Privacy Policy

DPDP Act 2023 · GDPR · CCPA/CPRA Compliant

Last Updated: September 21, 2026

Notice: PixaConnect ("we", "us", "our") is operated by Yantrashala Private Limited. This Privacy Policy explains how we collect, use, store, share and protect your personal data when you use the Service. This Policy should be read alongside our Terms and Conditions.

Scope and Applicability

This Policy applies to all users of PixaConnect, including professional photographers who register for an account ("Photographers"), their team members ("Team Members"), event guests and clients who access photo galleries ("Gallery Visitors" or "Clients"), and visitors to our marketing website.

PixaConnect operates as both a Data Fiduciary (under India's Digital Personal Data Protection Act, 2023) and a Data Controller (under the EU General Data Protection Regulation) for the personal data we process to provide our Service. Where a Photographer uses our platform to collect data from their own clients, the Photographer acts as an independent controller/fiduciary for that relationship, and PixaConnect acts as a processor on their behalf.

This Policy is governed by and complies with applicable provisions of the Digital Personal Data Protection Act, 2023 (India), the Digital Personal Data Protection Rules, 2025 (India), the Information Technology Act, 2000 (India), the General Data Protection Regulation (EU), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (USA).

Key Definitions

Term	Meaning
Personal Data	Any data about an identified or identifiable individual, including name, phone number, email, photographs, face embeddings, IP address and device identifiers.
Biometric Data	Data resulting from specific technical processing relating to the physical characteristics of a person — in our case, facial geometry vectors (embeddings) derived from selfies or photographs for identification purposes.
Data Principal	The individual whose personal data is being processed (DPDP Act term). Equivalent to "Data Subject" under GDPR.
Data Fiduciary	The entity that determines the purpose and means of processing personal data (DPDP Act term). Equivalent to "Data Controller" under GDPR. Yantrashala Private Limited is the Data Fiduciary for PixaConnect.
Processing	Any operation performed on personal data, including collection, storage, use, sharing, modification and deletion.

Data We Collect

3.1 Photographer Account Data

Identity data: full name, email address, phone number, studio/business name. Authentication data: hashed password, OAuth tokens (Google Sign-In). Business profile data: portfolio content, studio logo, watermark images, social media handles. Subscription and billing data: plan/tier selection, subscription status, payment transaction IDs — we do not store credit/debit card numbers; all payment processing is handled by Razorpay. Team data: names, phone numbers and email addresses of team members.

3.2 Gallery Visitor and Client Data

Identity data: name, phone number (via OTP verification), email address. Authentication data: gallery PIN, one-time passwords (OTP via WhatsApp/SMS), Google or Apple sign-in tokens. Biometric data: facial geometry embeddings derived from selfies uploaded through our "Find My Photos" feature (see Section 4). Social media data: Instagram handle and follow status (only when the gallery uses the Instagram follow-gate). Activity data: photo selections, downloads, gallery viewing patterns. Payment data: transaction records for pay-to-unlock galleries, processed through Razorpay.

3.3 Photographs and Media

Photographers upload photographs through our platform. These images may contain photographs of identifiable individuals and EXIF metadata (camera model, GPS coordinates, timestamps). PixaConnect processes these to generate optimised variants for gallery delivery. Original master files are stored either on our cloud infrastructure or on the photographer's own Google Drive, depending on their storage tier.

3.4 Automatically Collected Data

Device and browser data: IP address, browser type and version, operating system, device type, screen resolution. Usage data: pages visited, features used, session duration, referral source. Analytics data: aggregated product analytics collected through PostHog for service improvement.

Biometric Data and Face Recognition

Important: This section provides specific disclosure about our use of facial recognition technology, as required under applicable biometric data protection laws.

4.1 What We Process

PixaConnect uses face detection and recognition technology (powered by InsightFace/ArcFace models, self-hosted on our infrastructure) for: Face clustering — automatically grouping photographs by individual; Find My Photos (selfie matching) — allowing Gallery Visitors to upload a selfie to find their photographs; and Instagram selfie-DM matching — matching a selfie sent via Instagram DM to faces in event photographs.

4.2 Technical Details

From each detected face, we extract a facial geometry embedding — a numerical vector (512 floating-point numbers) representing geometric relationships between facial features. These embeddings are derived from photographs using automated processing on our servers, cannot be reverse-engineered into a facial image, are used solely for matching and grouping faces within PixaConnect, and are stored in our database linked to the corresponding photograph or user profile.

4.3 Consent for Biometric Processing

Gallery Visitors (selfie upload): When you use "Find My Photos", you provide explicit, informed consent by voluntarily uploading your selfie. You may decline to use this feature and still browse the gallery normally.

Individuals in uploaded photographs: The Photographer, as the independent data controller, is responsible for obtaining any required consents from the individuals they photograph. PixaConnect's face detection is performed as a processor on the Photographer's behalf.

