Privacy Notice

Veloxshot processes personal data of photographers, participants, buyers, and individuals who appear in photographs and videos taken at events. This Privacy Notice explains what data we process, for what purposes, and under which legal bases, in accordance with the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares - LFPDPPP) published in the Official Gazette of the Federation (DOF) on 20 March 2025, and its applicable regulations.

Data Controller

Veloxshot. Contact: legal@veloxshot.com.

Personal Data We Process

• From photographers: name, email, uploaded photographs and videos and their metadata, albums, sales and earnings history, subscription plan, and referral program data (your referral code and the photographers you referred). Your payout account is held by Stripe Connect: Veloxshot does not store your bank details or tax identification data, only the identifier of your Stripe account.
• From participants and buyers: name, email, bib number when you search with it, orders and transaction history, records of the downloads of your purchases, and — only if you provide it voluntarily — your phone number, to receive WhatsApp alerts.
• From individuals who appear in photographs and videos uploaded to Veloxshot:
  • Facial vectors (numerical templates of each detected face) derived from the photographs, used for selfie search.
  • Bib numbers read automatically from the photographs, which make the photographs searchable by bib number.
  • Where race videos are available: facial vectors of each person tracked in the video, the position of the person's body in the frames (used to follow the person through the clip), bib numbers read from the video frames, matches between the person in the video and photographs of the same event or album, and short previews (animated teasers, posters and still frames) generated from the video.
• From people who use selfie search: the selfie, processed temporarily as described below, and a log of each search.
• From any visitor: technical data (IP address, user agent), cookie preferences (stored in your browser and, if you are signed in, in your account), and — only if you accept Analytics or Marketing cookies — the identifiers described in the Cookie Policy.

Purposes of Processing

Primary Purposes (necessary for the service):

• To operate the platform for the sale of photographs and video clips, including event albums, private albums and share links.
• To process payments via Stripe, pay photographers via Stripe Connect, and bill photographers' portfolio subscriptions.
• To enable searches of photographs and clips by bib number and by facial recognition (selfie).
• To process uploaded photographs and videos automatically: detecting faces to create facial vectors, reading bib numbers, detecting nudity in order to moderate content, and, for videos, following each person through the video and generating previews and clips.
• To allow photographers to find other photographs of the same person within their own uploads ("find similar photos").
• To deliver purchases and keep evidence of delivery, and to prevent fraud and abuse.
• To send transactional emails related to your account, your purchases and your sales.
• To comply with applicable tax and legal obligations.

Secondary Purposes (you can refuse them without affecting the service):

• Usage analysis to improve the product (only with Analytics cookies).
• Measuring the effectiveness of our advertising on Meta platforms (only with Marketing cookies). See "Advertising measurement" below.
• Sending you WhatsApp alerts when your photos are available, only if you provide your number and tick the consent box. You can opt out at any time by replying STOP.
• Training and improving Veloxshot's own artificial-intelligence models. See "Use of AI" below.
• Using photographs and clips uploaded to or sold through the platform in Veloxshot's own marketing and advertising. See "Use of Photographs in Our Marketing" below.

You can refuse the secondary purposes at any time through the Privacy preferences link in the website footer (Analytics and Marketing), by replying STOP (WhatsApp), or by writing to legal@veloxshot.com.

Biometric Data and Facial Recognition Search

Veloxshot offers a selfie-based search so that event participants can locate the photographs, and, where available, the video clips, in which they appear. This feature processes sensitive personal data under the LFPDPPP, and therefore requires express, informed, and specific consent.

Facial recognition at Veloxshot is performed by Veloxshot's own facial-recognition system, which runs on infrastructure operated on Veloxshot's behalf. No third-party facial-recognition service receives your selfie or any facial data.

Legal Bases

• Express and informed consent of the data subject, collected through an independent mechanism (separate from the acceptance of the Terms of Service), before the first selfie search. The same consent covers searching photographs and race videos.
• Contractual fulfillment: execution of the requested search service.

