Privacy & data

The Platform is operated by individual entrepreneur Oleksandr Vitaliiovych Korniienko under the name IquraPhotos. For anything to do with your personal data, write to [email protected]. We answer it ourselves.

• The event organizer is the controller: they publish the photos, configure the event, and obtain your consent for face search.
• IquraPhotos is the processor: we run the detection and matching on the organizer's documented instructions, and nothing else.
• For operating the website, security logging and talking to organizers, we act as an independent controller.

IquraPhotos is built for the Ukrainian market and offered in Ukraine only: organizers based in Ukraine, events held in Ukraine, attendees who are in Ukraine when they use it.

• We do not offer, market or direct the Service to people outside Ukraine, and we do not take on organizers whose events are held elsewhere.
• Every organizer undertakes, in their agreement with us, that the event is held in Ukraine and that they will not make face search available to attendees in another country.
• If you are outside Ukraine, please do not use face search. You may still be able to browse the gallery where the organizer has made it public.

This is a deliberate limit. Face search processes biometric data, and we would rather do that properly under one legal regime than spread ourselves across several. If we ever extend the Service to another country, we will publish the terms that apply there first.

• Your selfie (biometric, closed events only): one selfie taken with your camera per search; uploading a photo is not possible. It is sent to our biometric matching provider, a specialist third-party face-recognition service, as part of the search request, compared against the event's indexed faces, and then discarded. Neither our servers nor the provider store it. Your own browser keeps a copy of your last search on your device only, until you clear site data.
• Face templates of event photos (biometric, closed events only): a biometric identifier our provider computes for each face it detects, held in a collection isolated to that event. We keep no copy: our database stores only a bounding box, a confidence score and an internal reference. A template cannot be turned back into a photograph, and the provider does not use it, or the images it came from, to train its own models.
• Event photos: uploaded and owned by the organizer. At a closed event they are sent to our provider for face detection within seconds of upload. At an event without biometrics faces are not analysed and nothing is sent to our provider. An exact duplicate is recognised by its file hash and not processed twice. We also keep a perceptual hash, the capture time and the camera serial number from the photo's EXIF data, only to group near-duplicate shots. Photographers who upload are data subjects for this data.
• Expression metadata (not biometric): for each detected face, our provider also returns how that face looks in that one photograph: a label such as "happy" or "calm" with a confidence score, whether it appears to be smiling, whether the eyes look open, and two image-quality measures. We store this as ordinary metadata. It cannot identify or distinguish anyone. It is used for the "Filter by Expression" control in your own search results and for anonymous totals per event, for example how many faces look happy, shown in the organizer's statistics. It is deleted together with the face record it describes.
• Technical data: minimal request and security logs (timestamps, IP address, errors) with no biometric content.
• Usage statistics: counts per event only (searches, page visits, downloads) and an approximate number of unique visitors per day, worked out from a keyed daily hash of your IP address and browser that cannot be reversed.
• Search limit identifier: a random cookie and, for up to 12 hours, the list of photos your last search found. See Cookies and browser storage.

We do not ask for your name, email or an account, and we never link a face template to your identity. The only identifier is the random search limit cookie described below.

Face templates, and the selfie used to query them, are biometric data. Article 7 of the Law of Ukraine "On Personal Data Protection" prohibits processing them as a rule, and permits it only on the grounds that Article lists.

The ground we rely on is your unambiguous consent under Article 7(2)(1). At a closed event the organizer asks for it when you register, before photos are uploaded, because faces in photos are turned into face templates soon after upload, before anyone searches. Before you search, the event page asks you again: the search buttons stay locked until you tick the box, and our server refuses a search without that confirmation. It records each confirmation (the event, the time and the terms version) with no personal data. Anyone who has not agreed can remove their face from search with "Don't index me", even before the event. You may withdraw consent at any time.

