What we collect, why, and how to have it removed. Written to be read — if anything here is unclear, that is a fault worth telling us about.
Effective 31 July 2026 · Last updated 20 October 2026
CamSetu is an event-photo platform: photography studios upload and organise event photos, and guests view, download and find their own photos in them. It is operated from India by Codeverse Weenggs Solutions LLP (“we”), of 221, Avalon Business Hub, Ambatalavadi, Katargam, Surat, Gujarat 395004, India. CamSetu is the product name; the LLP is the entity accountable for the service and for your data.
For anything in this policy — questions, requests, complaints — write to [email protected]. This policy explains what personal data we collect, why, where it lives, who else touches it, and what you can ask us to do with it, in line with India’s Digital Personal Data Protection Act, 2023 (DPDP Act).
This is the only privacy policy CamSetu has, and it covers every CamSetu surface: this marketing site, the studio panel where studios manage their events, the guest surfaces (event galleries, join pages, flipbooks and the portfolio pages studios publish), the CamSetu mobile apps for iPhone and Android, and the CamSetu desktop uploader.
Two roles appear throughout, because we hold different data about each. Studios are our customers — the photography businesses, wedding planners and event teams who hold an account with us, and the team members they invite. Guests are the people who open a link a studio shared and sign in with a phone number, an email address or Google. A guest can also be made an event admin by the studio, or create an event of their own; for that event they act as its host, much as a studio does, and the parts of this policy about studios apply to them for it.
The mobile apps ask for your permission before using your camera (to take a selfie or scan an event’s QR code), saving photos to your device, or sending you notifications. You can refuse any of these, or withdraw the permission later in your phone’s settings; the parts of the app that need it will then not work.
Signing in. You sign in with Google, or with a one-time code or sign-in link we send to your email address or mobile number. If you choose Google, it tells us your verified email address, name and profile picture; we never receive your Google password and get access to nothing else in your Google account. We do not use passwords to sign in. Some older accounts — team members who joined by invitation, and accounts our staff created — still hold a password, stored only as a secure hash, which nothing uses any more.
From studios, we hold:
From guests, we hold:
Event photos and videos frequently show people — that is the point of the product. We remove GPS location from every photo and video we store, whichever way it was uploaded: the location in a photo’s EXIF and XMP data, and the location recorded in a phone video. (A few uncommon file layouts that our software cannot rewrite safely are stored as uploaded.) Other embedded details are kept, such as the capture time, the camera and lens, the photographer’s copyright, and any place name a photographer typed into the file. Files uploaded before 24 September 2026 have not been reprocessed and may still contain location data; ask us and we will remove it. We also count how many times each photo is opened full-screen — one number per photo, with no record of who opened it.
Devices. If you allow notifications in the mobile app, we store a push token for your device so we can reach it. If the app crashes, a crash report is sent (see Who else receives data). Whenever anyone signs in, we record the session’s IP address and browser or app details as part of keeping accounts secure.
This website. When you ask us to contact you, we keep the name, studio name and phone number you submit, and a salted hash (never the raw value) of your IP address, used to limit abuse of the form.
Anyone with a CamSetu account — a guest, a studio owner or a studio team member — can optionally register their face so CamSetu can find the photos they appear in. This is the most sensitive data we handle, so here is exactly what happens.
What we collect when you register. (1) Your selfie: one photo of your face. (2) If you choose, up to four more face photos on the same account, five in total. Each is either another photo of you (for example, wearing glasses) or another person you are responsible for and entitled to act for — for example, a child or an elderly parent. You give each one a name. (3) A face embedding for each of those photos: a list of numbers our software computes from the face. We do not use Face ID or any device face-unlock data, and face data is never used to sign you in.
Every face is captured live, and registering one is optional. You never need to register a face to use CamSetu, and you can skip it. Each face is taken with the camera, not chosen from your photo library. You are asked to blink so we know a real person is in front of the camera. That check runs entirely on your device, using face-detection software from Google built into the app (ML Kit in the mobile apps, MediaPipe on the web); the camera feed is not sent anywhere during it, and no image or face data goes to Google. Only the one photo taken for registration is uploaded, to us — in the mobile app it is taken at the blink, and on the web you can look at it and retake it first. (The one exception: a small number of test accounts that we switch on by hand may add another person’s face from a saved photo, and those faces are recorded as not live-checked.) When the photo is saved, we record your consent together with the wording you were shown and the version of this policy you agreed under. Registering another person’s face is recorded as a separate consent. By registering it, you confirm that you are entitled to act for that person; for a child, that you are their parent or lawful guardian.
Faces in event photos — including people who never use CamSetu. When photos are added to an event, our software detects every face in them and stores, for each face, an embedding and a small cropped image. It also records measurements of the face — head angle, sharpness, whether the eyes are open, how near it is — and whether a photo shows no one, one person, a couple or a group, so photos can be sorted (for example, to find shots that are ready to share). It then groups faces it judges to be the same person into a “person” for that event. The studio, and anyone the studio or the event’s creator puts in charge of the event, can give a group a name and record how that person relates to the event (for example, “family” or “friends”). We do not estimate age, gender, emotion or ethnicity. All of this belongs to the one event and is deleted with it.
