Privacy Policy

1. Information we collect

• Account data: email, name, username, password (hashed), profile picture, bio and links you choose to add.
• Photos and metadata: images you upload as a photographer (EXIF, GPS if present, captions, album metadata) and the previews and AI indexes generated from them.
• Selfies and biometric data: when you opt in to facial search, we generate a temporary face vector to find your photos.
• Purchases and payments: orders, items, totals, country, billing details and payment metadata. Card numbers are processed directly by Stripe; we never store them.
• Usage and device data: pages visited, clicks, search queries, IP address, browser, language, time zone, and approximate geolocation.
• Cookies and similar technologies: necessary, preference, and basic analytics cookies (see Cookies section).

2. How we use your information

• Run the platform: serve photos, complete purchases, pay photographers, and offer customer support.
• Power AI features: facial recognition, bib number detection, and photo tagging so buyers can find their photos.
• Improve the service: analyse aggregated usage to fix bugs and prioritise features.
• Security and fraud prevention: detect abuse, protect accounts, and meet legal obligations.
• Communication: send operational notices and, with your consent, news or marketing you can opt out of.

We don't sell your data and we don't share it with advertisers.

3. Facial recognition and biometric data

• Photographers' photos are processed by AWS Rekognition to extract faces and assist with album indexing.
• When you search by selfie we generate a temporary face vector, compare it with the album's index, and delete it once the search is complete.
• If you opt in to save your selfie for faster searches, we keep the vector only for as long as your saved selfie remains active. You can delete it any time from your settings.

Use of facial recognition is optional. You can search by event, date, or bib number without it.

4. Sharing with third parties

• Service providers we depend on: Stripe (payments), AWS (hosting and AI), Cloudflare (delivery and security), email providers, analytics, and customer support tools.
• Photographers and buyers: when you make a purchase the photographer can see what was sold and the order metadata needed to complete the transaction; they don't receive your card details.
• Legal and safety: when required by law, court order, or to protect users from fraud, abuse, or imminent harm.
• Business transfers: if ZebraSnap participates in a merger, sale, or restructuring, your data may be transferred to the new entity under the same terms.

5. Cookies and tracking

We use strictly necessary cookies to keep your session active and remember your preferences (language, theme). For aggregated usage analytics we use Google Analytics. In the EU/EEA, UK, and Switzerland, analytics cookies stay off until you accept them in our banner; you can change your choice anytime from the "Cookies" link in the footer. We don't use third-party advertising cookies. Disabling necessary cookies may break parts of the platform.

6. Security

• Data in transit is encrypted with TLS; at rest we use server-side encryption on managed AWS storage.
• Passwords are stored hashed with modern algorithms; we never see them in plain text.
• Access to data is limited to authorised personnel and audited periodically.

No system is bulletproof. If you spot a vulnerability, please write to us so we can fix it fast.

7. Your rights

• Access: see what we hold about you from your account settings.
• Correct: update your profile and order details directly from settings.
• Delete: close your account to start the deletion process for personal data we don't need to keep for legal reasons.
• Export: request a portable copy of your data.
• Object or restrict: oppose specific uses (such as marketing) or limit certain processing.
• Withdraw consent: opt out of biometric features and marketing at any time.

Most actions are available directly from your account settings. For anything else, write to us.

8. Data retention

• Account data: kept while your account is active. After deletion we erase or anonymise it within a reasonable period, except for data we must keep for legal, accounting, or fraud-prevention reasons.
• Photos: kept while the album is published. Deleted albums are removed from active storage promptly; backups follow a documented rotation.
• Biometric data: face vectors are deleted right after a search unless you opt in to save your selfie. Saved selfies and their vectors are deleted when you remove them or close your account.
• Order and tax records: retained for the period required by tax and accounting law.

9. Children

ZebraSnap is not directed at people under 18. We don't knowingly collect data from minors. If you believe a minor has created an account or that we hold data about a minor, write to us and we'll delete it.

10. International transfers

ZebraSnap operates from Mexico and uses providers based in the United States and the European Union. When we transfer data internationally we rely on standard contractual safeguards or equivalent mechanisms recognised by applicable privacy laws.

11. Changes to this policy

We may update this policy when we launch new features, regulations change, or providers shift. We'll notify material changes by email or in-product before they take effect. The date at the top of the page reflects the latest version.