Under GDPR (Article 9): Biometric data is a special category. Our processing is based on your explicit consent (Article 9(2)(a)) when you voluntarily upload a selfie.

Under India's DPDP Act: We process biometric data based on your consent, provided through the affirmative action of uploading a selfie or registering for the Service.

Under CCPA/CPRA: Facial geometry data constitutes "biometric information" under Cal. Civ. Code §1798.140(c). We collect this category for the business purposes described above and do not sell it.

4.4 Opting Out of Face Recognition

Gallery Visitors may choose not to upload a selfie and browse galleries without the face-matching feature. To request deletion of a previously submitted selfie embedding, contact us at the address in Section 15. Photographers may disable face detection and clustering for any project from their project settings.

How We Use Your Data

Purpose	Data Used	Applies To
Account registration & authentication	Name, email, phone, password	Photographers, Team Members
Gallery access & identity verification	Phone number, OTP, PIN, name	Gallery Visitors
Photo gallery delivery & CDN optimisation	Photographs, image variants, EXIF data	Photographers, Gallery Visitors
Face detection, clustering & selfie matching	Facial embeddings, selfie images	Gallery Visitors, individuals in photos
Photo selections and downloads	Selection records, download activity	Gallery Visitors
Subscription management & payments	Tier, transaction IDs, subscription status	Photographers
Gallery unlock payments	Payment amount, transaction ID, commission	Gallery Visitors, Photographers
Album design & print production	Photo selections, layout data	Photographers
Portfolio & studio branding	Logo, colours, domain, social links	Photographers
Instagram follow-gate verification	Instagram handle, follow status	Gallery Visitors (opt-in)
Product analytics & improvement	Anonymised usage data	All users
Security & fraud prevention	IP address, device data, access logs	All users

Legal Basis for Processing

6.1 Under India's DPDP Act, 2023

Consent (Section 6): We process personal data based on your free, specific, informed and unambiguous consent, given through a clear affirmative action (account registration, selfie upload, accepting gallery terms).

Legitimate Uses (Section 7): Certain processing is permitted without consent where necessary to fulfil a contractual obligation, comply with legal requirements, respond to medical emergencies, or for employment purposes.

6.2 Under GDPR

Consent (Article 6(1)(a) and Article 9(2)(a)): For biometric data processing and marketing communications. Contract (Article 6(1)(b)): For providing the Service to registered Photographers. Legitimate Interest (Article 6(1)(f)): For security, fraud prevention, product improvement and analytics. Legal Obligation (Article 6(1)(c)): Where required by applicable law.

6.3 Under CCPA/CPRA

We collect and use the categories of personal information described above for the business and commercial purposes listed in Section 5. We do not "sell" or "share" (as those terms are defined under the CCPA) your personal information for cross-context behavioural advertising.

Data Sharing and Third Parties

We do not sell your personal data. We share data only with the following service providers:

Provider	Purpose	Data Shared	Location
Cloudflare	CDN, image processing, DDoS protection	Images, request metadata	Global edge
Microsoft Azure (AKS)	Application hosting, compute	All application data	India (primary)
Cloudflare R2	Image variant storage	Processed image variants	Configurable
Google Drive	Master storage (drive-backed tier)	Original photographs	Photographer's Drive
Razorpay	Payment processing	Transaction amount, payer identity	India
MSG91	WhatsApp OTP & messaging	Phone numbers, message content	India
Meta (Instagram)	Instagram follow verification	IG handle, follow status	US
PostHog	Product analytics	Anonymised usage events	EU / US

Each service provider is bound by a data processing agreement (DPA) compliant with GDPR Article 28 where applicable. Photographers and business customers who require a copy of our DPA may request one by contacting [email protected].

7.1 Photographer–Client Relationship

When a Photographer creates a gallery, they can view the identity of clients who access it (name, phone number) and their selections/downloads. This sharing is necessary for the delivery of photography services.

7.2 Legal and Regulatory

We may disclose personal data where required by law, regulation, legal process or enforceable governmental request, including to Indian law enforcement, the Data Protection Board of India, or courts of competent jurisdiction.

Data Storage and Security

We implement appropriate technical and organisational measures to protect your data:

Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
Encryption at rest: Sensitive credentials (Google Drive OAuth tokens, payment keys) are encrypted using Fernet symmetric encryption.
Access controls: Role-based access with the principle of least privilege.
Infrastructure security: Azure Kubernetes Service (AKS) with network policies, pod security standards and regular security updates.
CDN security: Cloudflare DDoS mitigation, web application firewall and bot management.
Signed URLs: All media access is through time-limited signed URLs that cannot be shared or reused after expiry.

