Privacy policy

Last updated: 3 November 2026

Spotted finds the photos of you at an event by comparing one selfie with the photos the event's organiser uploaded. That means we handle faces, which South African law (the Protection of Personal Information Act, POPIA) treats as special personal information: the face in your selfie if you add one, and the faces of everyone who appears in an event's photos, whether or not they use Spotted. This page says what we collect, why, who else touches it, how long we keep it, and how to make us delete it.

Who we are

Spotted is operated by LoveIt Labs in South Africa ("we", "us"). We are the responsible party for the personal information described here. Our information officer can be reached at privacy@loveitlabs.co.za.

For the photos themselves, the event's organiser is the responsible party: they decide which photos to upload and they are responsible for telling the people at their event. We are the responsible party for the face templates we make from those photos and for the selfies people add.

What we collect

• Account details. Your name, your email address, and a hashed version of your password. If you sign in through an emailed link, we store the one-time token for that link until it is used or expires.
• Your selfie and a face template. When you add a selfie we store the image privately and send it to Amazon Web Services' Rekognition service, which returns a numeric template of your face. We keep the template's identifier; the template itself is held by Rekognition in a collection that only our systems can query.
• Your selfie agreement. Before you add a selfie, or when you confirm one from My account, you agree to our selfie wording, and we keep a record of it: the version and the exact statements you were shown, when you agreed, the IP address you agreed from, your name and a hashed copy of your email address. If you agreed and your selfie is later removed (by Delete my selfie, the 180-day cleanup or erasing your account), we add a record that your agreement ended and when; if you used Delete my selfie, it also holds the IP address you deleted it from. If we email you to confirm a selfie you added earlier (see How matching works), we also keep when we sent that email and any reminder, and the date you have to confirm by.
• Matches. For each event you join, a record of which uploaded photos matched your face, so we can show you your album.
• Event photos and the faces in them. Photos are uploaded by the event's organiser, who is responsible for having the right to do so. For each clear face we detect in an uploaded photo (up to 20 in a photo) we make a face template, as described in People in event photos below.
• People an organiser names. If an organiser uses the People feature, the name they give a person, any reference photo of that person they add, a face template made from that photo, and which faces in their event photos were labelled with that name. See People in event photos.
• Consent to be found by face. If an organiser asks for your consent to be found by face in their photos, the email address they gave us for you, when they asked and the IP address they asked from; and, if you answer, whether you agreed or said no, the exact wording you were shown, when you answered and the IP address you answered from. If you withdraw, when you withdrew and, if you used the link, the IP address you withdrew from.
• Organiser upload confirmations. Before an organiser's first upload to an event, they confirm a checklist (see People in event photos). We record which organiser confirmed it, their name and email address, the event and company, the exact wording they confirmed, when, and the IP address they confirmed from.
• What organisers do in Spotted. If you have an organiser account, we keep a log of the actions you take in it, such as signing in, creating and changing events, uploading and deleting photos, answering access requests, inviting and managing your team, and using the People feature: which action, when, in which company, on which event or other item, and the IP address you did it from. When an action concerns another member of your team (for example, changing their role), the log names them by their email address. It does not record the names or email addresses of attendees, of people in your photos, or of someone you invite. Only our staff can see it.
• Requests and orders. Which events you asked to join and the organiser's answer, and, where an event charges for downloads, a record of what you bought.
• Technical data. Server logs with your IP address and browser type, and error reports if something breaks. On the web, we keep your sign-in token in per-tab sessionStorage, not localStorage. Refreshing does not sign you out: storage survives reload and same-tab navigation to and from hosted checkout, while your session remains valid. We do not use advertising cookies or third-party analytics.

Shared devices and browser tabs

On a shared or public device, use Sign out when finished (labelled Logout in the attendee toolbar). Refreshing, closing a tab or closing the browser are not guaranteed substitutes for signing out. An independently opened tab normally starts signed out; a tab opened by another page with an opener can inherit a copy of that page's session. Browser restore or reopen features may also restore a signed-in tab. Our automated browser checks target Chromium; restoration and storage restrictions vary by browser and settings, so do not rely on closing a tab to protect your account.

Why, and on what basis

• Your selfie and face template are processed with your consent, which you give when you add the selfie (or when you confirm a selfie added earlier) by agreeing to our selfie wording first; we keep a record of that agreement. Attendees can withdraw it using Delete my selfie; matching stops when that withdrawal commits. Organisers use the support contact below to request withdrawal or removal; sending a request does not itself stop matching or confirm deletion.
• Your account, matches, requests and orders are processed because they are needed to provide the service you asked for.
• Technical data is processed in our legitimate interest of keeping the service secure and working.
• Face templates from event photos are made so that people who choose to add a selfie can find their photos. We rely on the organiser, who must confirm before uploading that the people at the event were told about face matching and that a parent or guardian consented for any child in the photos.
• Names, reference photos and labels from the People feature are processed so that an organiser can find a person's photos within their own events. Finding a person by their face, including from a reference photo, is done only with that person's own consent, which we ask them for directly; they can withdraw it at any time.
• Consent records are kept as evidence of what the person agreed to or declined, and of the wording they were shown.
• Organiser upload confirmations are kept as evidence of what the organiser confirmed, in our legitimate interest of showing that photos were uploaded on that basis.
• The organiser activity log is kept in our legitimate interest of understanding how organisers use Spotted, so we can improve it, and of looking into problems an organiser reports.

