Privacy Policy

Welcome to EventBit Studio("EventBit", "we", "our", or "us"). Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website, applications, and services available at https://eventbit.io.

By using EventBit Studio, you agree to the collection and use of your information in accordance with this Privacy Policy. For India-specific rights under the Digital Personal Data Protection Act, 2023 (DPDP Act), see the section "Your Rights Under India's DPDP Act" below and our DPDP Compliance page.

Information We Collect

We may collect the following information:

• Name, email address and phone number
• Account login information (OTP and Google Sign-In)
• Billing and subscription information
• Event galleries, photographs, albums and uploaded files
• Selfies uploaded for AI Face Search
• Face embeddings and cropped face images generated by our AI system
• Device information, browser type, IP address and usage information
• Cookies and analytics data
• Consent records (type, notice version, timestamp, and request context)

How We Use Your Information

We use your information to:

• Provide and maintain our services
• Authenticate users and secure accounts
• Process subscriptions and payments
• Deliver event galleries and AI Face Search
• Improve our products and services
• Respond to support requests
• Send invoices, service notifications, newsletters and product updates
• Prevent fraud, abuse and unauthorized access
• Comply with applicable legal obligations

AI Face Recognition & Face Search

This section describes how EventBit Studio processes face-related personal data for AI Face Recognition and AI Face Search, in line with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable rules. Face-related data is treated as sensitive personal data and is processed only for the purposes stated below.

What we collect

When you use Face Search or register for a gallery with selfie matching enabled, we may collect and process:

• Selfie images you capture or upload for face matching
• Face images detected or cropped from event photographs uploaded by the photographer
• Biometric face embeddings (mathematical representations of facial features used for matching)
• Related technical metadata needed to run and secure the feature (for example, timestamps, gallery or event identifiers, and consent records)

We do not use face data to sell advertising, build unrelated identity databases, or share face data for third-party marketing.

Purpose of processing

Face data is processed only to:

• Match your selfie with photographs in a specific event gallery (Face Search / Face Recognition)
• Show you photos that are likely to include you
• Operate, secure, debug, and improve the accuracy and reliability of Face Search
• Record and honour your consent, withdrawal, and deletion requests
• Comply with applicable legal obligations

Processing is limited to the gallery or event context in which the feature is used. We do not use your face data for automated decision-making that produces legal or similarly significant effects outside this Face Search purpose.

Lawful basis & consent (DPDP)

Under the DPDP Act, EventBit acts as a Data Fiduciary (or as a processor on behalf of the photographer, depending on the activity) for Face Search processing. We process face-related data based on your free, specific, informed, unconditional and clear consent, obtained before capture or upload (for example, during gallery registration or when you start Face Search).

You may refuse Face Search consent and still access other gallery features that do not require face matching, where the photographer has enabled such access. Where Face Search is offered, we will present a clear notice describing purpose, data involved, and how to withdraw consent.

Third parties involved

To deliver Face Recognition and Face Search, EventBit uses trusted third-party service providers (Data Processors) that process personal data only on our instructions and for the purposes described in this Privacy Policy. These may include:

• Cloud storage providers (for example, Backblaze B2) — to store selfies, cropped face images, embeddings, and related files securely
• CDN and security providers (for example, Bunny.net, Cloudflare) — to deliver media securely and protect our infrastructure
• Compute / AI infrastructure providers — to run face-detection and face-matching models that generate embeddings and return match results
• Messaging and email providers (for example, WhatsApp / AiSensy, Brevo) — only where needed to send OTPs, access links, or service notices related to your gallery registration, not to market your face data
• Monitoring and security tools (for example, Sentry) — limited technical logs that may incidentally include request metadata, used to keep services reliable and secure

These third parties are contractually required to protect personal data, use it only for contracted services, and not sell it. Some providers may process or store data outside India; where that occurs, we take reasonable measures consistent with applicable law to protect your information during such transfers.

Photographers who host galleries on EventBit may also act as Data Fiduciaries for event photos they upload. EventBit processes those photos and related face matches to provide the gallery service.

Retention

Face-related data (selfies used for matching, cropped face images, and face embeddings) is retained for up to 6 months, or until you withdraw consent or request deletion — whichever is earlier — unless a longer period is required by law or needed to resolve disputes or security incidents. See our Data Retention Policy for more detail.

