BUILT TO BE READ
BY YOUR LEGAL TEAM.

Biometric data

HOW FACE SEARCH HANDLES PERSONAL DATA.

• •Consent is collected in-product, before camera access, and checked against the event being searched. Every entry point uses an explicit unticked checkbox: the event page’s “Find my photos” button, the registration link, roster invitations, the organiser-wide search and the mobile app. A consent recorded under the older notice wording is kept as history but can no longer start a search. Web consent records are versioned by the wording shown and logged (timestamp, hashed IP, withdrawal state). At events with children under 16, a parent or legal guardian consents for their child, and the photos go only to the parent's verified email.
• •Consent is never a condition of attending an event. Guests who decline can browse public galleries like anyone else.
• •Face embeddings are used only to match a consenting guest's selfie against the photos of the event being searched. They are never used to train models and never shared or sold.
• •No account is needed for deletion. Guests can delete their selfie and face data from their results page, which takes effect immediately, or by requesting it from the event page, confirmed by email.
• •Photos an organiser marks private are excluded from face search itself, not only hidden from results.
• •A performer or speaker added to an event roster is only matched after they accept the invitation and give their own consent; a photo uploaded by the organiser is never used for matching on its own.
• •Retention is fixed and published: selfies within 30 days; guest search templates within 30 days; the photo face index no later than 1 year from upload.

Application security

THE CONTROLS AROUND THE DATA.

• •All traffic is encrypted in transit (TLS). Photo storage is private by default; photos are served through signed, time-limited URLs only.
• •Role-based access for event teams (owner, team member, photographer, VIP) with per-event scoping. Administrative access is limited to named individual accounts, and administrator actions taken through the admin interface (user accounts, password resets, events, data-protection requests, payouts, imports and data ingests) are logged with who, what and when; audit coverage of the CRM is still being extended.
• •A web application firewall and per-endpoint rate limiting protect guest-facing routes, including the scan and search endpoints.
• •Secrets are kept in platform secret stores and referenced by name. Error monitoring runs in an EU region, with access tokens and email addresses removed from reported URLs.
• •Rate-limit counters store a keyed hash of the IP address, never the address itself.
• •Payments are processed by Stripe; card data never touches TIME&SPACE systems.

Sub-processors

WHO ELSE TOUCHES THE DATA, AND WHERE.

These providers process personal data to deliver the service. Biometric data (photos, selfies, face embeddings) is stored and processed in the EU. Consent-gated analytics (Google Analytics, Meta, Microsoft Clarity) are not part of delivering an organiser’s event. Google Analytics and the Meta pixel load in a denied state and send nothing until a visitor grants cookie consent; Microsoft Clarity loads only on public marketing and public profile pages after analytics consent, never on guest pages or inside the dashboard.

Compliance posture

WHAT WE CLAIM, AND WHAT WE DON'T.