The Platform does not record or check the consent of the people shown in photographs. At a closed event it creates a face template for every face in every uploaded photo, and the opt-out removes a face afterwards. Getting consent from those people is the organizer's job.

The organizer, as controller, is responsible for obtaining that consent and for being able to demonstrate it. Biometric data is also processing of "particular risk" under Article 9, so where that obligation applies it is the organizer who notifies the Ukrainian Parliament Commissioner for Human Rights. We set this out in the agreement we conclude with each organizer.

Each event has one of two types, chosen by the organizer when it is created. At a closed event, attendees agree to face search when they register, usually with a checkbox. At an event without biometrics, faces are not analysed at all: there is no face search and only the photographs are stored.

For non-sensitive operational data we rely on our legitimate interest in running and protecting the service (Article 11(1)(6)) and, for organizer accounts, on our contract with the organizer (Article 11(1)(3)).

• You tick the consent box in the event gallery. Without it the server refuses the search.
• Your selfie is sent to our biometric matching provider as part of the search request. It is not stored by us and not added to the provider's collection.
• The provider compares it against the event's indexed face templates and returns the closest matches.
• We show you the matching photos. Your selfie is kept in memory only, for the seconds your search takes (at most five minutes if the queue is busy), and is then discarded. For up to 12 hours our server keeps the list of photos your search found, so a repeated search can show it again.

Under Article 8 of the Law of Ukraine "On Personal Data Protection" you may object to processing and withdraw your consent, and on that basis have your data deleted. You can do it yourself, immediately, without contacting the organizer: open the event and tap "Don't index me".

This works at closed events, including before the event starts. At an event without biometrics there is nothing to opt out of; to remove a photo, contact the organizer.

• Tick the consent box. A face template made from your live selfie is used only to find and remove your face from this event's search.
• Look straight into the camera, then turn your head left and right. Three frames are taken automatically; uploading a photo is not possible. The server checks that every frame shows exactly one face, that the head really turns, and that all three frames show the same person.
• The frames are used for this check only and are never stored, neither on our servers nor in object storage.

Removed: every face in the event's photos that matches yours at 99% similarity or higher, meaning its template in the provider's collection, the identifier that made you findable, and the face metadata record in our database. This is a best-effort match: a face that looks less similar, for example at another angle, may remain. Photos uploaded later are checked the same way when their upload batch is finished, for as long as your exclusion template is kept. Until then such a photo can be searchable for a short time.

Kept: the source photographs, which belong to the organizer (contact them to have a photo removed) and in which everyone else can still find themselves; your exclusion template, used only to keep you out of later photos and deleted with the event, no later than the end of the face-data retention period; a non-biometric tombstone (filename and bounding box only) that stops your face being re-indexed; and a record that an opt-out happened, with no biometric content.

To prevent abuse, one IP address can make at most three requests a day. If that stops you, write to [email protected] and we will remove your face for you. At the end you see only how many photos your own face was removed from.

Event photos are stored on Cloudflare R2 object storage in an EU region and are delivered to viewers through a public content delivery network, at addresses that cannot be guessed. Face detection and matching run on our biometric matching provider's service in Ireland. The application runs on servers in the European Economic Area. Web fonts are served from our own servers, so no font provider receives your data.

This is a cross-border transfer, and Article 29 of the Law of Ukraine No. 2297-VI governs it: personal data may go to a foreign recipient only where that state ensures an adequate level of protection. The Article recognises members of the European Economic Area, and states party to Council of Europe Convention ETS No. 108, as doing so. The photos and face data stay in the European Economic Area. Two technical services run by companies in the United States may also see limited technical data such as your IP address: a bot check (Cloudflare Turnstile) when you search or opt out, and error monitoring (Sentry, with its data in the EU), which receives technical error reports without images or names. Article 29 also recognises states whose capital market regulator signed the IOSCO Multilateral Memorandum of Understanding as providing adequate protection, and the United States is one of them. Ukraine is itself a party to Convention 108, which is why this Policy reads familiarly to anyone used to European data-protection documents.