Data Retention

Data Type	Retention Period	After Retention
Photographer account data	Active account + 90 days	Deleted or anonymised
Photographs (original masters)	Per tier and archival settings	Permanently deleted
Image variants	Project lifecycle	Purged from CDN & storage
Face embeddings (from uploads)	Duration of gallery project	Deleted with project
Selfie embeddings (visitor)	Gallery project or until deletion request	Deleted
Payment records	Min. 8 years (Indian tax regulations)	Archived securely
Analytics data	26 months	Automatically purged
Server logs	90 days	Automatically rotated

When a Photographer deletes a project, all associated data is permanently deleted. Backup copies may persist for up to 30 additional days before automated purge.

10.

Cookies and Tracking Technologies

Strictly necessary cookies: Session management, authentication tokens (JWT), CSRF protection. These cannot be disabled.
Functional cookies: Gallery scroll position, display preferences, language selection.
Analytics cookies: PostHog analytics to understand how the Service is used. PostHog data is anonymised and not sold to third parties.

We do not use third-party advertising cookies or cross-site tracking.

10.1 Cookie Consent

When you first visit our website, we display a cookie consent banner that allows you to accept or reject non-essential cookies. Strictly necessary cookies are set without consent as they are required for the Service to function. You can update your preferences at any time through the cookie settings link in the footer. For EU/EEA users, only strictly necessary cookies are set until you provide explicit consent for other categories.

11.

Your Rights

11.1 Rights Under India's DPDP Act, 2023

As a Data Principal, you have the right to:

Access: Obtain a summary of the personal data we process about you.
Correction and Erasure: Request correction of inaccurate data or erasure of data no longer necessary.
Withdraw Consent: Withdraw your consent at any time per Section 6(6) of the DPDP Act. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Grievance Redressal: Lodge a grievance with our Grievance Officer (see Section 15).
Nominate: Nominate another individual to exercise your rights in the event of your death or incapacity.
Complaint to the Board: File a complaint with the Data Protection Board of India if unsatisfied with our response.

11.2 Rights Under GDPR (EU/EEA Residents)

Data portability: Receive your personal data in a structured, commonly used, machine-readable format.
Restriction of processing: Request that we limit how we use your data in certain circumstances.
Object to processing: Object to processing based on legitimate interest.
Withdraw consent: Withdraw previously given consent at any time.
Lodge a complaint: With your local supervisory authority.

11.3 Rights Under CCPA/CPRA (California Residents)

Know: Request disclosure of categories and specific pieces of personal information collected in the preceding 12 months.
Delete: Request deletion of your personal information, subject to certain exceptions.
Correct: Request correction of inaccurate personal information.
Non-discrimination: We will not discriminate against you for exercising any of these rights.
Opt-out of sale/sharing: We do not sell or share your personal information. You may submit a verifiable request via our "Do Not Sell or Share My Personal Information" page or by contacting us at Section 15.
Limit use of sensitive personal information: You may request we limit our use of sensitive personal information to what is necessary for providing the Service.

11.4 Automated Decision-Making (GDPR Article 22)

PixaConnect uses automated processing for face detection, clustering and selfie matching. These features are organisational tools that assist Photographers — they do not produce decisions that have legal or similarly significant effects on individuals. You retain the right to request human review of any AI-generated result by contacting us at Section 15.

To exercise any of these rights, contact us using the information in Section 15. We will verify your identity and respond within the timeframes required by applicable law (30 days under DPDP, 30 days under GDPR, 45 days under CCPA).

12.

Children's Privacy

PixaConnect's Service is not directed at children under the age of 18. We do not knowingly collect personal data from children for the purpose of account registration.

Photographs uploaded by Photographers may contain images of minors taken at events such as family functions and weddings. The Photographer is responsible for ensuring they have appropriate authorisation. Face embeddings may be generated from such photographs as part of automated clustering. Parents or legal guardians may request deletion of their child's facial embeddings by contacting us at Section 15.

Under India's DPDP Act, processing personal data of children (under 18) requires verifiable consent from a parent or legal guardian.

13.

International Data Transfers

Our primary infrastructure is hosted in India (Azure AKS). Certain data may be transferred to other jurisdictions through our service providers:

United States: Cloudflare (CDN and edge processing), Meta/Instagram (follow verification), Google (APIs).
European Union: PostHog (analytics).
Global edge locations: Cloudflare CDN caches image variants at edge nodes worldwide to reduce latency.

For transfers from the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions where available, or your explicit consent.

Under India's DPDP Act, cross-border transfers are permitted to all jurisdictions except those specifically restricted by the Central Government. As of this Policy's date, no such restriction applies to the jurisdictions where our service providers operate.

14.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date, notify registered Photographers via email or in-app notification, and for changes to biometric data processing, provide prominent notice and seek renewed consent where required by law.

Your continued use of the Service after the updated Policy takes effect constitutes your acceptance of the changes.

15.

Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or need to file a grievance:

Data Protection & Grievance Officer:
Yantrashala Private Limited
[email protected]

General Support:[email protected]

EU Representative (GDPR Art. 27):[email protected]

Under the DPDP Act, you may also lodge a complaint with the Data Protection Board of India if unsatisfied with our response.