Your rights & how to withdraw consent

As a Data Principal under the DPDP Act, you may:

• Withdraw consent for Face Search / Face Recognition at any time
• Request access to, correction of, or erasure of your face-related personal data
• Nominate another person to exercise rights on your behalf in case of death or incapacity, as provided under the Act and rules
• Raise a grievance with our Data Governance & Grievance Officer

How to withdraw or request deletion:

• Signed-in studio users: Settings → Privacy & Data
• Gallery visitors / guests: email data-protection@eventbit.io with your registered email or mobile number and the gallery or event name (or share link), and request withdrawal or deletion of face data

Withdrawal of consent does not affect processing that was lawfully completed before withdrawal. After withdrawal or verified deletion, we will stop using your face data for Face Search and delete or de-identify it from active systems within a reasonable period, subject to backup cycles and legal holds.

Children

EventBit Studio is intended for users aged 18 years or older. We do not knowingly collect face data from children below 18. If you believe a child's face data has been submitted, contact data-protection@eventbit.ioand we will take steps to delete it. Where the DPDP Act requires verifiable parental consent for children's data, we will not process such data without that consent.

Sharing Your Information

We do not sell your personal information.

We may share information only with trusted service providers that help us operate EventBit Studio, including payment processors, cloud storage providers, messaging providers, authentication providers, analytics providers, customer support tools and email delivery services.

Our current providers include:

• Chargebee
• Razorpay
• Backblaze B2
• Bunny.net
• Cloudflare
• Google OAuth
• WhatsApp / AiSensy
• Google Analytics
• Microsoft Clarity
• PostHog
• Sentry
• Brevo

These providers process information only for the purposes described in this Privacy Policy.

Cookies

We use cookies and similar technologies to:

• Keep you signed in
• Improve website performance
• Analyze website usage
• Personalize your experience
• Deliver marketing communications where permitted

You may control cookies through your browser settings. For more details, see our Cookie Policy.

Data Retention

We retain personal information only for as long as necessary to provide our services or comply with legal obligations.

• User accounts remain active until deleted by the user.
• AI face data is retained for up to 6 months unless deleted earlier.
• Galleries remain available while the photographer maintains an active subscription.
• Expired galleries may be permanently removed approximately 15 days after subscription expiry following advance notifications.
• Billing records are retained as required by applicable laws.

See our Data Retention Policy for more detail.

Data Security

We implement reasonable technical, administrative and organizational safeguards to protect your information against unauthorized access, disclosure, alteration or destruction. While we strive to protect your information, no method of transmission or electronic storage is completely secure.

International Data Transfers

Your information may be processed or stored in countries outside your country of residence through our trusted service providers. We take reasonable measures to protect your information during such transfers.

Your Rights

Depending on your location, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of your information
• Export your personal data
• Withdraw consent where applicable
• Object to certain processing activities

Signed-in studio users can exercise several of these rights from Settings → Privacy & Data and Settings → Danger Zone.

California residents may also exercise rights available under applicable California privacy laws. EventBit does not sell personal information.

Your Rights Under India's DPDP Act

If you are a Data Principal in India, the Digital Personal Data Protection Act, 2023 provides rights including access, correction, erasure, data portability (where applicable), and withdrawal of consent. You may also nominate another individual to exercise rights on your behalf in case of death or incapacity, as provided under the Act and rules.

To raise a privacy grievance or exercise DPDP rights, contact our Data Governance & Grievance Officer, Deven Rathod, at data-protection@eventbit.io. We aim to respond within a reasonable period. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India in accordance with the DPDP Act and applicable rules.

Children's Privacy

EventBit Studio is intended for users aged 18 years or older. We do not knowingly collect personal information from children below 18 years of age. If you believe a child has provided us personal data, contact data-protection@eventbit.io and we will take steps to delete it.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page together with an updated Effective Date.

Contact Us

EventBit Studio
Sai Nagar, Akola Road
Shelubazar, Washim 444402
Maharashtra, India

• Website: https://eventbit.io
• Support: support@eventbit.io
• Data Governance Officer: Deven Rathod
• Privacy: data-protection@eventbit.io
• Phone: +91 92844 69052

If you have any questions regarding this Privacy Policy or our privacy practices, please contact us at data-protection@eventbit.io.