Privacy Policy

1. Introduction & Roles of the Parties

At InstaSnapic (“we”, “our”, or “us”), we believe facial data is highly personal and sensitive. This Privacy Policy explains how we collect, process, safeguard, and automatically delete biometric and personal data in strict compliance with India's Digital Personal Data Protection Act, 2023 (“DPDP Act”)and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

2. Categories of Data We Collect

3. Strict Purpose Specification (No Function Creep)

In accordance with Section 4 of the DPDP Act, personal and biometric data is collected solely and exclusively for the following specified purpose:

• Scanning the isolated photo collection of the specific event to identify and deliver photographs containing the guest's face.
• Maintaining a statutory audit trail to demonstrate compliance with consent requirements under law.

What We Never Do: We do NOT sell, rent, monetize, or disclose facial data to advertisers. We do NOT perform cross-event surveillance. We do NOT use your photographs or face embeddings to train public machine learning or foundation AI models.

4. Anti-Fraud Liveness Verification & Anti-Spoofing Architecture

To prevent identity theft, unauthorized gallery viewing, and malicious spoofing using another person's printed photograph or mobile screen, InstaSnapic enforces a strict Client-Side Liveness & Anti-Spoofing Architecture:

• Mandatory Real-Time Front Camera Stream: Photo matching requires an active live video stream directly from the user's device front camera. File system image pickers (<input type="file">) are disabled to eliminate static photo impersonation.
• Ephemeral In-Memory Landmark Processing: Biometric facial landmark analysis (eye aspect ratio and smile mouth curvature) executes entirely client-side in ephemeral browser memory. Raw video streams are never recorded, streamed, or stored on platform servers.
• Interactive 60-Second Verification Window: Users are prompted to align their face and smile naturally within a 60-second session window. If verification does not complete within 60 seconds, the camera stream immediately terminates and prompts a friendly retry.
• Single-Frame Cryptographic Match: Only upon authentic human presence confirmation is a single cropped still image converted to vector embeddings for the isolated event search, automatically scheduled for permanent cloud deletion within 24 hours.

5. Automated Data Purge & Lifecycle Schedule

6. Cloud Security & Indian Data Residency

• Indian Data Residency: All photographs, selfies, and biometric face collections are hosted exclusively on Amazon Web Services (AWS) in the Asia Pacific (Mumbai, ap-south-1) region.
• Encryption in Transit & at Rest: All web traffic is enforced over TLS 1.3 with strong cipher suites. S3 storage objects are encrypted using AES-256 server-side encryption.
• Zero Public Buckets: Cloud storage buckets are private. Files are accessed only via short-lived, cryptographically signed pre-signed URLs (300 seconds for uploads, 3600 seconds for viewing).

7. Your Rights as a Data Principal (DPDP Act, 2023)

Under Chapter III of the Digital Personal Data Protection Act, 2023, you possess the following rights:

• Right to Access Information: Request a summary of personal data being processed.
• Right to Correction & Erasure: Request the immediate deletion of photos or selfie logs. Because selfies auto-delete in 24 hours, most data is already purged automatically.
• Right of Grievance Redressal: Direct recourse to our Grievance Redressal Officer.
• Right to Nominate: Nominate an individual to exercise rights on your behalf in the event of death or incapacity.

8. Protection of Children's Personal Data (Section 9 DPDP Act)

InstaSnapic does not knowingly target or profile minors under the age of 18. For events where children appear in family photographs (e.g., weddings, birthdays), the Studio and event hosts are required to obtain lawful parental or legal guardian consent prior to capturing and uploading images.

9. Grievance Redressal Officer (Statutory Contact)

If you have questions, concerns, or wish to exercise your rights under the DPDP Act, contact our designated Grievance Officer: