Face data policy

1. What face data is made

• Face templates: numerical representations of the faces detected in a gallery's photos, held in that gallery's face-search index (Amazon Rekognition) or, for galleries on one of our own face models, as face vectors.
• The face archive: small face crops kept privately so a gallery's face search can be rebuilt without re-reading the original photos. It is never shown to anyone or served publicly.
• Selfies used to search are not face data we keep: a selfie is compared with that gallery's face templates and then discarded. It is not stored and no face template is made from it.

Finding people in photos (whole bodies, without identifying anyone) and reading bib numbers and text do not use face data. Bib/number search is not affected by this policy.

2. Where it is processed

• In Photohawk's cloud on Amazon Web Services in the European Union (Ireland, eu-west-1), after a photo is uploaded.
• Each gallery has its own face-search index (an Amazon Rekognition collection). A selfie is only ever searched against the gallery it was taken for.
• To save time, Photohawk Studio's upload apps may find faces on the computer or phone doing the upload and send small face crops with the photo. Face templates are always made in our cloud.

3. What it is used for, and never used for

Face data is used only so that people can find their own photos in that gallery with a selfie.

It is never sold, never used for advertising, never used to identify anyone outside the gallery, and never mixed with or matched against the Photohawk app's face data.

4. How long it is kept, and when it is deleted

From 1 November 2026 face data is permanently deleted at the earliest of:

• the period the gallery's administrator chose: 30, 90 or 180 days or 12 months after the photo was uploaded (photo by photo, even if the gallery stays online). The default is No expiry: nothing is deleted by age;
• when the gallery or the photo is deleted;
• 30 days after face search is switched off for the gallery (cancelled if the administrator switches it back on within those 30 days);
• within 24 hours of the administrator's workspace being closed;
• 30 days after a person asks us to delete their face data or withdraws their consent;
• 45 days after our yearly review finds it is no longer necessary.

Archiving a gallery doesn't delete its face data: an archived gallery stays online and keeps its face search.

Until 31 October 2026, face data is deleted when a gallery ages out (within about 60 days) and when a gallery is deleted. Face templates are not backed up, so a deletion is final; our database backups hold only references to faces (never templates) and are purged within 35 days. Photos, sales, downloads and bib search are not affected.

The full retention schedule and how deletion works: Biometric data retention policy

5. Legal basis

Photos. Photos in a gallery are shared so participants can find and buy their own photos. They are processed because that is necessary for the gallery's purpose, and kept only as long as is proportionate to it (see §4).

Face search. Face data is biometric data and gets extra protection:

• When it is used: only so that people can find their own photos in that gallery. It is never used to identify anyone for any other purpose.
• How long it is kept: as long as the administrator chooses (§4). It is deleted when that period ends, when face search is switched off or the gallery is deleted, or sooner on request.
• The person searching is asked for their explicit consent before their selfie is used. The selfie is never stored.
• The administrator decides whether face search is appropriate for their event and permitted where it takes place. Where local law requires the consent of the people photographed, the administrator must have it, for example through event registration. Where they don't, they should use bib and time search instead, which uses no face data.
• Anyone can ask for their face data to be deleted at any time, and it is deleted within 30 days (§8).

For people in a gallery, the gallery's administrator is the controller; Photohawk processes face data on their behalf under our data processing agreement.

6. Illinois and other US states

This policy and the biometric data retention policy are our public written retention schedule. The administrator chooses how long face data is kept (§4). Administrators whose events are subject to the Illinois Biometric Information Privacy Act (BIPA: when the purpose is satisfied or within 3 years of the person's last interaction), the Texas CUBI, the Colorado Privacy Act or Washington's RCW 19.375 should choose a period within those deadlines. No law prescribes a single period.

7. Who processes it

Amazon Web Services (Amazon Rekognition and storage), EU (Ireland) region, as our sub-processor, only on our instructions. We don't disclose face data to anyone else unless the law requires it.

