GDPR Compliance

The General Data Protection Regulation (EU) 2016/679 ("GDPR") gives individuals in the European Economic Area ("EEA"), and equivalent laws give individuals in the United Kingdom and Switzerland, strong rights over their personal data.

Kamero AI Solutions Private Limited ("Kamero", "we", "us") is committed to processing personal data lawfully, fairly, and transparently. This page explains, in plain language, how we apply GDPR principles to the data we handle across our mobile app, white-label apps, website, and desktop application (together, the "Services").

We are committed to your privacy: we collect only what we need, anonymize biometric data, delete data promptly when it is no longer needed, and give you straightforward ways to access or delete your information.

This GDPR notice supplements our Privacy Policy. Where this notice and the Privacy Policy differ for EEA, UK, or Swiss users, this notice prevails.

For most personal data processed through the Services, Kamero acts as the data controller. When event organizers and photographers use Kamero to manage their own event galleries and guest lists, they may act as controllers and Kamero acts as their data processor.

• Controller: Kamero AI Solutions Private Limited, registered in India
• General privacy contact: support@kamero.ai
• Data protection queries: dpo@kamero.ai

If you are in the EEA, UK, or Switzerland and wish to exercise your rights, contact us using the details above. We respond to verified requests within 30 days.

We only process personal data when we have a valid legal basis under Article 6 of the GDPR. Depending on the activity, we rely on:

• Consent — for optional features such as marketing emails, cookies that are not strictly necessary, and the "Find My Photo" face recognition feature. You can withdraw consent at any time.

• Performance of a contract — to create and secure your account, deliver galleries, process photo purchases, and provide customer support.

• Legitimate interests — to keep the Services secure, prevent fraud and abuse, and improve functionality, balanced against your rights and freedoms.

• Legal obligation — to comply with tax, accounting, and other laws that apply to us.

For special category data such as biometric face vectors used for recognition, we rely on your explicit consent under Article 9(2)(a). You may withdraw this consent at any time by deleting your selfie in the app.

We collect only the data needed to provide the Services:

• Account & contact data — first name, last name, email address, and phone number (required for verification and security). Country and city are optional.

• Event & gallery data — event names, dates, locations, and guest lists provided by organizers.

• Biometric data (face vectors) — mathematical feature vectors derived from a selfie you voluntarily upload for the "Find My Photo" feature. We do not store your selfie image on our servers; only anonymized vectors keyed to randomly generated UUIDs and randomly generated photo IDs are processed, never linked to your identity.

• Transaction data — records of photo purchases and orders (payment card details are handled by our payment processors, not stored by us).

• Technical & usage data — IP address, device and browser type, timestamps, and interaction logs collected automatically.

We apply data minimization: we do not collect more than we need, and optional fields remain optional.

We use personal data strictly for the purposes for which it was collected, including:

• Creating, verifying, and securing your account (including OTP verification via email/SMS)
• Delivering event galleries and enabling authorized photo sharing
• Matching your face vector against event photos to power "Find My Photo"
• Processing photo purchases and maintaining order history
• Sending service, security, and account communications
• Sending marketing communications only with your consent
• Detecting, preventing, and investigating fraud and abuse
• Meeting legal and regulatory obligations

We do not sell your personal data, and we do not use your biometric data to train generative AI models.

Kamero is based in India, and personal data may be processed in India and other countries that may not offer the same level of data protection as your home jurisdiction.

Where your photos and media live: Uploaded photos, albums, and related media are stored in Cloudflare R2 object storage, which may be replicated across multiple regions (cross-region buckets) on Cloudflare's global cloud infrastructure for reliability, durability, and fast delivery. Cloudflare acts as our storage sub-processor and applies encryption at rest and in transit.

When we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, together with additional technical and organizational measures where needed.

Anonymized face vectors used for recognition are processed and stored on the secure infrastructure of our sub-processor SightRadar under a written Data Processing Agreement, and only to perform face matching on our behalf.

