Effective date: 1 August 2025 · Last updated: 1 August 2025
CrowdTagg helps you find photos of yourself at events. This Privacy Policy explains what personal information we collect, how we use it, and your rights. Questions? Email privacy@crowdtagg.com.
CrowdTagg Inc. ("CrowdTagg", "we", "our") operates the CrowdTagg platform. For attendees, CrowdTagg is the controller of contact details you give us and of the temporary selfie faceprint used to find your photos. Event organizers are the controller of the event photographs they upload. CrowdTagg processes those photographs, including face embeddings derived from them, as their processor under our DPA.
Selfie image. You upload a photo of yourself to power face-matching. The image is processed in memory. A mathematical faceprint is derived, then both the selfie and that faceprint are deleted as soon as matching finishes. We do not write the selfie to disk.
Event-photo embeddings. When an organizer uploads event photographs, we detect faces in those photos and store a numeric embedding per detected face, scoped to that event, so a later selfie can find matches. These embeddings are not your selfie. They are deleted 30 days after the event date (or 90 days after upload if the event has no date), or sooner if the organizer deletes the photo or you ask us to erase data that identifies you.
Contact details. Email address and/or phone number you voluntarily provide to unlock your matched photos. These are shared with the event organizer and its named sponsor only for the purposes described at the time of collection (photo delivery, event updates). You can unsubscribe at any time via the link in any message.
Matched photos. The event photos in which you appear are retained so you can access, download, or purchase them. They are associated with your contact record and the event.
Usage data. Standard web-server logs (IP address, browser, pages visited, timestamps) retained for up to 90 days for security and analytics. We do not use third-party advertising trackers.
Your selfie faceprint is created only to find your photos at one event. It lives in server memory for the match (usually under a few seconds) and is then destroyed. It is not written to any database.
Event-photo embeddings are stored for that event so matching can run. Purpose: return the right photos to a guest who consents. We do not sell, lease, trade, or use them for advertising. See the Biometric Data Notice.
We do not use your photos or contact information for advertising targeting, and we do not sell personal data.
Event organizer & sponsor. The organizer who created the event receives your contact information (name, email, phone as provided) and your consent status. Their privacy practices are their own responsibility.
Service providers (sub-processors). We use Stripe for payments, Cloudflare R2 for photo storage, and AWS for server infrastructure. Each is bound by data-processing agreements.
Legal requirements. We may disclose information if required by law, court order, or to protect rights and safety.
Business transfers. If CrowdTagg is acquired or merges, personal data may transfer subject to the same protections.
We do not sell personal information to third parties.
Selfie images: never stored. Selfie faceprints: deleted in memory right after matching. Event-photo embeddings: 30 days after the event date, or 90 days after upload if there is no date. Contact details and match records: 12 months after the event unless you ask us to delete sooner. Server logs: 90 days.
Depending on where you live, you may have the right to: access your personal data; correct inaccurate data; delete your data ("right to be forgotten"); restrict or object to processing; data portability; withdraw consent at any time (withdrawal does not affect lawfulness of prior processing); and lodge a complaint with your supervisory authority (EU/EEA residents: your national data protection authority; California residents: California Attorney General).
To exercise any right, email privacy@crowdtagg.com. We respond within 30 days (or 45 days where law permits extension).
We do not sell or share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information (including biometric data) beyond the purpose disclosed at collection. California residents may submit a verifiable request to know, delete, or correct their information by emailing privacy@crowdtagg.com. We will not discriminate against you for exercising your rights.
CrowdTagg is not directed to individuals under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided data, contact us immediately at privacy@crowdtagg.com.
We use TLS encryption in transit, encrypted storage, access controls, and regular security reviews. No system is perfectly secure; if you believe your data has been compromised, contact privacy@crowdtagg.com immediately.
We will post material changes here and update the effective date. For significant changes, we will notify you by email if you have an account with us.
CrowdTagg Inc. · privacy@crowdtagg.com · For EU/EEA inquiries: dpo@crowdtagg.com