How matching works

For attendee accounts, we use your face template only to find your photos in events you have joined. When you request access yourself, that event's organiser team (authorised members of the company that owns the event) can see your name, email address and selfie when reviewing access. This is not limited to pending requests: the selfie can remain visible on requests that have been approved or denied, while it is on file. CSV or integration invitations alone do not reveal your selfie, and admin view-as sessions hide it. Organisers can see the name and email on their event's access records and which of their photos matched you so they can deliver your album; they never receive your face template. We do not build profiles across events.

If you added your selfie before we kept a record of each agreement, we ask you once, by email, to confirm it. We send it to the email address on your account even if that address was never confirmed as yours; opening the link confirms it. The email gives a date 30 days after the day it was sent, and you have until the end of that day, South African time; the 30 days start only once our email to you has gone. Matching carries on as before until that date, and if you have not answered we also try to send you a reminder about 7 days before it. If you have not confirmed by the end of that day, we pause matching: we stop looking for you in photos until you confirm. Nothing is deleted because of the pause. Your selfie and the photos already found for you stay, and the 180-day cleanup in How long we keep it still applies. You can confirm at any time, even after the date, in My account. Confirming turns matching back on, and if it was paused we look again through the photos of the events you have joined, including those added while it was paused. If you would rather not, use Delete my selfie on the same page instead.

For organiser accounts, the selfie added through My Photos is attached to your organiser account, separate from an attendee access-review selfie. It is used to find you in photos from companies you belong to; matching and access to those photos are scoped to company membership. Adding an organiser selfie does not create an attendee access request or make that selfie available through attendee access review.

People in event photos

If you appear in photos an organiser uploads to Spotted, this section applies to you even if you never use Spotted.

• What we make. For each clear face we detect in an uploaded photo (up to 20 in a photo), we send the photo to Amazon Web Services' Rekognition service, which makes a numeric template of that face and keeps it in a collection only our systems can query. We also keep where the face is in the photo. A template from an event photo is not linked to anyone's Spotted account.
• How it is used. When someone adds a selfie, we compare their face template with the templates from the photos of events they have joined, to find the photos they appear in. Your template from an event photo is part of that comparison, but it is only matched to your account through a selfie, added by you or, for a child, by a parent or guardian.
• Organisers can name people in their own photos. With the People feature, an organiser can give a face in their photos a name; naming a face by hand labels that face. To find that person's other photos by their face, or to add a reference photo of a person, the organiser must first ask the person for their consent. We email the person a link to a page that says which organiser is asking and what face matching does. The link works once and expires two weeks after it is sent. We search for the person's face only if they agree. Then we search for matching faces and label the ones in the organiser's own event photos with that name, so the organiser can find that person's photos, without the person adding a selfie. The matching is automatic, so it can label the wrong face. If the person says no, or does not answer, we do not search for them. If we change what the consent page says, earlier consents stop counting: we do not search for the person again until the organiser asks them again and they agree. Whenever the person says no, whether or not they agreed before, we also remove the labels our matching added and delete any face template made from a reference photo of them; labels the organiser made by hand stay. The names, reference photos and labels are shown only to members of that organiser's company, and to our staff when they view the account to support it. If you agreed, you can withdraw your consent at any time, without an account. To withdraw your consent, use the link in the email we send you when you agree (the same link is shown on the page right after you agree), or email privacy@loveitlabs.co.za, and we will withdraw it for you or send you a new link. When you withdraw, it covers every name you agreed to at that email address: we stop searching for you, remove the labels our matching added and delete any face template made from a reference photo of you. Labels the organiser made by hand stay; to have those removed too, object as described below. We tell the organiser that you withdrew, without a reason, and that organiser cannot ask you again at that email address. To have your name, reference photo and labels removed, email privacy@loveitlabs.co.za as described below. An organiser could add them again later; if that happens, tell us.
• The organiser's part. Before an organiser's first upload to an event, they must confirm that they have the right to upload the photos, that they told the people attending that photos would be taken and matched with face recognition, that none were taken where people could reasonably expect privacy, and that a parent or guardian consented for any child in the photos. We keep a record of that confirmation (see How long we keep it).
• How long. A template from an event photo is kept for as long as that photo is in Spotted. Deleting the photo, or the event, deletes the templates made from it.
• If you object. Email privacy@loveitlabs.co.za with the event and, if you can, the photos you appear in. We answer within 30 days. We exclude those photos from face indexing and remove all face templates and automatic matches made from them, so reprocessing those same photos cannot recreate the templates. This stops face matching for everyone in those photos; the photos themselves remain with the organiser. We retain a hashed photo identifier as minimal proof of the exclusion, including after photo deletion, so recovery cannot undo it. Deletion from our face-service provider may need retries, which we track until resolved. We also remove any name, reference photo and labels an organiser has added for you with the People feature, and pass on any request to remove the photos themselves to the organiser, who owns them.

