Privacy Policy

This Privacy Policy explains how HPK AI Labs ("we", "us", "our") collects, uses, shares, stores and protects personal data when you use SpotMe, our AI-powered event photo delivery service available at https://spotme.hpklabs.ai, including its installable web app (together, the "Service").

HPK AI Labs is a sole proprietorship, registered as a Micro, Small and Medium Enterprise (MSME) under the Udyam registration scheme, with its principal place of business at 22, Ellora Commercial Center, Relief Road, Ahmedabad, Gujarat 380001, India.

This Privacy Policy is published in accordance with the Digital Personal Data Protection Act, 2023 and the rules made under it ("DPDP Act"), Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and Rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules"). Where the EU General Data Protection Regulation or the UK GDPR applies to you, Section 16 also applies.

This Privacy Policy forms part of, and should be read together with, our Photographer Terms of Service, our Guest and Couple Terms of Use and our Face Data Notice.

1. Summary

2. Who this Privacy Policy covers

This Privacy Policy applies to everyone whose personal data we process through the Service:

• Photographers: professional photographers, studios and their authorised staff who create a SpotMe account.
• Couples: the hosts of an event (for example, a wedding couple or their family) who open the event's Master Link.
• Guests: people who open an event's Guest Link to find their photos.
• People in event photos: anyone who appears in photos a photographer uploads, including people who never open SpotMe themselves.
• Visitors: anyone who browses our website.

"Event" means an event (such as a wedding) that a photographer creates on SpotMe. "Event Data" means the photos uploaded to an Event, the data derived from them (including face data), and the personal data of the couple and guests of that Event.

3. Our role and the photographer's role

Photographer account data. For the personal data of photographers (such as your studio name, email address and mobile number), HPK AI Labs decides why and how that data is processed. We are the Data Fiduciary under the DPDP Act (the "controller" under the GDPR).

Event Data. The photographer decides to photograph an Event, to upload the photos to SpotMe, to use face recognition and to share the Event's links. For Event Data, the photographer is the Data Fiduciary (controller), and HPK AI Labs processes Event Data on the photographer's behalf as a Data Processor under our Data Processing Addendum.

Data we collect directly from couples and guests. When you log in to an Event, you give some data (your name, mobile number and, for guests, your selfie) directly to SpotMe. We give you this notice and record your agreement ourselves. Requests to access, correct or delete Event Data go to the photographer, who owns the Event (see Section 13.2). We also act as a Data Fiduciary for the limited purposes we decide ourselves: keeping the Service secure, preventing fraud and abuse, keeping records of consent, and complying with the law.

4. How you give consent

• Photographers agree to this Privacy Policy and the Photographer Terms of Service by ticking the checkbox on the sign-up page before creating an account. When we update these documents, we ask you to accept the new version the next time you open your dashboard.
• Couples and guests agree to this Privacy Policy and the Guest and Couple Terms of Use by continuing past the notice shown on the Event login screen, then verifying their mobile number with a one-time password (OTP). This happens every time you log in.
• Guests consent to their selfie being used to create a face template and match it against the Event's photos when they continue past that notice and then take a selfie. The selfie screen explains this again before you take the photo.

Each time you agree, we record the document versions you accepted, the date and time, your IP address and your browser's user agent, as evidence of your consent.

Your consent is free, specific, informed and unconditional within the meaning of the DPDP Act: we only ask for what is needed to deliver your photos. You can withdraw consent at any time by contacting the photographer (see Section 13). Withdrawing consent does not affect processing that happened before you withdrew it. If you withdraw consent to face matching, we can no longer show you your personalised gallery.

5. Personal data we collect

5.1 Photographers

• Account details: studio name, email address, Indian mobile number, and password. We store your password only as a one-way cryptographic hash (bcrypt); we never see or store it in readable form.
• Verification data: whether your email address and mobile number have been verified, and one-time passwords sent to you (which expire within 5 minutes).
• Branding: your studio logo, your watermark image and your watermark settings (size, position, opacity).
• Event details: Event name, type, dates, description, cover photo, folders, link and download settings.
• Uploaded photos: the original files you upload, including any metadata embedded in them by your camera or editing software (such as camera model, capture date and time and, if your equipment recorded it, GPS location). The web-optimised versions we generate do not contain this embedded metadata.
• Guest and couple activity for your Events, which we show you in your dashboard (see Section 5.3).
• Payment records: the Plan you bought, amounts, payment dates and the payment reference (such as a UPI or bank transaction reference) that you share with us. Payments are made by bank transfer or UPI outside the Service. We do not collect or store your card numbers, bank account passwords, UPI PINs or similar payment credentials.
• Communications: emails and messages you exchange with us, including support requests.
• Consent records: the versions of our documents you accepted, when, and from which IP address and browser.

5.2 Couples (Master Link)

• Your name and Indian mobile number, and whether it has been verified by OTP.
• Photos you mark as favourites and photos you choose to share with all guests ("highlights").
• Records of photos you view and download.
• Consent records, as described in Section 4.

