Privacy policy

1. Controller

The controller for the processing on this website and for the operation of the platform is digitalify GmbH (see legal notice). The school concerned is responsible for the photos of its learners; the operator processes them on its behalf.

Please send questions to kontakt@validportrait.ch.

2. Which data is processed

Website: no accounts, no trackers. A cookie remembers the chosen language when you switch it. When a school registers, we store the school's name, short name and language and the person's name and email address until the operator decides, for 30 days at most. If the school is unlocked, the person becomes its first admin.

School console: username, display name, role, where set a “Valid until” date and a session cookie after signing in; for an invitation, who issued it, when and until when it is valid, the link itself only as a hash; also the school's logo if it uploads one. As on the website, a cookie remembers the chosen language when you switch it. Logs contain identifiers and error codes, no names.

Learners: ID number, email address or mobile number, optionally a label, a class and the language, as the school records them. