Biometric Information & Privacy Policy

1. Scope and Core Commitment

NovusGrid Event Photos provides AI-powered facial discovery services for event photography studios, educational institutions, corporations, and guests. We treat facial geometry and biometric data with the highest standard of technical privacy and statutory compliance (including the Illinois Biometric Information Privacy Act (BIPA), California Consumer Privacy Act (CCPA), and General Data Protection Regulation (GDPR)).

2. How Facial Search Operates (Ephemeral Selfies)

When a guest utilizes our search service:

• In-Memory Processing: The guest selfie uploaded or captured via webcam is streamed directly into volatile system memory (RAM). The selfie image file is never persisted to physical disk, database storage, or external cloud storage.
• Vector Generation: A mathematical facial vector (512-dimensional numerical embedding) is calculated strictly to measure similarity against photographs indexed in the specific event gallery.
• Immediate Discard: As soon as the similarity search query completes (typically under 800 milliseconds), the temporary embedding and the raw selfie bytes are immediately released and purged from server memory.

3. Event Gallery Face Embeddings

Photographs uploaded by the authorized event organizer are processed by background neural workers to identify face locations and compute vector representations. These vectors are strictly bound to the specific event_id. Under no circumstances are face embeddings aggregated across separate events, organizations, or public discovery databases.

4. Data Retention & Automatic Purging

Search session records containing guest-provided contact details (name, phone, email) and search timestamp logs are retained solely for organizer audit verification. These records are subject to an automated retention schedule (default 30 days, or configured down to immediate purge). When an event is archived or permanently deleted by the organizer, all associated photo metadata, access logs, and face embeddings are permanently destroyed.

5. Security & Signed Photo Access

All photographic results returned to guests are guarded behind cryptographically signed, short-lived HMAC-SHA256 tokens (15-minute validity). Unauthenticated third parties cannot traverse or scrape event galleries.

6. Contact & Data Controller Notice

For questions regarding event photo data, rights of erasure, or data subject access requests, guests may contact their designated event photographer directly or email NovusGrid Technologies at privacy@novusgrid.com.