Events privacy addendum

This addendum explains what happens to personal data at events that an organiser or photographer hosts on FindMyPhoto: for guests who look for their photos, for people who appear in the event photos, for visitors who only browse an event's open gallery, and for creators.

1. Scope and precedence

This addendum applies to hosted events: events that an organiser, photographer, venue, club or other organisation (the creator) creates on creator.findmyphoto.app, and that guests open with a link or QR code on event.findmyphoto.app, or with the event code in the FindMyPhoto app.

It applies in addition to our Privacy Policy. For hosted events it takes precedence where the two differ. When you search an album link that you submit yourself, only the Privacy Policy applies.

What creators promise us, including the data processing agreement, is in the Creator Terms. The text guests accept is published as the event consent text.

2. Who is responsible

The creator is the controller for their event: the event photos and the versions we make of them, the face index of those photos, the list of guests who joined, guest selfies and the match results. The event page, the consent screen and our emails name the creator as "Hosted by {display name} (@handle)". An @handle belongs to one creator at a time: while their account exists no one else can host under it, and after they delete their account the handle can be chosen again (Creator Terms, section 2).
FindMyPhoto processes that data on the creator's behalf (as processor, Article 28 GDPR), only on the creator's documented instructions, under the data processing agreement in the Creator Terms. FindMyPhoto is operated by S-Industry, based in the Netherlands.
FindMyPhoto is itself the controller for: creator accounts; FindMyPhoto accounts and the app, also when you link a hosted event to your account (the Privacy Policy applies to those); security logs and abuse prevention; the list of addresses we must not email (bounces, spam complaints, unsubscribes); and the service emails and app notifications we send ourselves.

3. What data is processed

Creator account: besides the FindMyPhoto account itself, the display name, @handle, email address, optional logo and reply-to address, language, the version of the Creator Terms accepted and when, and the settings of each event.
Event details: name, date, event code and link, retention period, and settings such as the General tab, the open gallery, downloads and watermark.
Event photos: the photos the creator uploads or imports, and the versions we make of them: a full-size copy, a medium and a thumbnail version, and a watermarked copy if the creator turns that on. We remove location data and other embedded metadata (EXIF, XMP, IPTC, GPS) from every version we keep. The uploaded original, metadata included, is deleted once it has been processed, and at the latest after 2 days. The time a photo was taken is read first and used only to sort the photos for the creator.
Face index (biometric data): Amazon Rekognition detects the faces in each photo (up to 15 per photo) and stores a face vector for each one, a set of numbers that describes the face, in a face collection that belongs to that one event. This covers everyone who appears in the photos, including people who never join. A face vector is linked only to the random identifier of its photo: no name, email address or other identity is attached. We do not ask Rekognition to estimate age, gender, emotion or any other characteristic.
Guest email address: to send your gallery link and the emails you choose. We also keep a keyed hash of it, to recognise a repeat sign-up and to link the event to a FindMyPhoto account with the same verified address.
Guest selfie: the photo you take or choose to find yourself. It is used for a search (section 5) and never added to the face index.
Consent record: a random participant reference and the keyed hash of your email address (the same identifiers as your participation), the version of the consent text and the sha256 fingerprint of the published consent text in your language, your language, the date and time (UTC), your choice (once or keep me posted), what you did (accepted, changed your choice, withdrew, left or asked for erasure), whether you used the app (iOS or Android) or the website, and the version of the app or website you used. It does not contain your IP address or browser details.
Match results: which event photos you were found in, the similarity score and when.
App data (only if you use the app): the event in your FindMyPhoto account or guest profile, and your push token, as described in the Privacy Policy.
Website and security data: strictly necessary cookies (Privacy Policy, section 5a); your IP address, which we use only as a hash in short-lived counters that stop abuse; and technical logs (times, errors, request identifiers).
Open-gallery visitors: someone who only browses an open gallery (section 5, step 11) gives us no selfie, email address or name, and gets no account and no session. Their browser receives access cookies for that one event's photos, valid for at most 1 hour (Privacy Policy, section 5a), and their requests leave the ordinary technical logs that every visit to our websites leaves. Like every visit to an event page, they are also counted under a hash of the visitor's IP address, never the address itself, in the short-lived abuse-prevention counters (section 6). We store nothing else about them.
Email delivery data: whether an email to you bounced, was marked as spam or was rejected, and whether you unsubscribed from new-photo emails. We do not record deliveries, opens or clicks.

