BUILT TO BE READ
BY YOUR LEGAL TEAM.

Biometric data

HOW FACE SEARCH HANDLES PERSONAL DATA.

• •Consent is collected in-product, before camera access, and checked against the event being searched. Every entry point uses an explicit unticked checkbox: the event page’s “Find my photos” button, the registration link, roster invitations, the organiser-wide search and the mobile app. A consent recorded under the older notice wording is kept as history but can no longer start a search. Web consent records are versioned by the wording shown and logged (timestamp, hashed IP, withdrawal state).
• •Consent is never a condition of attending an event. Guests who decline can browse public galleries like anyone else.
• •Face embeddings are used only to match a consenting guest's selfie against the photos of the event being searched. They are never used to train models and never shared or sold.
• •No account is needed for deletion. Guests can delete their selfie and face data from their results page, which takes effect immediately, or by requesting it from the event page, confirmed by email.
• •Photos an organiser marks private are excluded from face search itself, not only hidden from results.
• •A performer or speaker added to an event roster is only matched after they accept the invitation and give their own consent; a photo uploaded by the organiser is never used for matching on its own.
• •Retention is fixed and published: selfies within 30 days; guest search templates within 30 days; the photo face index no later than 1 year from upload.

Application security

THE CONTROLS AROUND THE DATA.

• •All traffic is encrypted in transit (TLS). Photo storage is private by default; photos are served through signed, time-limited URLs only.
• •Role-based access for event teams (owner, team member, photographer, VIP) with per-event scoping. Administrative access is limited to the founder, and key administrative actions are logged.
• •A web application firewall and per-endpoint rate limiting protect guest-facing routes, including the scan and search endpoints.
• •Secrets are kept in platform secret stores and referenced by name. Error monitoring runs in an EU region, with access tokens and email addresses removed from reported URLs.
• •Rate-limit counters store a keyed hash of the IP address, never the address itself.
• •Payments are processed by Stripe; card data never touches TIME&SPACE systems.

Sub-processors

WHO ELSE TOUCHES THE DATA, AND WHERE.

These providers process personal data to deliver the service. Biometric data (photos, selfies, face embeddings) is stored and processed in the EU. Consent-gated analytics (Google Analytics, Meta, Microsoft Clarity) run only after a visitor’s explicit cookie consent and are not part of delivering an organiser’s event. Microsoft Clarity never runs on guest pages: event pages, the organiser-wide face search, or a guest’s matched photos.

Compliance posture

WHAT WE CLAIM, AND WHAT WE DON'T.