Data Processed

• Selfie: your selfie is processed temporarily, solely to perform the search you requested, and is deleted immediately after the search, including every copy made to process it. The facial vector calculated from your selfie is used only to run that search and is not stored.
• Facial vectors of photographed individuals: faces detected in the photographs uploaded by photographers are converted into facial vectors, each linked to its photograph and to the event or private album it belongs to. A selfie search only compares your selfie against the vectors of the event or album you are searching.
• Facial vectors from race videos (where available): each person tracked in a video is converted into a facial vector linked to that video and its event or album. Your selfie search is also compared against these vectors so that we can show you the clips in which you appear.
• Search log: for each selfie search we record a reference to your consent, the event searched, your IP address, the number of results, and the date and time. We do not record the selfie or its facial vector in this log. See "Retention" for how long it is kept.
• Consent records: date and time, IP address, user agent, version of the accepted notice, and attestation of legal age.

Retention

• Selfie: deleted immediately after the search, including every copy made to process it.
• Search log: 180 days after the search, your IP address and the link to your consent record are removed from the log. What remains (the event, the number of results, and the date and time) no longer identifies you and is kept only to produce aggregate statistics on the use of the service.
• Consent records: kept while your consent is active, and deleted 5 years after you withdraw it.
• Facial data of event albums (the facial vectors of the photographs, the facial vectors of people tracked in the event's videos and their matches with photographs, and the "find similar photos" results): automatically deleted 180 days after the date of the event (its end date, for multi-day events) or the last upload of a photograph or video to the event, whichever occurs later. If an event is cancelled or deleted, its facial data is deleted in the next daily deletion run. After deletion, photographs remain available through other methods (event browsing, bib number, share links).
• Facial data of private albums (the same categories): automatically deleted 180 days after the last upload of a photograph or video to the album.
• Deleted content: when a photograph or an album is deleted, its facial data is deleted immediately; when a video or a clip is deleted, its facial data is deleted in the next daily deletion run.

The other data about a person tracked in a video (the position of their body in the frames and the bib numbers read) is not facial data and is kept with the video, because it is needed to produce the clips. See "Photographs, Videos and Share Links".

Minors

Veloxshot prohibits the processing of biometric data of individuals under 18 years of age without the express authorization of their parent or legal guardian. By using the selfie search, the user declares and attests that they are over 18 years old or possess such authorization. Responsibility for non-compliance with this restriction rests with the parent or legal guardian.

Withdrawal of Consent

You can withdraw your consent to the processing of biometric data at any time via the Privacy preferences link in the website footer. The withdrawal takes effect immediately; the next selfie search will prompt you for a new consent.

Photographs, Videos and Share Links

• Bib numbers: bib numbers read automatically from photographs and videos can be searched by anyone who has access to the event or album.
• Race videos and clips (where available): race videos uploaded to Veloxshot are processed to follow each runner, read bib numbers and match each runner with photographs of the same event or album. Short animated previews of a runner may be shown in search results and albums, and the corresponding clip can be purchased. Temporary frames extracted from a video during processing are deleted automatically within 7 days. The facial data derived from videos is deleted as described under "Retention". Videos, the previews derived from them, and the other data about each tracked person (body position and bib numbers read) are not subject to automatic time-based deletion; if you appear in a video and want it or its previews removed, you can use the "Reporting Content" procedure in the Terms of Service or your ARCO rights.
• Selfie-search share links: if you share your selfie-search results, we create a link that contains only the event and the list of matched photographs — never your selfie or any facial data. The link stops working after 90 days.
• Album share links: photographers can share an album, or a selection of photographs, through a link. Anyone with the link can view the shared content and, where offered, buy it, including clips on whole-album links.

Use of AI

Veloxshot uses automated systems, operated on its behalf, to detect faces, read bib numbers, detect nudity, and process videos, as described in this Notice.

