Privacy Policy
Effective Date: March 1, 2026 • Last Updated: September 24, 2026
PhotoFav (“we”, “our”, or “us”, operated by DevelopOne Apps) provides this Privacy Policy to transparently explain how we collect, handle, process, store, and safeguard your data when you use our mobile application on Google Play, our web application (app.photofav.in), and our marketing website (photofav.in).
1. Our Core Privacy Principles
PhotoFav is an AI-powered photo sharing, gallery delivery, and monetization platform designed for event photographers, studios, and attendees. We are founded on three unwavering principles:
We never sell, rent, monetize, or trade your photos, personal contact information, or facial data to any third party or advertiser.
Guest selfies are used strictly to match photos within that specific event album. No cross-event tracking, public profiling, or public surveillance.
You have the unreserved right to delete your uploaded photos, purge your face embeddings, or request complete account deletion at any time.
2. Device Permissions We Request (Google Play Compliance)
To provide our core photo delivery and face search functionality on Android and mobile devices, PhotoFav requests specific runtime permissions. We only request permissions strictly necessary for app features, and each permission is requested only upon your explicit action:
- Camera Permission (
android.permission.CAMERA)Why it is requested: Allows you to take a real-time selfie to instantly find your photos within an event gallery using our AI face-matching engine, or scan an event QR code to join an album. For studio owners and photographers, the camera is also used to capture an optional live reference selfie during KYC identity verification.
Protection: Camera access is never activated in the background. It is triggered solely when you explicitly tap the selfie or QR scan buttons in the app.
- Photos & Media Access (
READ_MEDIA_IMAGES/READ_EXTERNAL_STORAGE/WRITE_EXTERNAL_STORAGE)Why it is requested: Required for photographers to select and upload event photo albums, for attendees to pick an existing selfie from their photo gallery for face matching, for photographers to upload dual-sided KYC verification document files, and for saving purchased or downloaded original photos directly to your device storage.
Protection: The app only accesses specific files you explicitly select or images you choose to save. It never scans, indexes, or reads unrelated files on your device.
3. Facial Recognition, Biometric Information & Guest Selfies
PhotoFav provides an AI-powered face search feature. When you capture or upload a selfie to find your event pictures, you consent to our processing of your facial image strictly according to the terms below:
A. Nature of Facial Data Collected: Our AI engine analyzes the uploaded event photos and your reference selfie to detect facial landmarks and convert them into a 512-dimensional mathematical numerical vector (“face embedding”). This vector is an abstract set of mathematical numbers and cannot be reverse-engineered into a human photographic image.
B. Specific & Exclusive Purpose: Facial vector embeddings are generated and utilized exclusively to compare your reference selfie against photos published within that specific event gallery to return matching images to you.
C. Absolute Commercial & Advertising Restrictions:
- We never sell, trade, lease, or commercially exploit biometric or facial data.
- We do not build cross-event facial profiles or track individuals across different events.
- We do not utilize your faces or private photos to train public generative AI or foundational vision models.
- Facial data is never shared with advertisers, data brokers, or marketing intermediaries.
D. Retention & Deletion of Facial Data: Reference selfies uploaded by event guests for searching are processed ephemerally or retained only for the duration of the guest’s search session. Event photo face embeddings are retained only for the active lifecycle of the photographer’s event album. When an event is deleted by the photographer or upon user request, all associated face vector embeddings are permanently wiped from our databases.
4. Data Categories We Collect & Process (Data Safety Disclosure)
In compliance with Google Play Data Safety standards, the following table details every category of data PhotoFav collects, whether it is optional or mandatory, and the purpose of handling:
| Data Category | Data Items | Purpose of Collection | Shared with 3rd Parties? | Encrypted in Transit? |
|---|---|---|---|---|
| Photos & Videos | Event photos, reference search selfies | App functionality, gallery delivery, AI face search | No (Private Cloud Storage only) | Yes (TLS/SSL) |
| Biometric / Face Data | 512-D numerical face vector embeddings | App functionality, matching selfies to event photos | No (Never shared or sold) | Yes (TLS/SSL) |
| KYC & Identity Documents | Identity & business proof (PAN Card, Passport, Driving License, GSTIN Certificate), dual-sided scans, address, birthdate, live verification photo | Photographer & studio seller identity verification, fraud prevention, digital photo sale payouts, tax compliance (See Section 5) | No (Private Cloud Storage; shared with statutory/banking authorities only if legally mandated) | Yes (TLS/SSL) |
| Personal Identifiers | Name, email address, phone/WhatsApp number, user ID | Account registration, authentication (OTP/Google), studio profile, customer support | Only essential subprocessors (Auth, SMS) | Yes (TLS/SSL) |
| Financial & Purchases | Payment transaction ID, order history, amount, plan tier, payout account details | Subscription billing, digital photo sale payouts, invoices | Payment Gateway (Razorpay/UPI) | Yes (TLS/SSL) |
| Device & Diagnostics | Device model, OS version, IP address, crash logs | Analytics, fraud prevention, stability, and troubleshooting | No (Internal diagnostics only) | Yes (TLS/SSL) |
*Note: PhotoFav does not collect real-time GPS location, contacts list, microphone audio, or health data. Identity documents (PAN Card, Passport, Driving License, or GSTIN) are collected strictly for photographer/studio seller KYC compliance as detailed in Section 5, and are never requested from general event guests viewing or finding photos.
PhotoFav enables professional photographers and studios to sell digital photo downloads, publish branded galleries, and receive monetary payouts. To comply with applicable statutory laws, prevent fraudulent activities, and maintain a trusted marketplace ecosystem, we require photographers and commercial studio owners to complete Know Your Customer (KYC) identity verification:
A. Documents and Information We Collect for KYC
- Official Identity Documents: Digital scans of recognized official identification documents such as Permanent Account Number (PAN) Card, Passport, or Driver’s License.