Hosting abroad does not change who the Service is offered to. It is offered in Ukraine only.

So organizers can see how their gallery is used, we record anonymous aggregate counts per event, per day: searches, landing-page visits and photo downloads.

To approximate unique visitors without identifying you, our server derives a one-way hash from your IP address and user-agent combined with the current day. The day is part of the hash, so it changes every 24 hours and cannot track you over time; the raw values are never stored and the hash cannot be reversed. Download counts are per-photo totals only, never linked to who downloaded them.

The visitor statistics set no cookies and use no identifier that lasts longer than one day. There is no link to your selfie or any biometric data, and the data is never sold and never used for advertising. Our legal basis is our and the organizer's legitimate interest in measuring the service (Article 11(1)(6)); because these statistics use no cookies and are aggregate, we ask for no consent for them.

We set one technical cookie, pf_vid. It holds a random identifier, is valid for 30 days and is used only to count the daily search limit. It is not linked to your name or your face. For up to 12 hours our server keeps the list of photos your last search found, tied to that identifier, so that a repeated or failed search can show it again.

Your browser also stores, on your device only, your language choice, the photos you saved and a copy of your last search, until you clear site data. Our servers never store your selfie.

We are deliberately short-term storage. IquraPhotos is a search tool for the weeks around an event, not a photo archive: the organizer keeps the master copies, and you should download anything you want to keep as soon as you find it.

• Selfie / query photo and its embedding: kept in memory only, for the seconds your search takes (at most five minutes if the queue is busy), then discarded. Not stored on our servers.
• Search result list (photo references only, no image): 30 minutes for an identical repeated search, and up to 12 hours tied to the pf_vid cookie.
• Face templates of event photos: deleted thirty (30) days after they are created, or after the event ends if that is later. On the organizer's request we may set a different date for an event, earlier or later, up to 365 days ahead. The event page shows the date until which face search stays available. From then on, face search finds no one in that event.
• Expression metadata: erased on the same sweep, to the same deadline. It never outlives the face record it describes.
• Event photos: deleted ninety (90) days after upload, or after the event ends if that is later, together with the web-optimised copies, unless the organizer removes them sooner or asks us to keep them longer, up to 365 days.
• Consent confirmations (event, time, terms version, no personal data): kept for the same period as the event's photos and deleted with the event.
• Technical and security logs: request logs are kept for a short rolling period. Abuse protection keeps a daily hash of your IP address for 30 days and short counters for up to 24 hours.
• Anonymous analytics: aggregate counters may be kept for trend reporting; the daily visitor hashes are deleted within ninety (90) days.
• Database backups, if they are made, are kept for no longer than thirty (30) days.
• Organizer accounts: the organizer can delete their account in the console at any time. Its events, photos, face templates, sponsors and users are deleted at once and leave the backups within thirty (30) days. We keep one closure record (the organization's name, its users' names and emails, its events, and who deleted the account and when), together with the processing log and the signed agreements, for three (3) years, the general limitation period under Article 257 of the Civil Code of Ukraine, to answer lawful requests from Ukrainian authorities and to defend legal claims. It holds no photos and no biometric data, and is deleted automatically when the three years end.

These deletions are automatic: a scheduled job runs daily, so nothing depends on someone remembering to do it.

You can search anonymously, browse the gallery without searching, or not use face search at all.

Article 8 of the Law of Ukraine "On Personal Data Protection" gives you the right to know what data about you is held and where it came from, to access it, to require it to be corrected or destroyed, to object to its processing, to withdraw your consent, and to be protected against unlawful processing. A request is answered within thirty (30) calendar days.

You do not have to wait that long for erasure: the self-service flow above removes your face templates on the spot.

