Biometric Data Notice (BIPA / CUBI / WA)

1. What biometric identifier we collect

When you upload a selfie, our software derives a temporary mathematical faceprint — a numeric vector representing the relative geometry of facial features. This is a "biometric identifier" as defined under BIPA and similar laws. We do not collect a photograph as a biometric identifier; the photograph itself is also discarded immediately (see §3).

2. Purpose and lawful basis

The faceprint is created for the sole purpose of identifying photographs of you taken at the specific event you are attending. No other use is made of it. Your written consent (the checkbox you check before uploading) is the lawful basis for this processing under BIPA §15(b) and equivalent statutes.

3. Retention schedule

Your selfie and selfie faceprint exist only in server memory for the match. When matching ends they are destroyed. They are not written to any database, log, or object store.

Event-photo embeddings (numeric templates of faces already in the organizer's photographs) are stored only for that event so a consented selfie can find matches. They are automatically deleted 30 days after the event date, or 90 days after upload if the event has no date. The organizer can delete a photo (and its embeddings) sooner. This is the written retention and destruction schedule required by BIPA §15(a).

4. No sale or disclosure

CrowdTagg does not, and will not, sell, lease, trade, profit from, or otherwise disclose your biometric identifier or biometric information to any third party. The faceprint is used exclusively by CrowdTagg's own matching system and is immediately destroyed.

5. No third-party sharing

Biometric data is processed entirely within CrowdTagg's own infrastructure. It is not transmitted to, shared with, or accessible by the event organizer, sponsors, or any other party.

6. Your rights

You have the right to:

• Refuse consent. You may decline to upload a selfie. You will not be able to use the face-matching feature, but you may still access event photos by other means if the organizer provides them.
• Request confirmation. Because the faceprint is deleted immediately, we cannot provide access to data that no longer exists. We can confirm our policy and deletion practice.
• Lodge a complaint. Illinois residents may file a complaint with the Illinois Attorney General. Other residents may contact their relevant state authority.

Contact us at privacy@crowdtagg.com with any biometric-related inquiry.

7. Written policy availability

Pursuant to BIPA §15(a), CrowdTagg makes this written policy publicly available. It is accessible at crowdtagg.com/legal/biometric and linked from the selfie upload screen at every event.

8. Contact

CrowdTagg Inc. · Privacy & Compliance · privacy@crowdtagg.com