- Business & Studio Proof: GSTIN Registration Certificate, Trade License, or Certificate of Incorporation (for registered studios and agencies).
- Biographical & Contact Details: Full legal name, date of birth, complete residential or registered studio address, and secondary/alternative contact telephone number.
- Live Verification Photo (Selfie): A real-time face image captured via camera to cross-verify the applicant against the photograph on their submitted government identity card.
- Payout Details: Verified bank account details (Account Number, IFSC Code) or direct UPI Virtual Payment Address (VPA) for transferring photo sale proceeds.
B. Who is Subject to KYC Verification?
KYC and identity document collection is strictly required only for photographers, studio owners, and creators who intend to host commercial events, sell digital photos, or withdraw earnings. Regular event guests, wedding attendees, and visitors who only browse or search for their photos are NEVER asked for government IDs or KYC documents.
C. Storage, Confidentiality & Access Controls
- Restricted Private Cloud Storage: All uploaded identity documents are stored in secure, private cloud storage protected by AES-256 encryption at rest and TLS 1.3 encryption in transit.
- Zero Public Access: KYC documents are strictly confidential. They are never rendered on public event pages, never accessible by guests, never shared with third-party advertisers, and never indexed by web crawlers.
- Manual Admin Audit: Access is restricted strictly to authorized compliance and security officers for manual verification, approval, or rejection of photographer accounts.
- Statutory Compliance Retention: KYC verification records are retained for the duration of the photographer’s active account and for statutory periods mandated by financial and tax regulations governing digital marketplaces in India.
6. Financial Information & Payment Security
When you subscribe to a studio plan or purchase digital photo downloads on PhotoFav, transactions are processed directly by certified third-party payment gateways (such as Razorpay and authorized UPI networks).
- We never store sensitive credit or debit card numbers, CVVs, expiry dates, or UPI MPINs on our servers.
- All payment processing complies strictly with Payment Card Industry Data Security Standards (PCI-DSS).
- We only retain non-sensitive transaction records (order ID, date, billing amount, and payment status) for invoicing, tax compliance, and order fulfillment.
7. Third-Party Service Providers & Infrastructure
We do not sell user data. To securely deliver PhotoFav’s cloud services, we partner with industry-leading infrastructure providers who are bound by stringent data processing and confidentiality agreements:
- Secure Cloud Storage & CDN: Geographically distributed, enterprise-grade cloud object storage with 256-bit AES encryption at rest to host encrypted original and preview photo files.
- Relational Database & Vector Indexing: Securely isolated database clusters for storing user profile metadata and mathematical face coordinate embeddings.
- Authentication Services: Google Sign-In and secure SMS/OTP telephony aggregators for account verification and passwordless authentication.
- Payment Aggregation: PCI-DSS certified gateway providers for processing Indian Rupee (INR) and international transactions.
PhotoFav respects your absolute right to be forgotten. In compliance with Google Play Store Account Deletion guidelines, we provide multiple simple methods for you to delete your account and all associated personal data:
Method A: In-App Account Deletion
- Open the PhotoFav application on your device.
- Navigate to Settings → Account Settings.
- Scroll down to the Danger Zone.
- Tap Delete Account and confirm your decision.
Your account and associated data will be immediately scheduled for permanent deletion.
Method B: Online / Web Deletion Request
You do not need to reinstall or access the app to request deletion. You can submit an online request directly:
Email: developeoneapps@gmail.com
Subject: Account & Data Deletion Request
Turnaround Time: Verified and permanently processed within 30 days.
- Your user profile, email, phone number, and studio branding assets are permanently purged.
- All uploaded photo galleries, master original files, previews, and thumbnails are irrevocably deleted from cloud storage.
- All mathematical face vector embeddings generated for your events are permanently removed from vector databases.
- Past statutory financial invoice records and approved KYC compliance logs may be retained only for the legally mandated period required by Indian tax and financial laws.
9. Children’s Privacy (COPPA & Global Standards)
PhotoFav is an event management and photography delivery platform intended for professional photographers, event hosts, and adult guests. It is not directed to children under 13 years of age (or under 16 in the European Economic Area).
In celebratory events such as family weddings, birthday parties, or school celebrations where children may appear in event photography, photos are uploaded and managed exclusively under the supervision, responsibility, and consent of the event hosts, legal guardians, or hired photographers. We do not knowingly collect personal registration information or KYC documents directly from children under 13. If you believe we have inadvertently collected personal data of a minor without parental consent, please contact us immediately for prompt deletion.
10. Security Standards & Technical Safeguards
We employ comprehensive technical and administrative security measures to protect your imagery, KYC documents, and account credentials against unauthorized access, destruction, loss, or alteration:
- 256-bit TLS/SSL Encryption: All data transmitted between your device and our servers is encrypted in transit using modern cryptographic ciphers.
- Encryption at Rest: Cloud file storage, document vaults, and database backends employ AES-256 encryption at rest.
- Granular Access Controls: Photographers can protect events using unique access PINs, client-only VIP permissions, and watermarked display protections.
- Automated Rate Limiting: Robust rate-limiting and bot-protection mechanisms prevent brute-force attacks on event links and album downloads.
11. Changes to This Privacy Policy
We may periodically update this Privacy Policy to reflect enhancements in our services, technological advancements, or changes in Google Play Store policies and legal regulations. When material changes are made, we will update the “Last Updated” date at the top of this document and notify registered users through in-app alerts or email notices where appropriate.
12. Contact Information & Data Protection Officer
If you have questions, concerns, or requests regarding this Privacy Policy, your biometric data, KYC document submissions, or our data handling practices, please contact our dedicated Data Protection team: