Privacy Notice

Veloxshot processes personal data of photographers, participants, and individuals photographed at events. This Privacy Notice explains what data we process, for what purposes, and under which legal bases, in accordance with the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares - LFPDPPP).

Data Controller

Veloxshot — address and contact at legal@veloxshot.com.

Personal Data We Process

• From photographers: name, email, tax identification data when applicable, banking details for payments via Stripe Connect, uploaded photographs, and metadata.
• From participants: name, email, bib number, purchased photographs, transaction history, and — only if you provide it voluntarily — your phone number, to receive WhatsApp alerts. The number is deleted automatically 90 days after the event end date.
• From individuals photographed at events: facial vectors derived from the photographs uploaded by photographers to enable biometric search.
• From any visitor: technical data (IP address, user agent), cookie preferences, consent audit logs, and — only if you accept Analytics cookies — a random visitor identifier used to count views. See "Photo and gallery views" below.

Purposes of Processing

Primary Purposes (necessary for the service):

• To operate the photograph sales platform.
• To process payments via Stripe.
• To enable photograph searches by bib number and facial recognition.
• To comply with applicable tax and legal obligations.

Secondary Purposes (with your consent):

• Usage analysis to improve the product.
• Send you WhatsApp alerts when your photos are available, only if you provide your number and tick the consent box. You can opt out at any time by replying STOP.
• Marketing (currently inactive; any future campaigns will require additional express consent).

Biometric Data and Facial Recognition Search

Veloxshot offers a selfie-based search so that event participants can locate the photographs in which they appear. This feature processes sensitive personal data under Article 9 of the LFPDPPP, and therefore requires express, informed, and specific consent.

Legal Bases

• Express and informed consent of the data subject, collected through an independent mechanism (separate from the acceptance of the Terms of Service).
• Contractual fulfillment: execution of the requested search service.

Data Processed

• Temporary selfie: sent to AWS Rekognition solely to perform the search. It is NOT stored in our systems and is discarded immediately after processing.
• Facial vectors of photographed individuals: faces detected in the photographs uploaded by photographers are indexed in event-specific AWS Rekognition collections to allow biometric matching.
• Consent audit logs: timestamp, IP address, user agent, version of the accepted notice, and attestation of legal age are retained. These are kept for 5 years from the withdrawal of consent, in accordance with the applicable civil statute of limitations in Mexico.

Retention

Facial vectors indexed in AWS Rekognition are automatically deleted 180 days after the date of the event or the last upload of photographs to the event, whichever occurs later. After deletion, photographs remain available for search through other methods (event browsing, bib number, shared links).

There is no mechanism in this version for retention extension at the photographer's request.

Subprocessors

• AWS Rekognition (Amazon Web Services Inc., United States). Subject to the AWS Data Processing Agreement (DPA) and international transfer requirements under the LFPDPPP.

Minors

Veloxshot prohibits the processing of biometric data of individuals under 18 years of age without the express authorization of their parent or legal guardian. By using the selfie search, the user declares and attests that they are over 18 years old or possess such authorization. Responsibility for non-compliance with this restriction rests with the parent or legal guardian.

Withdrawal of Consent

You can withdraw your consent to the processing of biometric data at any time via the Privacy Preferences link in the website footer. The withdrawal takes effect immediately; the next selfie search will prompt you for a new consent.

ARCO Rights

You have the right to Access, Rectify, Cancel, and Oppose the processing of your personal data (ARCO rights). To exercise them — including requesting the deletion of a specific facial vector linked to a photograph where you appear — please write to us at legal@veloxshot.com.

We will respond within a maximum period of 20 business days in accordance with Article 32 of the LFPDPPP.

International Transfers

Some of our data processors process data outside of Mexico:

Processor	Purpose	Location	Safeguard
Amazon Web Services	Photograph storage and biometric matching	USA	AWS DPA
Clerk	Authentication	USA	Clerk DPA
Stripe	Payments	USA	Stripe DPA
Resend	Transactional email	USA	Standard contractual terms
Twilio	WhatsApp message delivery	USA	Twilio DPA
Meta Platforms (WhatsApp)	WhatsApp message delivery	USA	Standard contractual terms
Render	Hosting	USA	Render DPA

These providers may use subprocessors or internationally distributed infrastructure. Veloxshot maintains contracts requiring protection levels equivalent to those of the LFPDPPP.

Security

We implement reasonable technical, administrative, and physical measures to protect your data:

• Encryption in transit (TLS) and at rest where supported by the provider.
• Restricted access to authorized personnel based on operational necessity.
• Biometric vectors are segregated per event and stored apart from photographs and account data.
• Minimization: we do not store original selfies; only vectors derived from photographers' photos.
• Continuous monitoring and audits.

Use of AI

Veloxshot DOES NOT use the photographs or selfies uploaded to the system to train proprietary or third-party artificial intelligence models. Any future use for such purposes would require your additional explicit consent.

Cookies

The use of cookies is governed by the independent Cookie Policy. You can manage your preferences from the Privacy Preferences link in the footer.

Changes to this Notice

When this Privacy Notice changes substantially, we will notify you by email or request your re-acceptance when you log in. The version you accepted is recorded with a timestamp.

Photo and gallery views

When you open a gallery, or open an individual photograph at full size, we record that view. We do not record which photographs merely scrolled past on your screen. We use this data to help photographers understand which of their work generates interest, to detect abuse, and to verify that albums are reaching real participants. We process it under our legitimate interest in operating and improving the Veloxshot service.

Each view record contains the photograph or event identifier, a timestamp, and a salted hash derived from your IP address and browser — used to spot abusive traffic, not to identify you. We do not store your IP address in this log.

If you have accepted Analytics cookies, the record is instead linked to the random visitor identifier described in our Cookie Policy (vlx_vid). That identifier contains no name, email, or account reference; its only purpose is to let us count a returning visitor once rather than twice.

Retention. Individual view records are deleted after 30 days, except views of galleries and of individual photographs, which are kept for 180 days because they can be required as evidence that a purchase was delivered when a payment is disputed.

Separately, and for as long as the album or event exists, we keep one minimal row per visitor per gallery or photograph, containing only that visitor identifier (or the daily hash described above), which channel the visit arrived through, and the date first seen. This row is what makes a count of people possible rather than a count of clicks; it holds no browsing history and records nothing about what else you did on the site. You can have it deleted at any time by exercising your ARCO rights, and we delete it when we no longer need it to report on that album or event.

Photo download records

When you download photographs you have purchased, we record the download: the date and time, your IP address, your browser's user agent, and which order and photograph it relates to. We process this data under our legitimate interest in confirming that purchases were delivered and in defending payment disputes and chargebacks.

Unlike the view records described above, this log does contain your IP address, because a bank reviewing a disputed charge may require it as evidence of delivery. Identifying details (IP address and user agent) are erased after 180 days. A minimal record of the download - order, photograph and timestamp - is kept for up to 400 days, which covers the period during which a payment dispute can still be raised.

Contact

Questions? Write to us at legal@veloxshot.com.