Veloxshot may use the photographs and videos uploaded to the platform, together with labels derived from them (such as bib numbers and the position of people and faces in each image), to train, evaluate and improve Veloxshot's own artificial-intelligence models, including models that read bib numbers, detect people, moderate content and process videos. This training:

• never uses selfies, which are deleted immediately after each search;
• is never used to train models that recognize faces, and never uses facial vectors or any other biometric data;
• is carried out on infrastructure operated on Veloxshot's behalf, and the photographs and videos are not provided to third parties to train their own models.

The images and labels used for training are kept for as long as they are needed to train and evaluate these models. The periods under "Retention" apply to the facial vectors used by the selfie search, not to training images.

You can object to the use, for this purpose, of photographs and videos in which you appear by writing to legal@veloxshot.com. They will be excluded from future training.

Use of Photographs in Our Marketing

Veloxshot may use photographs, clips and previews uploaded to or sold through the platform in its own marketing and advertising: on its website, on its social-media accounts, and in paid advertising on third-party platforms such as Meta (Facebook and Instagram). When an image is used in paid advertising, the advertising platform receives that image in order to display the ad.

In this marketing, Veloxshot does not publish your name, does not tag you unless you asked us to, and never uses selfies or the results of your searches.

Featuring you (opt-in). After a purchase, Veloxshot may ask whether you want to be featured. If you say yes, we record which purchased photographs and clips you approved, whether you confirmed you are the person in them or their parent or guardian, the Instagram username you chose to give us (optional, so we can tag you), the date and time, your IP address and browser, and the version of the wording you accepted. You can withdraw at any time from your download link or your account; withdrawing deletes your Instagram username. We keep the record of a withdrawn consent for 5 years as evidence, then delete it.

If you appear in a photograph or clip used in our marketing and want it removed, write to legal@veloxshot.com with a link to it or a screenshot. Veloxshot will stop using it in new materials and will remove it from the posts and ads it controls.

Advertising Measurement

Only if you accept Marketing cookies, Veloxshot uses the Meta Pixel and the Meta Conversions API (Meta Platforms) to measure the effectiveness of our advertising:

• In your browser, the Meta Pixel records page views and the following actions: viewing an event, searching an event (by bib number or selfie), adding to cart, starting checkout, and completing a purchase (amount and currency). For searches, including a search made with a selfie, we only send the event identifier — never your selfie, any facial data, the bib number you searched, or your results.
• From our servers, we send Meta the same actions together with your IP address, your user agent, and the Meta cookie identifiers (_fbp, _fbc). For views, searches, adding to cart and starting checkout, we also send the address of the page on which the action took place, without its query parameters. For completed purchases, we also send the amount and currency and your email address in hashed form (SHA-256), which Meta uses to match the purchase with its users.

Meta processes this data under its own privacy policy, which is why we only send it with your consent. In our own records, the IP address and user agent sent to Meta are deleted once the event has been sent, and in any case within 30 days; the cookie identifiers and the record of your consent are kept with the order.

Only if you accept Analytics cookies, Veloxshot uses Google Analytics (Google) to measure how the site is used. Google Analytics is configured not to use the data for advertising.

If you withdraw your Marketing or Analytics consent through Privacy preferences, the corresponding cookies are deleted and no further data is sent.

ARCO Rights

You have the right to Access, Rectify, Cancel, and Oppose the processing of your personal data (ARCO rights). To exercise them — including requesting the deletion of a specific facial vector linked to a photograph or video where you appear — please write to us at legal@veloxshot.com.

We will respond within the period established by the LFPDPPP (20 business days).

Account Deletion

When you delete your account, Veloxshot anonymizes it:

• Your login is deleted, and your name and email are removed from your account and replaced with anonymous values.
• Photographers: photographs that were never sold are deleted together with their files and facial vectors; photographs that were sold are removed from sale and their facial vectors are deleted, but their files are kept so that buyers retain the items they purchased. Videos are removed from the platform and their facial data is deleted; their files are kept, including so that purchased clips remain available to buyers.
• We keep the records we need for tax, accounting and legal purposes and to defend payment disputes: orders and sales (including the name and email recorded on each order), download records, payment records held by Stripe, the documents you accepted and your consent records, and the lists that prevent us from emailing or messaging you again after you opted out, together with the records of messages already sent.

