Privacy & PDPO

What we collect

When a photographer uploads event photos, our service detects faces in each photo and generates a numerical face embedding (a 512-dimensional vector) for each face. The embedding is a mathematical fingerprint — it cannot be reversed into a photo of your face.

When you search for yourself by selfie or Google profile photo, we compute an embedding of your search image and retain the image itself for 30 days in our private R2 bucket for security audit purposes (so we can verify that searches are legitimate). After 30 days the image is automatically and permanently deleted. Only Master Album admins (@hkmci.com Workspace accounts) can view this audit history.

How long we keep it

• Album photos: auto-deleted from R2 storage 30 days after the event date.
• Face embeddings: kept indefinitely so we can match across future events if needed.
• Search logs: who searched, when, on which event, and the result count — kept indefinitely as a low-PII audit trail.
• Search images (selfies / Google avatars): stored privately for 30 days, then auto-purged.

Remove your data yourself

You can wipe every search image you've uploaded and every search record we hold for you at any time from My Photos → Clear my data. The deletion is immediate and irreversible.

Your rights (PDPO)

Hong Kong's Personal Data (Privacy) Ordinance gives you the right to ask what data we hold about you, request its deletion, or withdraw consent at any time. Use the Clear my data button on My Photos for an immediate wipe, or contact your album's photographer or tommy.shum@hkmci.com and we'll remove your face embedding from our database within 30 days.

Security

Photos are stored in Cloudflare R2 with private ACL and accessed only via short-lived signed URLs. All traffic is encrypted (HTTPS). Photographer access requires Google Workspace sign-in restricted to hkmci.com. Embeddings live in Cloud SQL Postgres in a private network.