How your registered face is used. To find your photos, our own self-hosted face-matching service compares the embeddings of your registered faces with the faces detected in the photos of events you have joined, and records which of your registered faces was found in which photo. It runs on servers we operate. Embeddings are used only within the events you have joined; they are never compared across studios or against any outside database. Face data is not used for advertising, profiling, identity verification or training models. No third-party face-recognition service receives your face photos or your face data, and we do not sell or share it.
When one of your registered faces is found in an event’s photos, the matching group of photos is labelled with your name — or, for another person you registered, the name you gave them, marked as registered by you — and the studio and the event’s hosts see that label. Your selfie also becomes the profile picture on your account, which they see in the event’s guest list. The face photos of the other people you register are shown to no one but you, and no registered face photo is published in any gallery. Images are served over unguessable web addresses, but those addresses are not login-protected, so treat a link to an image as viewable by anyone the link is shared with.
Removing it. You can remove your face data yourself at any time. In the mobile app, open My Face (studio accounts: Account → My Face); on the web, open Settings → Your Face. Then choose Remove Face Data. This deletes every face registered on your account, the embeddings computed from them and the stored images, withdraws your consent and stops all future matching. Your My Photos list empties with it, except for any photo a studio tagged you in by hand. You can also remove any one registered face on its own. Every other way face data is deleted is listed in How long we keep data. You can always email [email protected] instead; see Your rights.
Data inside the product is visible to the people it is for, and to nobody else:
A guest’s details are never visible to studios whose events the guest has not joined.
We use the data above to:
We do not use your data for advertising, we do not profile you for marketing, and we do not sell it. A studio’s photographs are used to run the service for that studio and nothing else — we do not use them to advertise CamSetu, and if we ever wanted to feature a studio’s work we would ask first.
Photos, face photos and other images are stored in object storage. By default that is Cloudflare R2, served through Cloudflare’s content delivery network. For accounts whose plan uses it, it is Backblaze B2 in the European Union, also delivered through Cloudflare. Everything else lives in databases on servers we manage ourselves, rented from Hetzner in data centres in the European Union. That includes accounts, events, guest lists, face embeddings, consent records, billing records and activity logs. Our face-matching service runs on those same servers.
Protections currently in place: all traffic is encrypted in transit (HTTPS). Sign-in uses one-time codes, sign-in links or Google rather than passwords, and the passwords some older accounts hold are stored only as secure hashes. A studio’s GSTIN and contact details are additionally encrypted at rest inside the database. Each studio’s data is isolated from every other studio’s. Image web addresses are long and unguessable but, as noted above, not login-protected.
We use a small number of service providers, and only for the job named:
Every provider is held to this policy. Each provider above receives only the data its job needs, may use it only to provide that service to us, and is bound by its data-protection terms with us to protect it to at least the standard this policy describes. The one exception is Google ML Kit’s technical diagnostics described above, which contain no photos, face data or contact details and are not linked to you; Google uses them under its own terms to run and improve that software.
Face data is not shared with any third party. No provider receives your face photos or embeddings in order to analyse them, and no third-party AI service is used: face matching runs on servers we operate, and the blink check runs on your device. Cloudflare and Backblaze only store and deliver the image files on our behalf.
We do not currently run any usage analytics on this site, the panel, the guest pages or the apps, and no analytics data is sent to any analytics company. If we turn analytics on, it will be self-hosted, and this policy will say so first.
We do not sell personal data, we do not share it for anyone else’s advertising, and no ad networks or third-party trackers run on our pages or in our apps. We may disclose data if required by law or a competent authority.
CamSetu is operated from India. Our servers are rented from Hetzner and located in the European Union, and the face matching described above runs there; the databases on them, including face embeddings, are managed by us. Razorpay, our payment provider, is an Indian company. Some of our other providers are international and may store or process data outside India as part of providing their services: Cloudflare (image storage and delivery), Backblaze (image storage in the European Union, for accounts whose plan uses it), Resend (email delivery), Google (the optional sign-in, Android notifications, and ML Kit’s diagnostics from the mobile app), Expo and Apple (app notifications and updates; Expo is based in the United States) and Sentry (crash reports, in its European Union region). Each of them is bound to protect that data to at least the standard of this policy, as described in Who else receives data, and this processing happens only for the purposes described in this policy.
We keep data for as long as the account, event or photo it belongs to exists. When a host deletes a photo or an entire event, the stored image files are removed as part of the deletion, together with the faces detected in them, their embeddings and measurements, and the face groups, names and relations recorded for that event. A diagnostic log from the desktop uploader is stored with the event it belongs to and is deleted with it; one not tied to an event is kept until we are asked to remove it. The exception is a photo the studio copied to its public portfolio, which stays until the studio removes it. Backups may lag behind by a short period before they age out. Unfinished sign-up records are deleted automatically: after 30 days if the sign-up never reached payment, or after 90 days if a payment step was started but not completed.