Who we share it with

We use these providers to run Spotted. Each one processes data only on our instructions.

• Amazon Web Services (Rekognition) — face detection and the face templates used for matching.
• Cloudflare (R2) — storage for photos and selfies. Links to your files are private and expire.
• Neon — the database that holds accounts, matches, requests and orders.
• Resend — sends our emails (sign-in links, password resets, notifications).
• Fly.io — hosts the application.
• Sentry — receives error reports so we can fix faults.

Some of these providers process data outside South Africa. Where they do, we rely on their contractual commitments to protect it to a standard consistent with POPIA. We do not sell personal information, and we do not share it with advertisers.

How long we keep it

• Attendee selfie and face template: you can withdraw consent at any time using Delete my selfie. Automatic cleanup becomes due 180 days after the later of your most recent selfie enrolment and your latest approved event date. If there is no approved event, it uses the enrolment date. The enrolment-only cohort can be held in report-only mode during rollout; records with no usable date are flagged for review rather than automatically deleted. Cleanup depends on maintenance and external deletion succeeding, so this is not a guaranteed deletion deadline. Deleting the selfie removes the links between you and matched photos in the live service.
• Selfie agreements: each record, of an agreement or of its end, is kept for five years from when it was made, including after you delete your selfie or erase your account, because it is the evidence of what you agreed to. Erasing your account removes your name and the link to your account from these records; the rest is kept, including the IP address and the hashed email address. While you still have a selfie, your latest record is kept even after five years. The dates of any email asking you to confirm a selfie are kept with your account, and deleted when you erase it.
• Organiser selfie and face template: the attendee automatic cleanup sweep does not cover organiser enrolment. An organiser selfie remains attached to the organiser account unless replaced or removed through administrative erasure; removing a company membership alone does not erase it. Contact support to discuss withdrawal or removal rather than relying on the attendee retention window. External deletion is queued after an administrative erasure commits and can take longer if cleanup fails.
• Face templates from event photos: kept while the photo they were made from is in Spotted, and deleted with the photo or its event. External deletion from Rekognition is queued and retried, so it can take longer than the live-service change.
• People names, reference photos and labels: kept until the organiser removes them (a label can be removed on its own, and two people can be merged), replaces the reference photo, or their company is deleted. Deleting a photo or an event removes the labels on its photos, but not the name or reference photo.
• Consent to be found by face: each answer, yes or no, is kept for five years from when it was given, together with the IP address the organiser sent the request from (which is recorded with each consent request), including after the person's name, the company or the request is deleted, because it is the evidence of what the person agreed to. After five years a consent no longer counts, and the organiser has to ask again. A withdrawal is kept for five years in the same way, and while it is kept that organiser cannot ask again at that email address. A request is deleted 30 days after its link expires, whether or not it was answered; the answer itself is kept as above.
• Organiser upload confirmations: kept for five years from the confirmation, including after the event, the company or the organiser's account is deleted, because they are the evidence of what the organiser confirmed.
• Organiser activity log: each entry is kept for 12 months and then deleted automatically. If an organiser's account is erased, we remove the link to their account, their email address and the IP address from their entries (and their email address wherever another organiser's entry names them), and keep the rest, without those, until its 12 months are up.
• Account details, matches and requests: attendee records remain until you erase your attendee account; organiser account removal is an administrative process described below.
• Orders: kept for five years after the purchase because tax law requires it, but with your name and account removed once you erase your account.
• Erasure records: when you delete your selfie or your account we keep a small record that the erasure happened and when, without your face data, so we can prove we did it.
• Logs and error reports: rotated automatically, typically within 90 days.
• Backups: our database keeps a rolling one-day recovery window, so something you erase can still sit in a backup for up to a day after it leaves the live service. Backups exist only to recover from a failure, and we do not restore erased data back into the service.

Your rights and how to use them

You can ask to see the personal information we hold about you, correct it, object to how it is used, or have it deleted.

If you are not satisfied with our answer you may complain to the Information Regulator (South Africa) at inforegulator.org.za.

Children

Spotted is for people aged 18 and over. If you are younger, a parent or guardian must add your selfie for you and can use the attendee withdrawal route or organiser support contact above, as appropriate.

Children can appear in event photos. Before uploading, an organiser must confirm that a parent or guardian consented to the photos of any child under 18 being uploaded and matched with face recognition. A parent or guardian can object on a child's behalf as described in People in event photos.

Security

Everything travels over HTTPS. Photos and selfies live in private storage and are served through short-lived links. Passwords are stored as salted hashes. Access to production systems is limited to the people who run the service.

Changes

If we change this policy in a way that matters we will update the date at the top and, where we have your email, tell you before the change takes effect.