8. Requests and contact

• In the gallery: open selfie search and choose “Make a request”. It goes to the gallery's administrator and to Photohawk.
• By email: support@photohawk.com, telling us which gallery or event it concerns. We act on the request within 30 days.
• CLOUDCONCUR LTD (company no. 13399913), trading as Photohawk, 23 Caldey Gardens, Ingleby Barwick, Stockton-on-Tees, TS17 5HW, United Kingdom. Email: support@photohawk.com.

1. What face data is made

• On your phone: where the faces are in each photo or video, which faces belong to the same person, the names and corrections you add, birthdays and relationships, and each face's estimated age range (sent back by the cloud, which doesn't keep it). These stay only on your phone.
• In the cloud: small face cut-outs (never whole photos or videos), which are kept, encrypted, and the face templates (a list of numbers for each face), groups and similarity scores our cloud service makes from them.

Recognising pets and the kind of scene in your photos doesn't use face data.

2. Where it is processed

• On your phone: faces are found on the phone, and face data is kept in the app's private storage, excluded from phone backups.
• In the cloud: face cut-outs go to your own face collection at Amazon Rekognition (Amazon Web Services, EU (Ireland) region), which holds only your faces. Since the consent of 6 November 2026 the cut-outs are kept there, each encrypted with a key for your account alone (protected by AWS Key Management Service), with no download links, so your faces can be matched again without your phone sending them again and we can look into a problem when we support you. Only Photohawk's owner and support staff the owner names can see them, only for that, and every support action is recorded. Until you agree to that wording, cut-outs are deleted as soon as they are matched.
• We never receive your photos or videos for this (apart from photos you share, which are encrypted so we can't see them, and prints you order), and never the names, birthdays or relationships you add.

3. What it is used for, and never used for

Face data is used only to group your photos and videos by the people in them, to let you search by person, to help you choose which photos to share, to keep people who look like children from being offered as people to send photos to, to match your faces again from the kept cut-outs (for example when grouping improves or after a fault), and to look into problems with your face grouping when we support you.

It is never sold, never used for advertising, profiling or identity checks, never used to find out who anyone is, never matched across different users, never used to train models, and never mixed with or matched against Photohawk Studio's face data. It is never part of a share.

4. How long it is kept, and when it is deleted

On your phone, face data is kept until you tap “Delete all face data”, delete your account, delete the app, or don't use Photohawk for 3 years. A photo's face data goes when the photo leaves your phone.

In the cloud, face data, the kept cut-outs included, is deleted within 24 hours when you tap “Delete all face data”, when you delete your Photohawk account, and after 3 years without using Photohawk, or when you ask us to (within 30 days). It isn't deleted when a plan or free trial ends.

Cloud deletion removes your whole face collection and the kept cut-outs (the key that opens them goes at once). Deleting face data never deletes photos or videos.

5. Legal basis and consent

We rely on your explicit consent (GDPR Art. 9(2)(a), and the equivalent in other laws), asked for twice and separately before the app scans: for grouping faces (the box starts unticked), then for matching them in the cloud. Both are needed to use the app; if you don't agree, no face data is made and you can delete your account. You can withdraw at any time by tapping “Delete all face data”: everything is deleted, and the app asks again before it makes any more. If the wording changes, the app asks again.

6. Illinois

The Photohawk app isn't offered to people who tell it they live in Illinois (the app asks; it doesn't use GPS or your IP address). Our service refuses cloud matching for Illinois too, and if you change where you live to Illinois, existing face data is deleted on the phone and in the cloud.

7. Who processes it

Amazon Web Services (Amazon Rekognition), EU (Ireland) region, as our processor, only on our instructions. Face data that stays on your phone is never sent to anyone.

8. Requests and contact

• In the app: Sharing and privacy → “Delete all face data”, or Delete account.
• By email: support@photohawk.com, to access or delete your face data in the cloud.
• CLOUDCONCUR LTD (company no. 13399913), trading as Photohawk, 23 Caldey Gardens, Ingleby Barwick, Stockton-on-Tees, TS17 5HW, United Kingdom. Email: support@photohawk.com.