Privacy Policy

Last updated: May 24, 2026

1. Introduction

InItPic ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our website, mobile application, and related services.

For any of the requests below (data export, account deletion, biometric consent withdrawal, copy of your consent record, or any other privacy question), email us at hello@initpic.com from the address on your account. We respond within 24 hours.

2. Information We Collect

We collect the following types of information:

• Account Information: Name, email address, and password when you create an account.
• Facial Data: Selfie photos used for AI-powered facial matching. These are processed securely using AWS Rekognition and are used solely for matching you with event photos.
• Photos: Event photos uploaded by photographers, which are stored securely on AWS S3.
• Payment Information: Payment details processed securely through Stripe. We do not store your full credit card information on our servers.
• Usage Data: Information about how you interact with our platform, including device information, IP addresses, and browsing patterns.

3. How We Use Your Information

We use your information to:

• Provide facial recognition matching services to help you find your event photos.
• Process purchases and deliver purchased photos.
• Facilitate payments between customers and photographers.
• Improve and personalize your experience on our platform.
• Communicate with you about your account, purchases, and platform updates.
• Ensure platform security and prevent fraud.

4. Biometric Information

This section is our biometric privacy policy and applies in addition to any rights you have under the Illinois Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code §503.001), the Washington Biometric Privacy Act (RCW 19.375), and similar state laws.

What we collect

When you use selfie-based photo matching, we collect a biometric identifier derived from your selfie, specifically, a mathematical scan of your facial geometry (a "face template"). We also store the selfie image itself.

Specific purpose

The face template and selfie are used solely to match you with photos uploaded by event photographers on the InItPic platform. We do not use this data for advertising, to train AI or machine-learning models, for identity verification outside of photo matching, or for any other purpose.

How we process it

• Face templates are stored in AWS Rekognition (us-east-1 region) acting as our service provider under a contractual data-processing agreement.
• Selfie images are stored on AWS S3 (us-east-1) with restricted access controls and encryption at rest.
• Real-time match requests send your selfie image to AWS Rekognition for comparison. AWS does not retain the image after the comparison completes.

Length of term and retention schedule

We retain your biometric identifier and selfie image while your InItPic account is active. We will permanently destroy your face template and selfie image when the earliest of the following occurs:

• You delete your account or your selfie via the app's Profile → Privacy & AI screen.
• You request deletion (see the note at the top of this page, or use our data request page).
• You have not interacted with InItPic in any way (no login, no selfie upload, no purchase, no message) for three (3) years.
• The original purpose for collection (matching you with your event photos) is satisfied and complete.

Disclosure to third parties

We do not sell, lease, trade, or otherwise profit from your biometric identifier or biometric information. We disclose your face data only to AWS as our processor (described above) or as required by a valid court order, subpoena, warrant, or other binding legal process.

Your rights

You may withdraw consent for biometric processing at any time from Profile → Privacy & AI in the InItPic app. Revocation takes effect immediately and applies to all future processing. You may also request deletion of your account and all biometric data using the contact note at the top of this page.

Consent record

When you affirmatively consent to biometric processing in the app, we record a tamper-evident, append-only consent record including the timestamp, your IP address, your user-agent string, and the version of this policy that was in effect at the time. You may request a copy of your consent record using the contact note at the top of this page.

5. Data Sharing

We do not sell your personal information. We may share data with:

• Service Providers: AWS (storage and facial recognition), Stripe (payments), and other essential service providers.
• Photographers: Limited information necessary to fulfill photo purchases (e.g., confirmation of purchase).
• Legal Requirements: When required by law, court order, or to protect our rights.

6. Data Security

We implement industry-standard security measures including encryption in transit and at rest, secure authentication, and regular security audits. Photos are stored on AWS S3 with restricted access controls.

7. Your Rights

You have the right to:

• Access and download your personal data. Request your data.
• Request correction of inaccurate data.
• Request deletion of your account and associated data (see the contact note at the top of this page).
• Opt out of marketing communications.
• Withdraw consent for facial recognition processing.

Account Deletion

To delete your InItPic account, email us at hello@initpic.com from the address linked to your account. We will process your request within 24 hours. When your account is deleted, all personal data including your selfie photos, facial data, match history, favorites, and messages are permanently deleted. Order and transaction records may be retained for up to 7 years for legal and tax compliance purposes.

8. Cookies

We use essential cookies for authentication and session management. We do not use third-party tracking cookies for advertising purposes.

9. Children's Privacy

Our platform is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on our platform with a new "Last updated" date.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at hello@initpic.com.