Your image is protected separately from your data. Under Article 307 of the Civil Code of Ukraine, consent to being photographed is presumed where the filming is done openly at a conference or other public event, but that presumption covers the photograph only, never the biometric processing of it, which still needs your separate consent. Under Article 308 a photograph of you may generally be publicly displayed only with your consent. These rights are exercised against whoever publishes the photograph (the organizer), not against us.

Because the organizer is the controller, address requests about an event to them first; we will help carry them out. If you are not satisfied, you may complain to the Ukrainian Parliament Commissioner for Human Rights, who supervises data protection in Ukraine, or go to court. You can also write to us directly at [email protected].

Database backups, if they are made, are kept for disaster recovery for a maximum of 30 days, under the same access controls as the live database.

A backup taken before you erased yourself will still contain the face metadata row (bounding box, confidence score), though never the face template, which lives only in the provider's collection. If a backup is ever restored, we are required to re-apply every erasure tombstone before it serves traffic: a documented procedure deletes the resurrected template at the provider and removes the metadata row. Backups expire within 30 days in any case.

Article 24 of the Law of Ukraine No. 2297-VI requires us to protect personal data against unlawful processing and accidental loss. In practice:

• Encryption in transit (HTTPS / TLS).
• Face templates live only in our provider's secured, per-event collection, under its own security certifications, never in our database, which holds non-biometric metadata alone. Templates cannot be reversed into images.
• A SHA-256 hash of each photo lets us skip biometric processing for an exact duplicate.
• Least-privilege access, individually attributable accounts, and strict separation between one organizer's data and another's.
• Organizers manage photos through their CRM but never have access to any face template.
• Database backups, if made, are kept for a maximum of 30 days; erased data is re-removed before any restored backup goes live.

The organizer configures each event: whether selfie search is on; whether the event is public, private or closed; and they may display sponsors under their contract. Sponsors appear as branding only: we share no biometric data or selfie with them, or with anyone, for marketing.

We use sub-processors strictly to run the service: hosting and object storage in the European Economic Area, a specialist third-party service for biometric face-matching, a bot check and error monitoring (see Where data is processed and stored). We never sell personal data and never use it for advertising, and we have applied the provider's AI-services opt-out to our account so it cannot train on the photos, selfies or templates that pass through it either.

We name that provider in the agreement we conclude with each organizer, and will identify it to you on request. Write to [email protected].

Face search is for people aged 16 or older. If you are under 16, please do not use it. Photographs of people under 16 may be uploaded only if the organizer has the consent of their parent or guardian under the Civil Code of Ukraine before upload. Otherwise the organizer keeps them out. People aged 16 and 17 give their own consent. A parent or guardian can use "Don't index me" for a child or write to [email protected].

IquraPhotos is a small, independent service. We may decide to close it for good, if it does not turn out to be commercially viable, or for any other reason. If that happens, face search stops working and the galleries go offline.

• Everything is deleted. Photos, face templates, metadata, logs and organizer accounts are erased on shutdown. Nothing keeps running quietly in the background.
• Nothing is sold or handed over. We will never sell, licence or transfer personal data to another company as part of a shutdown, wind-up or insolvency. If the service were taken over as a going concern, organizers would be told in advance and could object and require deletion instead.
• Organizers get as much warning as we reasonably can give, normally at least thirty (30) days, so they can download their photos. They hold the master copies anyway.
• Download what you want to keep. Photos in "Saved" live in your browser but point at images on our servers: once the galleries are gone, they no longer load.

We would rather say this plainly now than surprise anyone later. It is also why we hold your biometric data for the shortest window we can, and why the photos always remain the organizer's.

We may update this Policy from time to time; the "last updated" date changes accordingly. Material changes affecting attendees are reflected in the event gallery.

IquraPhotos, [email protected]. That is the address for every question about personal data: access, correction, erasure, withdrawal of consent, or anything you would like explained. IquraPhotos is operated by individual entrepreneur Oleksandr Vitaliiovych Korniienko.

For your event's photos, contact your organizer first: they are the controller, and they publish the gallery.