Face data you registered is kept for as long as you keep it on your account; it has no fixed expiry. It is deleted in each of these cases. When you choose Remove Face Data, every registered face, its embeddings and its images are deleted. When you remove one registered face, that face is deleted. When you take a new selfie, the previous selfie image is deleted. When you leave an event, your face data and matching results for that event are deleted. The temporary copy of a selfie used for a matching job is deleted as soon as the job finishes.
When you delete your account, it is switched off at once (you can restore it within 24 hours), and after that it is permanently deleted together with all of its face data. Two records survive it, as evidence rather than for any other use: the record of the consents you gave and withdrew, and, in the activity log of each studio whose events you had joined, an entry saying that your account was deleted, with the name, email address, IP address and browser it was deleted from. The studio owner can read that entry.
A host can also set an expiry date on an individual event. When it is set, that event and everything in it are deleted automatically the day after that date, including photos, videos and the face data for them. The hosts are notified in the app beforehand. Setting a date is optional and most events do not have one; an event with no expiry date is kept.
When a plan ends. For a studio, we keep its events, photos and the face data derived from them for at least 30 days after its paid period ends; after that we may delete them, as set out in our terms. A guest’s storage plan works differently: we email a warning 30, 14, 7, 3 and 1 days before it ends, uploads stop when it ends, and the events that guest created are permanently deleted one day later, unless the plan is renewed first.
Account and payment records are kept while an account is active, and afterwards for as long as tax and accounting rules require. Contact requests from this website are kept until you ask us to remove them or we no longer need them to reach you; the abuse-check records behind the form, which hold no name or number, are kept for about 30 days. Apart from the deletions described here, we do not operate a platform-wide retention schedule that removes data automatically after a set period. Activity logs, support tickets, error reports and push tokens are kept until we are asked to remove them or no longer need them. If you want something specific removed, email [email protected]; see Your rights.
Under the DPDP Act you can ask us, at [email protected]: what personal data we hold about you (access); to correct data that is wrong or incomplete (correction); to delete your data, including a guest account, your registered faces and the face data derived from them (erasure); to withdraw a consent you gave earlier, such as for face matching, after which we will stop that processing and remove the associated face data; and to name another person to exercise these rights for you if you are unable to (nomination).
Some of these are self-service today, in the mobile app and on the web. Anyone can remove their face data, which withdraws that consent, from My Face. Guests can leave an event, and can delete their entire account. Hosts can delete their events and photos themselves. You can mute an event’s notifications in the app, or turn notifications off in your phone’s settings. Every other request — access, correction, nomination, and deletion of a studio account — is currently handled by a person, not a button, so email is the way to exercise it. We will act on verified requests and confirm when done.
If you are a guest, you can come to us directly. You do not have to go through the studio that invited you. That includes being named or labelled in an event’s face groups, and being invited by a host when you never signed up: tell us, and we will remove the name, label or contact details.
One honest limitation: a guest appears in a studio’s event photos because the studio photographed the event. Removing your guest account and face data stops us matching you to photos, but the photographs themselves belong to the studio’s event. Speak to the studio about removing a photo of you, or include it in your request and we will pass it on.
CamSetu accounts are for photography businesses and adult guests; the product is not directed at children, and we do not knowingly collect a child’s data directly. After you first sign in as a guest, we ask you to confirm that you are 18 or older, and we record your answer. If you answer that you are under 18, we sign you out: an account created in the last hour, with no events joined and no face registered, is deleted at once; for any other account, email us and we will delete it. Event photos may of course include children who attended the event. Those photos are uploaded by the event’s hosts, who are responsible for having the right to photograph and share them, and the faces in them are detected and grouped like any other face in the event.
An adult account holder may register the face of a child in their care, as described in Your selfie and face data, so that the child’s photos can be found for them. By doing so they confirm that they are the child’s parent or lawful guardian and consent on the child’s behalf, and we record that consent. The child’s face photo is used only to find photos for that account holder and is shown to no one else; the name the account holder gave the child is shown to the event’s hosts on the matching group of photos. It can be removed at any time from My Face.
If you are a parent or guardian and want a child’s data or photos removed, email [email protected] and we will treat it with priority.
If a personal-data breach affects your data, we will notify you and the Data Protection Board of India as the DPDP Act requires, and tell you what happened, what data was involved, and what we are doing about it.
If you believe we have mishandled your data or your request, write to [email protected] with “Grievance” in the subject line. We will acknowledge it and respond as required under the DPDP Act.
Our grievance officer is Tushar Navadiya, who can be reached at that address or by post at 221, Avalon Business Hub, Ambatalavadi, Katargam, Surat, Gujarat 395004, India. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.
When our practices change, this page changes with them, and the “Last updated” date at the top is revised. Meaningful changes — new data we collect, new providers, new uses — will be reflected here before or as they ship, and if a change is significant we will tell account holders by email or in the app rather than relying on you to notice.
This page is the single published version. Links to it from inside the product point here, so there is never a second copy to check against.