5.3 Guests (Guest Link)

• Your name and Indian mobile number, and whether it has been verified by OTP.
• Your selfie: processed in memory only, to create a face template, and then discarded. We do not store the selfie image.
• Your selfie face template: a list of numbers (a mathematical representation of facial features) computed from your selfie. It cannot be viewed as a photo. See our Face Data Notice.
• Your matches: the people groups your face template matched and the number of matched photos.
• Records of photos you view and download.
• Consent records, as described in Section 4.

The photographer who created the Event can see, and export as a spreadsheet, the name, mobile number, first visit time, number of matched photos and number of downloads of each verified guest of their Event.

5.4 People who appear in event photos

When a photographer uploads photos and runs face detection, we process, for each face found:

• the position of the face in the photo and automated quality scores (for example, blur and head angle);
• a face template (a list of numbers representing facial features);
• which people group the face belongs to (faces that look like the same person are grouped together); and
• for each people group, a small cropped image of a face that is shown as the group's thumbnail.

To avoid matching very young children, our system automatically estimates whether a detected face appears to belong to a child under about 5 years old. If so, that face is excluded from matching. This estimate is used only for that decision and is not stored. We do not estimate or record anyone's gender, ethnicity, emotions or any other attribute.

5.5 People who message us on WhatsApp

If you message SpotMe's WhatsApp number for sales or support, we receive your mobile number, your WhatsApp profile name and the messages, photos and files you send. If your number matches a SpotMe photographer account, we link the conversation to that account so we can help you faster. WhatsApp itself is operated by Meta under its own terms.

5.6 Technical and usage data (everyone)

• IP address, browser user agent, device type, date and time of requests, and the pages and API endpoints used.
• Security and error logs, and counters used to limit repeated attempts (for example, OTP requests).
• Data stored in your browser's local storage to keep you logged in (see our Cookie and Local Storage Notice).

We do not use advertising identifiers, third-party analytics, tracking pixels or social media trackers.

6. Sensitive personal data

Face templates are biometric data, which the SPDI Rules treat as sensitive personal data or information, and which the GDPR treats as a special category of personal data when used to identify a person. Passwords and payment-related information are also sensitive personal data under the SPDI Rules. We collect this data only for the purposes in Section 7, with your consent where the law requires it, and we protect it as described in Section 12.

7. Why we use personal data

We use personal data only for these purposes. If we ever want to use personal data for a new purpose, we will tell you and, where required, ask for your consent first.

What we never do:

• We never sell, rent or trade personal data.
• We never use photos, face data, selfies or any other data to train, test or improve AI or machine-learning models.
• We never match a face across different Events, or across different photographers' accounts, and we never build a general database of identified faces.
• We never use personal data for advertising or send marketing messages.

8. Who can see your data

The photographer decides who receives the Master Link and the Guest Link and can turn either link off at any time. Anyone who has a Guest Link and a verifiable Indian mobile number can log in, but they will only see photos that match their own face and the couple's shared highlights.

9. Disclosures

We may also disclose personal data:

• to comply with the law: in response to a court order, a lawful request from a government agency authorised by law (including under Section 69 of the IT Act and Rule 3(1)(j) of the IT Rules), or directions of CERT-In;
• to protect rights and safety: to investigate fraud, security incidents or violations of our terms, or to protect the rights, property or safety of our users, the public or HPK AI Labs;
• in a business transfer: to a successor if the SpotMe business is transferred, including to a company or limited liability partnership formed to carry on the business of HPK AI Labs. The successor will be bound by this Privacy Policy for the data transferred; and
• with your consent, in any other case.

10. Transfers outside India

We store Event Data and account data primarily in India. Some of our service providers (see Section 9) may process limited personal data outside India. Where we transfer personal data outside India, we do so in accordance with Section 16 of the DPDP Act, and we will not transfer personal data to any country or territory that the Government of India has restricted by notification. Where the GDPR or UK GDPR applies, see Section 16.

11. How long we keep data

Account deletion. When a photographer deletes their account from the dashboard, their access is revoked immediately. Their Events, photos, face data, and guest and couple records are kept for 7 days (so that an accidental deletion can be reversed on request) and are then permanently deleted. As required by Rule 3(1)(h) of the IT Rules, we keep the photographer's registration information (studio name, email address and mobile number) and consent records for 180 days after the account is deleted, and then delete them.

Retention required by law. We may keep specific data for longer where the law requires it, or where it is needed to establish, exercise or defend a legal claim, or to comply with an order of a court or authority. When the retention period ends, we delete the data or make it anonymous.