4. Why, and on what legal basis

The creator's account and the contract with the creator: performance of that contract (Article 6(1)(b) GDPR); FindMyPhoto is the controller for this. The events themselves, with their photos, guest data and exports, are processed on the creator's instructions (section 2).
Searching for you with your selfie: your explicit consent (Article 9(2)(a) GDPR), which we collect on the creator's behalf with a separate checkbox before your selfie is used. Without it, nothing is searched. You can withdraw it at any time (section 8); that does not undo what already happened.
Sending your gallery link and the notifications you chose: your request when you sign up, as part of the same consent (Article 6(1)(a) GDPR). You can stop new-photo emails at any time with the unsubscribe link.
The face index of the people in the event photos: this rests on the creator's legal basis and obligations as controller: the right to take and share the photos, telling attendees in advance (for example with our privacy outline, on the ticket page and at the venue), and handling objections and removal requests. The index is limited to one event, holds no names, is searched only with the selfie of a guest who gave explicit consent, and is deleted with the event.
Showing the event photos to anyone with the link (open gallery): the creator's decision, which rests on the creator's legal basis as controller; we show the photos on the creator's instruction (Creator Terms, sections 4 and 5.2).
Security, abuse prevention, logs and the do-not-email list: FindMyPhoto's legitimate interest in keeping the service secure and our emails deliverable (Article 6(1)(f) GDPR).
Proof of consent (section 6): to be able to show that consent was given (Article 7(1) GDPR) and to defend legal claims.
Showing a hosted event in your FindMyPhoto account or app (when you sign in with the same verified email address, open an event link in the app, or sign in for the first time on a phone where you joined as a guest): the contract for your account (Privacy Policy); the creator instructs us to deliver guests' photos this way (Creator Terms, section 5.2).

Nobody is subject to a decision with legal or similarly significant effects made by automated means. Nothing processed for hosted events is used to train or improve any AI model: our AWS organisation is opted out of the use of content to improve AWS's AI services.

5. How it works, step by step

1. The creator adds photos. Photos are uploaded or imported into our storage in Stockholm. We make the display versions, remove the metadata, and send each photo to Amazon Rekognition in Ireland, which adds the faces in it to the event's own face collection.
2. You open the event. Scan the QR code or open the link (no app needed), or enter the event code in the app. The page shows who hosts the event.
3. Selfie, choice and consent. You take or choose a selfie, enter your email address (on the website), choose "Find my photos once" or "Keep me posted", and tick the separate consent box. We check that the selfie shows exactly one clear face; if it does not, it is deleted straight away and you can try again (up to 3 times a day).
4. The search. Rekognition compares your selfie with that event's face collection only, and returns the photos with a similarity of 85 or more out of 100. The threshold is strict, so that you are not shown photos of someone else. Your selfie is never added to the collection, and no face template of your selfie is kept. If you appear in the event photos yourself, your face is in the collection like everyone else's (section 3).
5. Your gallery. We save the matches and email you a personal gallery link, valid for 30 days; you can ask for a new one at any time. If the FindMyPhoto app is installed on your phone, the link opens your photos in the app and links the event to the account or guest profile you use there; otherwise it opens in your browser. Anyone who has your link can open your gallery, so do not forward it.
6. Find my photos once. Your selfie is deleted right after the search. You get the photos that were online at that moment.
7. Keep me posted. Your selfie is kept, as a photo and not as a face template, while the event is open. When the creator adds photos, your selfie is compared with the new photos in batches, at most every 10 minutes, and you are told about new photos of you: by email at most once a day, or by a push notification if you use the app. When the event closes, your selfie is deleted and the search stops.
8. What you see. "My photos" shows the photos you were found in. If the creator keeps the General tab on (the default), every guest of the event also sees all its photos, and can download them if the creator allows downloads (originals are downloadable by default). App users may also get a notification, at most once a day, when new photos are added to the General tab. Photos are delivered through signed links that expire and work for that one event only.
9. Emails. Event emails come from photos@findmyphoto.app and are sent through Amazon SES in Stockholm. Replies go to the creator if they set a reply-to address, otherwise to our support. You can receive: your gallery link, updates about new photos of you (keep me posted only, with an unsubscribe link), a new link when you ask for one, a request to try again with a new selfie if yours could not be used or your sign-up could not be finished while the event is open, a confirmation when you change or withdraw your choice, an email when a large download (zip) is ready, the new end date if the creator extends the event (in the app, as a notification), and, with keep me posted or in the app, a reminder 7 days before the photos are deleted. We do not track whether you open our emails or click their links, and we never add you to a newsletter.
10. Your FindMyPhoto account. If you create a FindMyPhoto account, or sign in to one, with the email address you used for an event, the event appears in your account without a new selfie. When you sign in for the first time on a phone where you used the app as a guest, the hosted events you joined as a guest move to your account.
11. Open gallery. The creator can also switch on "Anyone with the link can see all photos" for an event. It is off by default, can only be on while the General tab is on, and works on the website only. Anyone with the event link or QR code can then browse all photos of the General tab, and download them as the creator's download setting allows, without a selfie, an email address or an account. The selfie search stays available next to it. The open gallery works while the event is open or closed and its photos are online, never for an archived, deleted or expired event. When the creator switches it off, new visitors are refused at once, and access already given ends within an hour.

