File for your data protection officer

The limits sit next to the measures.

1. In short

An organiser uploads the photos. Each guest who consents takes a selfie and finds the ones they appear in.
The selfie is destroyed as soon as its fingerprint is computed. The fingerprint is deleted 90 days after the event, or on request.
The service also detects the faces of people who asked for nothing. That index is destroyed 15 days after the event or the last photo analysed.
Hosting in the European Union. The publisher is an American company, subject to the CLOUD Act.
No exception in Article 9(2) covers people photographed without consent. We say so below.

2. Who is responsible for what

The controller is Kabinary LLC, a Wyoming company that publishes YourPics. The service is run from France, where its director lives.

Responsibilities follow Article 26.

The organiser informs the people present and handles requests about the photographs, including the removal of a face. YourPics handles those about selfies, fingerprints and accounts, notifies breaches and keeps the impact assessment. A person may contact either party.

For the Business plan, the agreement is accepted at payment; for an event covered by the Agency+ subscription, when it is first shared. In both cases, through a box that is never pre-ticked, for a single event, in the name of the designated company. It is governed by French law. For the other plans, the same allocation is set out in the terms of use.

Event photographs (upload, hosting, availability): the organiser and YourPics are joint controllers. The organiser decides on the event, what is uploaded, the guests and what is shown.
Biometric processing (detection, fingerprints, consent, matching): YourPics alone. It sets the model, threshold, retention periods and isolation.

3. The data processed

Email address, first name, last name, organisation, purchases, uploaded photographs with their original file name. Business plan: company, address, signatory of the agreement. YourPics never sees payment card data.

One to three selfie fingerprints (Article 9), the version of the accepted text, timestamps, an event-specific code, no name. No name, email address or IP address is collected for this journey. An account is only required to add one's own photos, or if the organiser has restricted the event to invited people.

Their face is detected and becomes a fingerprint, confined to the event, with no name. If they ask for their face to be removed, an area remains (four coordinates, two dates, a reason) that cannot identify anyone.

4. Legal basis and consent

The selfie fingerprint relies on explicit consent (Article 9(2)(a)). It is collected before any computation, never pre-ticked, and the server refuses any selfie without it. The text is versioned: a change voids earlier consents. Guests must be 15 or older. The screen states that recognition is performed by artificial intelligence.

Entering without a selfie counts as refusal: no fingerprint is computed. The guest then sees all photos if the album is open to everyone, otherwise those the organiser has highlighted, if any. Refusing changes no price.

For employees, consent given to an employer is fragile by nature. Refusal must therefore remain practical and free of consequences. For the photographs, the organiser determines and documents their legal basis.

5. People who have not consented

To find a guest's photos, the service detects every face in the photos, including those of people who never scanned the code. No exception in Article 9(2) covers these people. We invoke none, and the measures below are not a legal basis: they limit the exposure, they do not justify it.

The publisher considers the risk tolerable given these limits.

the index is destroyed 15 days after the last photo analysed or the day of the event, with no setting to extend it;
it is isolated to the event, with no name and no link to an account;
no outside image enters the system, and no training is done on the fingerprints;
any photographed person can ask the organiser to remove their face, without an account: it is blurred and its fingerprints deleted;
the organiser attests, when creating the event, that they have informed the people photographed.
the fingerprint is computed before any request;
the mechanism is reactive and the organiser can restore a face;
the unblurred original is kept;
if the index is rebuilt, the face is detected again for 15 days.

6. Retention periods

Data : Selfie (image) ; Period : Not kept ; Starting point : Fingerprint computed
Data : Selfie fingerprint ; Period : 90 days, or on request ; Starting point : End of the event or last photo upload
Data : Index of faces in the photos ; Period : 15 days, rebuilt if a guest returns or analysis is rerun ; Starting point : Last photo analysed or day of the event
Data : Database backups (with fingerprints) ; Period : 30 days at most ; Starting point : Date of the backup
Data : Photographs ; Period : 2 years, warnings at 60 and 15 days ; Starting point : Last upload or day of the event
Data : Consent register (no names) ; Period : 6 months; until the photos are deleted in case of refusal ; Starting point : Guest's arrival
Data : Register attestation, payment, event ; Period : 5 years ; Starting point : Deletion of the photographs
Data : Face removal areas ; Period : As long as the photo exists ; Starting point : Deletion of the photo
Data : Account ; Period : Erased after 3 years of inactivity ; Starting point : Last activity

7. Hosting and processors

No biometric data leaves the Union. The director may access administration data from the United States. The publisher remains subject to the CLOUD Act, wherever the servers are.

Name : Hetzner Online GmbH ; Role : Server, database, face detection ; Country : German company, server in Finland ; Safeguards : Article 28 contract (2026-10-01); encrypted disk
Name : Scaleway SAS ; Role : Photos, backups, emails, AI model of the help ; Country : France ; Safeguards : Built-in processing agreement; no photo or fingerprint sent to the AI
Name : Stripe, LLC ; Role : Payment ; Country : United States ; Safeguards : Data Privacy Framework, standard clauses; no photo
Name : Cloudflare, Inc. ; Role : Traffic relay and bot verification ; Country : United States ; Safeguards : Data Privacy Framework; photos and selfies in transit, neither kept nor analysed, never the face print
Name : Google, LinkedIn ; Role : Optional sign-in for the organiser ; Country : Ireland ; Safeguards : No photo or fingerprint

8. Security

The selfie is never stored; its fingerprint is encrypted with a key kept outside the database.
The fingerprints of faces in the photos are not encrypted one by one, because the database compares them: full-disk encryption, destruction within 15 days.
The key is a file protected by its access rights and disk encryption, not encrypted itself.
Photos in private storage, served through signed links of 30 minutes at most.
Permissions checked on the server for every request.
Neither images nor fingerprints in the logs.
Daily backups of the database and the key, in separate archives, in private storage encrypted at rest.
Written breach procedure: authority notified within 72 hours.

9. Data subject rights

A guest withdraws consent and erases their fingerprint, along with the faces matched to theirs, from the event's privacy area, without going through the organiser or YourPics.

Access, rectification, objection, portability, erasure: through the contact page, answered within one month. Requests about photos fall to the organiser and are passed on to them. Complaints can be lodged with the CNIL.

10. Impact assessment

An impact assessment (Article 35) is maintained. It covers necessity, risks, measures checked in the code, rights and gaps. Latest history entry: 7 October 2026. It is revised with every change to the processing and rates the risk as high by nature.

11. Further reading

The privacy policy, the terms of use, the joint controllership agreement and the consent text are published on the site. For any question, write through the contact page.