12. How we protect data

We follow reasonable security practices and procedures appropriate to the nature of the data, as required by Section 43A of the IT Act and the SPDI Rules, including:

• encryption of all data in transit using HTTPS (TLS);
• encryption of stored photos and backups at rest (AES-256), in storage that blocks all public access;
• photos delivered only through signed links that expire after a short time;
• passwords stored only as bcrypt hashes;
• one-time passwords that expire after 5 minutes and allow a limited number of attempts, together with rate limits on login and OTP requests;
• a database that is not reachable from the internet, and separate, least-privilege access credentials for storage and computing;
• access to personal data limited to the proprietor and any person authorised by the proprietor who needs it and is bound by confidentiality; and
• monitoring and alerting for failures and unusual activity.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will inform affected people and the Data Protection Board of India as the DPDP Act requires, report cyber security incidents to CERT-In as required by law, and inform affected photographers without undue delay.

13. Your rights

13.1 Rights under the DPDP Act

You have the right to:

• access information about your personal data: a summary of the personal data we process and the processing activities, and the identities of other Data Fiduciaries and Data Processors with whom it has been shared, with a description of what was shared;
• correct, complete, update and erase your personal data;
• withdraw your consent at any time, as easily as you gave it;
• grievance redressal (see Section 18);
• nominate another person to exercise your rights if you die or become unable to exercise them; and
• complain to the Data Protection Board of India, after first using our grievance redressal process.

You also have duties under Section 15 of the DPDP Act, including not impersonating another person, not suppressing material information and not filing false or frivolous grievances or complaints.

13.2 How to exercise your rights

• Couples and guests cannot delete Event Data themselves. The photographer who created the Event owns its photos and controls its data, so send access, correction and deletion requests about an Event, including withdrawal of your consent to face matching, to that photographer. The photographer can act on them in their dashboard, for example by deleting photos or the Event, and is required by our Terms of Service to act on them within 15 days.
• People who appear in event photos should also contact the photographer who uploaded them.
• Photographers can update their account details in the dashboard (Profile) and delete their account from the same page.
• If you cannot reach the photographer, or they do not act within 15 days, or your request is about data we control ourselves (see Section 3), email spotme@hpklabs.ai with the subject "Privacy request". Please include the Event link (if you have it), the mobile number or email address you used, and what you would like us to do.

To protect you, we may verify your identity before acting on a request, for example by sending an OTP to the mobile number or email address on record. We will respond within 30 days. Where a request concerns Event Data, we will forward it to the photographer and follow it up, and where the law requires it we will act on it ourselves and inform the photographer. See our Data Deletion Instructions for step-by-step guidance.

14. Children

SpotMe is not intended for anyone under 18 years of age. Under-18s may not create an account or log in to an Event themselves.

A parent or lawful guardian may log in to an Event and take a selfie of their child to find that child's photos. By doing so, the parent or guardian confirms that they are the child's parent or lawful guardian and gives consent on the child's behalf. We do not track or monitor the behaviour of children, target advertising at children, or process children's data in any way likely to harm their well-being.

Weddings and other events often include children. Photographers are responsible for making sure their client has told guests that event photos will be processed on SpotMe, and for obtaining any consent required from parents or guardians. As explained in Section 5.4, faces that appear to belong to children under about 5 years old are automatically excluded from matching. As a result, very young children may not be found by face matching; ask the couple or the photographer for those photos.

If you believe a child has used the Service without the consent of a parent or guardian, contact us and we will delete the child's data.

15. Automated processing

Face matching is automated: our system decides which photos to show a guest by comparing face templates. It does not produce legal effects or similarly significant effects on you, and it is not used to make decisions about you beyond showing you photos. If you think your matches are wrong (for example, you see photos of someone else, or photos of you are missing), retake your selfie or contact the photographer or us.

16. Additional information for people in the European Economic Area and the United Kingdom

SpotMe is designed for users in India. If the GDPR or UK GDPR applies to our processing of your personal data:

• Controller: HPK AI Labs is the controller of photographer account data and of the data described in Section 3 that we decide ourselves. For Event Data, the photographer is the controller and we are the processor.
• Legal bases: we rely on performance of a contract (Article 6(1)(b)) for photographer accounts; consent (Article 6(1)(a)) for couples and guests; explicit consent (Article 9(2)(a)) for processing face templates to match a guest's selfie; legal obligation (Article 6(1)(c)) for tax, accounting and legal compliance; and legitimate interests (Article 6(1)(f)) for security, fraud prevention and keeping consent records, where those interests are not overridden by your rights.
• Your rights: you have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time. You can exercise them as described in Section 13.2.
• International transfers: your data is transferred to and stored in India. Where required, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK Addendum), which we will enter into on request.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The version and effective date at the top of this page show when it was last changed. If we make a material change, we will notify photographers by email or in the dashboard and ask them to accept the new version, and couples and guests will be asked to accept it the next time they log in. We will not reduce your rights under this Privacy Policy without your consent where the law requires it.

18. Contact and Grievance Officer

If you have a question, request or complaint about this Privacy Policy or your personal data, contact our Grievance Officer:

Umang Gajjar, Grievance Officer, HPK AI Labs
22, Ellora Commercial Center, Relief Road, Ahmedabad, Gujarat 380001, India
Email: spotme@hpklabs.ai

We will acknowledge your grievance within 24 hours and resolve it within 15 days of receiving it. See our Grievance Redressal page for details, including how to escalate.