Buyers keep the items they purchased from a deleted photographer account.

Service Providers and International Transfers

Veloxshot relies on service providers that act on its behalf and under its instructions, for the following categories of services: cloud hosting, storage and compute (including the infrastructure on which Veloxshot's own facial-recognition, bib-reading, moderation and video-processing systems run); database hosting; authentication; email delivery; WhatsApp message delivery; and the service-status page shown on our website (which receives your IP address and browser data when the page loads). These providers may process data in Mexico and in the United States. They may only use the data to provide their services to Veloxshot, and Veloxshot maintains contracts requiring protection levels equivalent to those of the LFPDPPP.

The following third parties also receive personal data and process it under their own privacy policies:

Security

We implement reasonable technical, administrative, and physical measures to protect your data:

• Encryption in transit (TLS) and at rest where supported by the provider.
• Restricted access to authorized personnel based on operational necessity.
• Facial vectors are stored separately from the photograph and video files, linked only to the photograph or video and to its event or album — not to the name or account of the person photographed — and are protected by access controls. Selfie searches are always limited to one event or album.
• Minimization: selfies, including every copy made to process them, are deleted immediately after each search, and their facial vectors are not stored.

Cookies

The use of cookies is governed by the independent Cookie Policy. You can manage your preferences from the Privacy preferences link in the footer.

Changes to this Notice

We publish each new version of this Privacy Notice on this page. If you have an account, you will be asked to accept the new version the next time you use Veloxshot while signed in. The version you accepted is recorded with a timestamp.

Photo and gallery views

When you open a gallery, or open an individual photograph at full size, we record that view. We do not record which photographs merely scrolled past on your screen. We use this data to help photographers understand which of their work generates interest, to detect abuse, and to verify that albums are reaching real participants. We process it under our legitimate interest in operating and improving the Veloxshot service.

Each view record contains the photograph or event identifier, a timestamp, and a salted hash derived from your IP address and browser — used to spot abusive traffic, not to identify you. We do not store your IP address in this log.

If you have accepted Analytics cookies, the record is instead linked to the random visitor identifier described in our Cookie Policy (vlx_vid). That identifier contains no name, email, or account reference; its only purpose is to let us count a returning visitor once rather than twice.

Retention. Individual view records are deleted after 30 days, except views of galleries and of individual photographs, which are kept for 180 days because they can be required as evidence that a purchase was delivered when a payment is disputed.

Separately, and for as long as the album or event exists, we keep one minimal row per visitor per gallery or photograph, containing only that visitor identifier (or the daily hash described above), which channel the visit arrived through, and the date first seen. This row is what makes a count of people possible rather than a count of clicks; it holds no browsing history and records nothing about what else you did on the site. You can have it deleted at any time by exercising your ARCO rights, and we delete it when we no longer need it to report on that album or event.

Download records

When you download photographs or clips you have purchased, we record the download: the date and time, your IP address, your browser's user agent, and which order and item it relates to. We process this data under our legitimate interest in confirming that purchases were delivered and in defending payment disputes and chargebacks.

Unlike the view records described above, this log does contain your IP address, because a bank reviewing a disputed charge may require it as evidence of delivery. Identifying details (IP address and user agent) are erased after 180 days. A minimal record of the download - order, item and timestamp - is kept for up to 400 days, which covers the period during which a payment dispute can still be raised.

WhatsApp alerts

If you provided your phone number to receive WhatsApp alerts for an event, the number linked to that alert subscription is deleted automatically 90 days after the event end date. The records of messages already sent to you (which include the number) are kept as delivery records, and if you reply STOP we keep your number on an opt-out list so that we do not message you again. You can request the deletion of these records through your ARCO rights.

Contact

Questions? Write to us at legal@veloxshot.com.