Who can see the event photos. The creator decides. Guests who sign up see the photos they were found in and, with the General tab on (the default), all the event's photos. If the creator opens the gallery, anyone who has the event link or QR code can see all of them as well, without signing up. We ask search engines not to list event pages, but a link can be passed on, so an open gallery can reach people who were not at the event. The creator must tell attendees in advance who will be able to see the photos (Creator Terms, section 4).

What the creator sees. Totals (photos, guests, matches, downloads); a list of guests with partly hidden email addresses, each guest's choice and number of matched photos; and a consent register they can export, with a pseudonymous reference instead of your email address. The creator can send you a new gallery link or remove you from the event. In FindMyPhoto the creator never sees your full email address (section 7), and never sees your selfie.

6. How long data is kept

Event photos and their versions, the event's face collection and all match results: until the end of the retention period the creator chose for the event: 1, 3 or 12 months, counted from the day the creator sets up the event, or from the event date if the event is set up in advance, so that photos never go offline before the event has taken place. The event date can lie up to a year in the past. The creator can extend it, by at most 12 months from the day of extending and never beyond 24 months after the day the period started counting (the set-up day, or the event date for an event set up in advance), or delete the event earlier. When the creator extends it, every guest still in the event is told the new end date, by email or, in the app, by a notification. After the end, all of it is deleted within 7 days, starting with the face collection. Keep-me-posted guests and app users get a reminder 7 days before.
A photo the creator deletes: removed straight away from the gallery, from storage, from the face index and from everyone's matches; copies cached by our delivery network are invalidated and disappear within minutes. A photo the creator hides is no longer shown to guests, and its cached copies also disappear within minutes.
Your selfie: with "Find my photos once", deleted right after the search. With "Keep me posted", deleted when the event closes, when you leave, withdraw, switch to once or delete your selfie, or when the event is deleted, whichever comes first. A selfie without exactly one clear face is deleted straight away. A selfie uploaded for a sign-up that is never finished is deleted within 24 hours by an hourly clean-up. The rest of an unfinished sign-up on the website, your email address included, is deleted within 8 days; an unfinished join in the app stays until you leave the event, delete your account or the event is deleted. A daily check deletes any selfie that should no longer exist.
Your email address and participation: until you leave or withdraw, or until the event is deleted. Your email address, its hash and any link to an account are then overwritten, and the rest of the record expires 30 days later; the database removes expired records within a few days after that.
Gallery links: valid for 30 days; "Open in the app" links for 15 minutes and only once. All your links stop working when you withdraw or leave, or when the event is deleted.
Download files (zips): deleted after 2 days.
Open-gallery visits: the access cookies expire after at most 1 hour, and never after the end of the event; the requests stay only in the technical logs and the abuse-prevention counters (below).
Consent record: while the event exists. When you withdraw, leave or ask for erasure, or when the event is deleted, the email hash in it is overwritten. The random participant reference stays; once your participation is erased, nothing in our systems links it to your email address or account. The record is kept as proof of consent until 5 years after the event's data is deleted, then deleted.
Event details: while the event exists. After deletion, a short record without the event's name, code, logo or settings (only its dates, counters and the creator's account reference) is kept for 90 days, then deleted.
Do-not-email list: a hash of your address, kept after a hard bounce, a spam complaint or an unsubscribe for as long as needed to respect it, with no fixed end date; after a temporary bounce, 30 days, removed within a few days after that. Amazon SES keeps its own list of addresses that bounced or complained.
Abuse-prevention counters (hashed IP address, hashed email address): expire after their counting window of at most one day, and are removed automatically within a few days after that.
Technical logs: 12 months.
Backups: our database keeps point-in-time backups for 35 days, so a deleted database record can remain in a backup for up to 35 days before it is gone for good. Photos, selfies and face vectors are not in these backups.
Creator account: until the creator deletes it. Deleting it deletes all the creator's events as described above.