We keep personal data only for as long as necessary for the purpose it was collected, or as required by law:

• Photos, albums & event media — retained for the validity period of the event or the associated subscription. When you delete an event, album, or individual photo from our platform, the corresponding files are immediately deleted from our cloud storage (Cloudflare R2), across all regions where they were replicated. When an event or subscription expires, the data is retained for a short 7-day grace period to allow renewal, after which it is permanently deleted from our cloud storage across all regions.

• Face vector data — retained only for the validity of the user's event or subscription. When the event/album/photo is deleted or the user deletes their selfie, the associated face vectors are deleted immediately; when the subscription or event expires, the associated face vectors are permanently deleted after the same 7-day grace period. Face vectors are never linked to a person's name or identity (see the Security section). Once deleted, they cannot be restored.

• Account data — retained while your account is active. On account deletion, or on a verified deletion request sent to support, we delete your personal data within two working days, except where limited retention is legally required.

• OTP codes — automatically deleted after verification or expiry (typically within 10 minutes).

• Incomplete registrations — deleted automatically after 24 hours.

• Transaction records — retained only as long as required by applicable tax and accounting laws.

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in transit over HTTPS/TLS for all data exchanged with the Services, and encryption at rest for photos and media stored in Cloudflare R2
• Hashed passwords — never stored in plain text — and token-based (JWT) authentication
• Fully anonymized biometric storage — for the "Find My Photo" feature we store only the resulting mathematical face vectors. These vectors are keyed to randomly generated UUIDs and randomly generated photo IDs, and are never linked to any person's name, email, phone number, or any other identity. There is no way to reverse a stored vector back to an individual's identity.
• Access controls limiting personal data to authorized personnel on a need-to-know basis
• Sub-processor due diligence and Data Processing Agreements with vendors such as SightRadar and Cloudflare
• Regular security reviews of systems and infrastructure

No method of transmission or storage is completely secure, but we are committed to protecting your privacy and continually work to detect and respond to threats.

We share personal data only with trusted service providers who process it on our behalf under contractual confidentiality and security obligations. Key sub-processors include:

• SightRadar — provides the large-scale face recognition API behind "Find My Photo". It processes only anonymized face vectors, strictly as our sub-processor, and is contractually prohibited from selling, leasing, trading, independently using, or training generative AI on that data.

• Cloudflare — provides R2 object storage (including cross-region replication) and content delivery for photos, albums, and media, with encryption at rest and in transit.

• Payment processors — handle photo purchase transactions securely; card details are processed by them, not stored by us.

• Communication providers — deliver transactional email and SMS (including OTPs).

We disclose personal data to authorities only where legally required, or to protect the rights and safety of Kamero, our users, or others.

If you are in the EEA, UK, or Switzerland, you have the rights listed above. To exercise any of them:

1. Email support@kamero.ai or dpo@kamero.ai from the address associated with your account, or use the in-app account settings.
2. Tell us which right you wish to exercise. We may ask you to verify your identity to protect your data.
3. We action verified requests promptly — deletion requests are completed within two working days. More complex requests may take longer, in which case we will let you know.

Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

Self-service deletion: Many rights can be actioned directly in the app. You can delete your account yourself from account settings, and you can delete your uploaded selfie (and its face vector) at any time. You can also request account deletion by writing to support@kamero.ai, and we will delete your data within two working days. We are committed to your privacy and to giving you real control over your data.

We hope to resolve any concern you have about how we handle your personal data. Please contact us first at dpo@kamero.ai so we can help.

If you are not satisfied, you have the right to lodge a complaint with your local data protection supervisory authority:

• EEA — the supervisory authority in your country of residence, work, or where the alleged infringement took place.
• United Kingdom — the Information Commissioner's Office (ICO).
• Switzerland — the Federal Data Protection and Information Commissioner (FDPIC).

We maintain procedures to detect, report, and investigate personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, where feasible, and will inform affected individuals without undue delay when the breach is likely to result in a high risk.

We may update this GDPR notice from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice. We encourage you to review this page periodically.