived from the selfie, used to match your face across event photos
• No account creation required. No email, no phone number, no personal identifiers beyond the selfie

Our AI processes uploaded event photos to detect and encode faces as numerical vectors (face embeddings). When a guest takes a selfie, we generate a temporary embedding and match it against the event’s embeddings to surface relevant photos.

• Face embeddings are mathematical representations — not photographs of faces
• Guest selfies are used only for the matching session and are not stored permanently
• Embeddings are scoped to the event and deleted when the photographer removes the event
• We do not sell, share, or use facial data for advertising, profiling, or any purpose beyond photo matching

All data is encrypted in transit (TLS) and at rest. Photos are stored on secure cloud infrastructure. Access is restricted to authorised services necessary for photo processing and delivery.

• Photos are stored in private cloud storage buckets with restricted access
• Face embeddings are stored separately from photos and personal information
• We use industry-standard security practices and regularly review our infrastructure

We rely on trusted third-party providers for specific services:

• Clerk — authentication and user management
• Razorpay — payment processing. We do not store your card details; Razorpay handles all payment data under PCI-DSS compliance
• Cloud infrastructure — photo storage and AI processing

Each provider operates under their own privacy policy. We only share the minimum data necessary for them to provide their service.

• Event photos and embeddings are retained as long as the photographer keeps the event active. When an event is deleted, all associated photos and face data are permanently removed.
• Guest selfies are processed in memory and not stored beyond the matching session.
• Account data is retained while your account is active. You can request deletion at any time by contacting us.

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data and account
• Object to processing of your data
• Withdraw consent for facial recognition (guests can simply choose not to take a selfie)

To exercise any of these rights, contact us at hello@thatsmypic.com.

We use essential cookies for authentication and session management. We do not use advertising cookies. We do use service analytics tools, including Google Analytics and Microsoft Clarity, to understand usage patterns, improve navigation, and troubleshoot product issues.

thatsmypic is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child’s data has been collected, contact us and we will promptly delete it.

We may update this policy from time to time. Material changes will be communicated through the platform or via email to registered photographers. Continued use of the service after changes constitutes acceptance of the updated policy.

Questions or concerns about your privacy? Reach us at hello@thatsmypic.com.