Photos you saved on your own device are yours and outside our control.

7. Who receives data

Recipient	Role and purpose	Data	Where
The creator	Controller of the event	Event photos; the guest list with partly hidden email addresses, choices and match counts; the pseudonymous consent register	Wherever the creator is established
Other guests of the same event	Recipients: see all photos in the General tab, if the creator keeps it on	Event photos, never your selfie or your matches	Wherever they are
Anyone with the event link (open gallery)	Recipients: can browse all photos of the General tab on the website, if the creator opens the gallery	Event photos, never selfies, matches or guest details	Wherever they are
Amazon Web Services (S3, DynamoDB, Lambda and related services)	Subprocessor: our hosting provider	All data in section 3	Stockholm, Sweden (eu-north-1)
Amazon Rekognition (Amazon Web Services)	Subprocessor: face detection, the event's face index and the selfie search	Event photos, face vectors, selfies	Ireland (eu-west-1)
Amazon SES (Amazon Web Services)	Subprocessor: sending event emails	Email address and email content	Stockholm, Sweden (eu-north-1)
Amazon CloudFront (Amazon Web Services)	Subprocessor: delivering photos through signed links that expire	The photos you view, your IP address	The delivery location nearest to you
Vercel Inc.	Subprocessor: hosting our websites	Page requests, your IP address, and your selfie on its way to our storage when you sign up on the website (not stored by Vercel)	Server functions in Stockholm; delivery network worldwide
Google (Firebase Cloud Messaging)	Subprocessor: push notifications in the app	Push token, notification content	Google's infrastructure, also outside the EU
Zoho (Zoho Mail)	Subprocessor: our mailbox for support@ and for replies to photos@	The emails you send us	EU data centre
Apple and Google (sign-in)	Independent controllers: only if you sign in to the app with them	See the Privacy Policy	Under their own policies

The rows marked Subprocessor are the subprocessors that creators authorise in the data processing agreement (Creator Terms, section 5.5).

Participant list. Creators see their guests' email addresses only partly hidden, and the consent export holds a pseudonymous reference instead of your email address. Showing a creator the full addresses (a participant list) would need a consent text that tells you so before you sign up; the current one (ec-2026-09-v1) does not, so no creator can see them in FindMyPhoto.

Outside the EU. Hosted-event data is stored and processed in the EU (Stockholm and Ireland). Some of the providers above are, or belong to, companies outside the EU (Amazon, Google, Apple, Vercel and Zoho). Where one of them can access personal data from outside the EU, that transfer is covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses in its data processing terms. Firebase push notifications can be processed outside the EU, and CloudFront and Vercel serve you from the location nearest to you, which is outside the EU when you are.

We do not sell data, show advertising or use hosted-event data for marketing. We share data with authorities only where the law requires it.

8. Your rights and how to use them

Everyone whose data is processed at a hosted event has the right to access, rectification, erasure and restriction, to object, to data portability where it applies, and to withdraw consent at any time. The creator is the controller, so you can contact the creator directly: they are named on the event page and in our emails, and replying to an event email reaches them if they set a reply-to address. You can also use the options below, or email support@findmyphoto.app. We pass requests about an event on to its creator within 2 business days and help them answer. You get an answer within one month at most; for a complex request that can be extended by two months, and you are told why.

