Retention and deletion policy

What we keep, for how long, and why

• Selfie sent for the search

  Discarded within the same request

  Never written to disk or to a bucket. It becomes a vector in memory and is discarded; only the SHA-256 hash remains, for search auditing.

  Legal basis: Specific and prominent consent (LGPD art. 11, I; BIPA §15(b); CUBI §503.001)

• Face measurement (facial embedding)

  30 days

  Every vector is created with an expiration date recorded on it. A daily routine deletes what has expired and records the deletion in the audit trail.

  Legal basis: Specific consent for sensitive personal data (LGPD art. 11, I)

• Minimum age for face search (13 years)

  Nothing is collected

  Below 13 years old we do not run a face search and do not collect anything for it: no selfie, no email, no guardian address. The parental-verification method the law requires at that age (credit card, ID document, video call) is not offered here, and without it the processing cannot happen. Searching by bib number, which does not use a face, remains available.

  Legal basis: Refusal to process — COPPA 16 CFR §312.5(b) requires enhanced parental verification below this age

• Legal guardian authorization (ages 13 to 17)

  365 days

  Anyone who declares being under 18 provides the guardian's email. The request goes to that address and nothing is processed until the guardian confirms: no face measurement is generated, no search is unlocked, and no notification is sent. Opening the link decides nothing — confirmation only happens with a click on the button on the page, so that an automatic email scanner cannot authorize on the guardian's behalf. After authorizing, a second email arrives with what was authorized and a revocation link. If no one decides before the link expires, the whole request is destroyed, with an audit-trail record — including the minor's address and the guardian's.

  Legal basis: Specific consent given by the legal guardian (BIPA §15(b); LGPD art. 14, §1)

• Consent record

  365 days

  We keep the date, time, IP address, browser, and the version of the text accepted. Revoking deletes the biometric data immediately; this record remains because it is what proves what was accepted and that it was revoked.

  Legal basis: Compliance with a legal obligation — it is the proof of the consent itself

• Search audit (selfie hash, threshold, number of results)

  30 days

  Deleted together with the biometric data, and immediately upon revocation.

  Legal basis: Legitimate interest in security and accountability

• Event photos

  365 days

  Fast access for the first 30 days; afterward they move to cold storage. At the end of the total retention period, the action is "archiving".

  Legal basis: Performance of the contract with the photographer / event organizer

How we destroy it

Deletion is automatic and auditable. Every face measurement is created with an expiration date recorded alongside it and is removed by a daily routine once that date is reached. Every deletion generates an audit entry recording what was deleted, when, and why — it does not depend on anyone remembering to delete it, and we can prove it happened.

Event photos follow the same principle: fast access at first, cold storage afterward, and at the end of the total retention period, the action is archiving.

What we never do

• We do not keep your selfie. It becomes a numeric measurement in memory and is discarded within the same request.
• We do not use your face for advertising or to train models.
• We do not sell, rent, or share biometric data.
• We do not compare you against photos from other events.

Your rights

• Revoke at any time, without justification and without losing the photos you already bought.
• Confirm, access, and correct the data we hold about you.
• Request deletion — revocation already deletes the biometric data immediately; the consent record is kept only as proof that you authorized it and that you revoked it.
• Not use your face. Searching by bib number finds the same photos and is always available.
• Authorize on behalf of a minor under 18. The request goes to the legal guardian's email, and nothing is processed before their confirmation. They can revoke it through the same channel, at any time.

Revoke now

After revoking, face search stops working for you — bib number search keeps working normally.

Data Protection Officer

Data Protection Officer — FBPrimeShot
Questions and exercising your rights: privacidade@fbprimeshot.com
Deletion request via another channel: exclusao@fbprimeshot.com

We respond within 15 days. If you live in Illinois, Texas, Colorado, or Oregon, your specific rights under local law also apply.

Laws we follow

• BIPA — 740 ILCS 14 (Illinois)
• CUBI — Tex. Bus. & Com. Code §503.001 (Texas)
• Colorado Privacy Act / Oregon Consumer Privacy Act (biometric data = sensitive data, opt-in)
• LGPD — Law 13.709/2018, art. 11 (Brazil)