Your clients’ faces, handled with care
When a guest hands their face to software to find their photos, they are trusting you, and you are trusting us. Here is exactly what happens to every photo and selfie, in plain words.
At a glance
- Where photos live
- AWS data centres in Mumbai, India
- Face recognition
- Our own models, trained in-house, on our own servers
- Third-party AI providers
- None. No photo or selfie leaves our systems for AI processing
- Guest selfies
- Never stored. Turned into a face template and discarded
- Links to photos
- Signed, private and expire after one hour
- Storage buckets
- Private, with all public access blocked
What happens to a selfie
The whole journey takes about a second, and nothing about the selfie is kept afterwards.
The guest opens your link, verifies their mobile number with a one-time code, and agrees to a short consent notice that explains what the selfie is used for.
They take a selfie in the browser. It travels to our servers in India over an encrypted connection.
Our model turns the face into a face template: a list of numbers that describes the face. It is not a photo and can’t be turned back into one.
The template is compared only with faces found in that one event. Matching photos are shown in the guest’s gallery.
The selfie image is discarded. The guest’s match is remembered for that event so they don’t need another selfie next time.
Want the technical version? Read how our face recognition works.
Who can see what
| Who | What they can see |
|---|---|
| You and your team | Every event, photo, folder and guest lead in your studio account |
| The couple | Their whole event through their private master link, after verifying their mobile number |
| A guest | Only the photos they appear in, plus photos the couple chose to share with everyone |
| Someone with a forwarded link | Nothing until they verify their own number and selfie, and then only their own photos |
| SpotMe staff | Only what is needed to support you, when you ask us to, and logged |
How we run the platform
Encrypted in transit and at rest
Every connection to SpotMe uses HTTPS with HSTS. Photos and originals are encrypted at rest in storage.
Verified access, not passwords for guests
Couples and guests verify a one-time code sent on WhatsApp, with SMS as a backup. Codes expire in five minutes and are rate-limited.
Strong photographer accounts
Photographer sign-in needs a password and an email code. Passwords are hashed with bcrypt and sessions can be revoked.
No guessable links
Events and photos use random identifiers. Master links carry an unguessable token, and you can switch off any link at any time.
Locked-down servers
Databases are never exposed to the internet. Servers get automatic security updates and are watched around the clock for errors and outages.
Daily backups
Account and event data is backed up every day. Originals sit in storage designed for eleven nines of durability.
Security questions
Do you sell or share face data?
No. Face data is used only to match a guest to their photos within one event. It is never sold, shared, or used to train our models.
Can someone search for another person’s face?
No. A guest can only search with a live selfie of themselves, and only within the event they were invited to. There is no way to upload someone else’s photo to search.
What happens when I delete an event?
The event’s photos, originals, face data and guest galleries are deleted, and the storage returns to your plan. Guest leads you already exported stay in your own files.
Is SpotMe compliant with India’s DPDP Act?
We built SpotMe around the Digital Personal Data Protection Act, 2023: clear notice and consent at the selfie step, purpose-limited use of face data, Indian data residency and deletion on request. Our Face Data Notice and Privacy Policy explain the details.
How do I report a security issue?
Email spotme@hpklabs.ai with the subject “Security”. A founder reads every report, and we reply within two working days.
Your first wedding, set up with you, free.
Send us one event. Our team sets it up with you on a call, and you see it working on your own wedding before you pay anything.
- No card needed
- Every feature included
- 10 GB free forever