If you joined the event:

In the app: open the event and its menu. Leave event withdraws your consent, deletes your selfie, your matches and your participation, and stops all messages about the event. Delete my selfie for this event stops the search in new photos and keeps the photos already found. Keep me posted switches the ongoing search on or off.
On the website: open the link in your gallery email and go to Your data. You can delete your selfie and matches (this also removes your email address from the event), switch between once and keep me posted, and stop emails about new photos.
By email: write to support@findmyphoto.app from the address you used, with the name or code of the event.
Deleting your FindMyPhoto account removes you from every hosted event linked to your account or its email address (see Delete your account).

What stays after you leave or withdraw: the event photos, which belong to the creator's event, including the face vectors of every face in them (yours too, as for everyone in the photos), and the proof of consent described in section 6. To have a photo of you removed, see the next paragraph.

If you are in the photos but never joined: you can ask for a photo of you to be removed from the event, and object to your face being in the event's face index, without signing up and without sending a selfie. Email support@findmyphoto.app with the event link or code and the photo (a screenshot or a short description is enough), or contact the creator. We forward your request to the creator within 2 business days. We remove the photo from the gallery, from storage and from the face index when the creator instructs us to, or where the law requires it. If the creator does not respond within 7 days, we hide the photo from guests until they do, as creators instruct us in advance (Creator Terms, section 4). We tell you what was done. If the event's gallery is open to anyone with the link, you can also ask the creator, directly or through us, to close it.

If you are not satisfied, you can complain to a supervisory authority (section 12).

9. Children

You must be 16 or older to join a hosted event with a selfie. We do not ask for your age or check it when you join, so do not join if you are younger.
Creators may not host events that are mainly for, or mainly attended by, children under 16, unless they have the consent of the children's parents or guardians for the photos and the face index (Creator Terms, section 4).
Creators keep the open gallery off for events that are mainly for or about children under 16, and hide a child's photo as soon as a parent or guardian asks (Creator Terms, section 4).
Parents and guardians can ask for a child's photos, selfie or participation to be removed, through the creator or at support@findmyphoto.app, with the event link or code. We handle these requests first.

10. Security

Encryption: every connection uses HTTPS, and storage and databases are encrypted at rest.
Signed, time-limited access: photos are delivered only through signed links or cookies that expire (12 hours for a guest's gallery on the website, at most 1 hour for an open gallery, 7 days for the thumbnail in an email, 1 hour for a download file) and that work for a single event only. Gallery links are long random codes that we store only as a hash; a new link replaces the old one. Hidden photos are never listed in a gallery, and their web addresses are random, so they cannot be found by guessing.
One face collection per event: a selfie is searched only in the collection of its own event, and a guest of one event cannot open the photos of another.
Selfies are stored apart from event photos and are never shown to anyone, the creator included.
No liveness check: we check that a selfie shows exactly one clear face, not that it is a live picture of the person who sends it. Someone who has a clear photo of you and the event's link or code could use it to see the photos you are found in. Only ever use a selfie of yourself, and if you think someone used a photo of you, email support@findmyphoto.app with the event link or code.
Access controls: creators can open only their own events; the event interface behind our websites accepts calls only from our own website server, which holds a secret key; the app calls its own interface, which requires the app's sign-in or guest identity; limits per IP address, email address and event stop mass sign-ups and guessing.
Deletion jobs run every day and remove expired events, leftover selfies and old download files.
Data minimisation: no location metadata in stored photos, no IP address or browser details in consent records, and only partly hidden email addresses for creators.

If a personal data breach affects hosted-event data, we inform the creator without undue delay, and the creator or we inform the Autoriteit Persoonsgegevens and the people affected where the law requires it.

11. Changes

The consent text is versioned (currently ec-2026-09-v1). Every version stays published, including old ones; a published version is never edited, and your consent record shows which one you accepted. If we change this addendum or the consent text in a way that matters for you, we tell the guests of events that are still open, by email or in the app, before the change applies to them. Where a change needs new consent, we ask for it again, and until you give it nothing changes for you. The date at the top shows the latest revision.

12. Contact and complaints

FindMyPhoto, the processor for hosted events and the controller for the data named in section 2: S-Industry, trade name of Sem van Embden, Goudse Rijweg 497, 3031 CG Rotterdam, Netherlands; Chamber of Commerce (KvK) number 94484124; support@findmyphoto.app.
The creator, the controller for their event: named on the event page and in the event emails; their own privacy notice gives their contact details.
Complaints: you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or to the supervisory authority where you live, where you work or where the problem happened.