Privacy Policy

2. Information We Collect

When you use SnapStream, we collect the following personal information:

• WhatsApp phone number — used as your unique identifier on the platform.
• Name — as provided by your WhatsApp profile.
• Selfie photograph — the photo you send us for facial recognition enrolment.
• Facial recognition vectors — mathematical representations derived from your selfie. These are numerical data points, not raw biometric images.
• Photo match records — records of Event photographs in which your face was identified.

3. Purpose of Processing

We process your personal information for the sole purpose of:

• Matching your face in Event photographs.
• Notifying you when photos of you are found.
• Providing access to your personal photo gallery.

We do not process your information for marketing, profiling, automated decision-making, or any purpose unrelated to photo matching and delivery.

4. Lawful Basis for Processing

We process your personal information on the basis of your explicit, voluntary consent, as provided for in Section 11 of POPIA.

You provide consent by sending agree via WhatsApp. You may withdraw consent at any time by sending delete, which will immediately remove all your personal information from our systems.

5. Facial Recognition Technology

We use Amazon Web Services (AWS) Rekognition to analyse your selfie and create a mathematical face vector — a set of numerical values that represent the unique geometry of your face.

• Only the mathematical face vector is stored in the recognition system — not the raw image data.
• The face vector is used solely to compare your face against Event photographs.
• Face vectors cannot be reverse-engineered to reconstruct your facial image.

6. Data Storage & Security

• Your data is stored on Amazon Web Services (AWS) infrastructure in the Africa (Cape Town) region.
• Facial recognition processing is performed in the EU (Ireland) region, as required by the AWS Rekognition service.
• All data transfers occur over encrypted (TLS) connections.
• Access to your data is restricted to authorised system processes. No human reviews your selfie or facial recognition data as part of normal operations.

7. Data Retention

• All personal data — including facial recognition vectors, selfie images, and photo match records — is automatically deleted 30 days after the Event concludes.
• Photo gallery access links expire after 7 days.
• You may request immediate deletion at any time by sending delete via WhatsApp.

Upon deletion — whether automatic or by request — the following are permanently removed: your account record, selfie image, facial recognition vector, and all photo match records.

8. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

• Right to access — request confirmation of what personal information we hold about you.
• Right to correction — request correction of inaccurate personal information.
• Right to deletion — send delete via WhatsApp at any time for immediate removal of all your data.
• Right to object — you may object to processing by deleting your account.
• Right to lodge a complaint — you may lodge a complaint with the Information Regulator of South Africa.

9. Data Sharing & Third-Party Processors

We do not sell, rent, or trade your personal information. We share data only with the following third-party processors, solely for the purpose of operating the Service:

• Amazon Web Services (AWS) — data storage and facial recognition processing.
• Twilio — WhatsApp message delivery.

These processors are subject to their own privacy and security policies and may process data in jurisdictions outside South Africa.

10. Children's Privacy

SnapStream is intended for persons aged 18 or older. If you are under 18, you must obtain parental or guardian consent before using this Service. We do not knowingly collect personal information from children under 18 without such consent.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Updated versions will be posted at this URL. Continued use of the Service after changes constitutes acceptance of the revised policy.

12. Contact