Privacy Policy

What we collect

• Your account. An email address, and your name. If you signed up before email-only sign-in, a phone number may also be on your account.
• Sign-in with Google. If you use it, Google gives us your name, email address and profile picture. We use the email address to identify your account. We do not receive your Google password and we cannot see anything else in your Google account.
• Photos you import from Google Drive. If you choose to import photographs from Drive, you are asked for read-only access to it. We use that access for one thing: to read the files you picked and copy them into your event. We do not browse the rest of your Drive, we do not keep the access longer than the import needs it, and you can revoke it at any time from your Google account.
• Face data — only if you enrol. The selfie you take, and a numeric representation of your face computed from it.
• Photographs. The images photographers upload to their events, and the information stored with them, such as the filename and the date and camera settings recorded by the camera.
• Studio details, if you use FotoLama as a photographer: business name, logo, contact details and social links. These are shown publicly on the galleries you brand.
• Your settings, such as whether face matching is on and your preferred download quality.

What we use it for

• Signing you in — we email a one-time code to the address on your account.
• Showing you the events you are a member of, and the photographs in them.
• Matching you to photographs in those events, if you have enrolled a selfie.
• Emailing you about your account and the events you are part of.

Face data

• Enrolling is optional, and enrolling is your consent. Nothing is computed from your face until you take a selfie yourself.
• One per account, not one per event. The same enrolment is what finds you in every event you join or host, which is why you are never asked for a second selfie.
• It is matched only against photographs in events you are actually a member of.
• Your matched set is private to you. Other people in the event do not see which photographs matched you.
• You can switch it off. Turning off “Find me” in Account Settings stops the matching. Deleting your account deletes the selfie and the face data with it, and the matches stop everywhere at once.
• We do not sell face data, and we do not use it for advertising.
• The law calls this biometric information and treats it as sensitive personal data. So do we: it is collected only because you chose to enrol, it is used only to find you in events you belong to, and withdrawing your consent stops it the moment you ask.

Who else handles it

We use a small number of services to run FotoLama. Each is given only what it needs to do its job, and may use it only to do that job for us:

• Cloudflare — stores and delivers the photographs.
• Zoho (ZeptoMail) — sends your sign-in code and account emails.
• Razorpay — takes payment for plans. They receive your name, email address and the payment details you enter. We never see or store your card number.
• Modal — provides the computing power that turns an enrolled selfie into the numeric representation described above. It receives that image and returns the numbers; it is not used for anything else.
• Google — sign-in, the optional Drive import, and push notifications to Android phones (Firebase Cloud Messaging).
• Apple — push notifications to iPhones.

We do not sell personal data. We do not share it for advertising. We do not use your photographs or your face data to train anyone's models.

Information we receive from Google APIs is handled in line with the Google API Services User Data Policy, including its Limited Use requirements.

Where it is kept

FotoLama is run from India, and that is where the database lives. Some of the services above process data outside India — Cloudflare stores photographs on its global network, Modal and Zoho operate from outside the country, and a push notification goes through Google or Apple. Where data leaves India it is under a contract that holds the service to the same handling described here.

How long we keep it

• Your account — until you delete it.
• Your selfie and face data — until you turn matching off or delete your account, whichever comes first. Both take effect immediately.
• Photographs — until the person who uploaded them deletes them, or the event is deleted. A photograph you move to the trash is removed for good after 30 days.
• Photographs over a plan's storage limit — if an account ends up holding more than its plan allows, after a downgrade or a plan that lapsed, everything stays fully available for 30 days. After that the excess is deleted, whole galleries at a time. This is set out in our Terms of Use.
• Payment records — kept as long as tax and accounting law requires.
• Messages you send support — kept so we can answer you and see the history if you write again.

Cookies and tracking

We set no advertising cookies and use no third-party analytics on this site or in the app. When you sign in, your browser stores a session token so that you stay signed in. The full list is on our Cookie Policy page.

Deleting your account

Delete your account at any time from Account Settings, or write to hello@fotolama.com. That removes your account, your selfie and your face data.

Photographs uploaded by a photographer stay with the event. They belong to the photographer or host who uploaded them, so deleting your own account does not remove them from that event’s album. To have a photograph of you removed, ask the photographer or host who runs the event.

Your rights

The data on your account is yours, and you can act on it:

• See it — your account, your events and your matched photographs are all visible in the app. Ask us if you want it in a file instead.
• Correct it — your name and contact details are editable in Account Settings; write to us for anything you cannot reach.
• Withdraw consent — turning off “Find me” withdraws your consent to face matching, and the matching stops. It does not require deleting your account.
• Delete it — see above.
• Complain — to our Grievance Officer, whose details are on the contact page. We answer a complaint about your data within 30 days.

We ask you to write from the email address on the account, because that is how we know the request is yours.

If something goes wrong

If personal data on FotoLama is exposed or lost in a way that could affect you, we will tell you and the Data Protection Board of India, as the Digital Personal Data Protection Act 2023 requires — what happened, what was affected, and what we are doing about it.

Children

FotoLama accounts are for people aged 18 or over. We do not knowingly create an account for anyone younger. If we learn that an account belongs to someone under 18, we delete it and the data on it. If you believe a child's photograph or face data is on FotoLama, write to us and we will act on it.

Changes

If this policy changes, the updated version appears on this page with a new date above.

Who is responsible, and how to reach us

FotoLama is operated by Swaggers Club LLP (LLPIN ACC-7320, GSTIN 29AFCFS1172E1Z3), E1602, Sattva East Crest, #41 Old Madras Road, Bandapura, Karnataka 560049, India. We decide how the data described here is handled, and we are answerable for it.

Questions about this policy, or about the data on your account: hello@fotolama.com. To escalate a complaint, our Grievance Officer is on the contact page.

See also our Terms of Use, Cookie Policy and contact details.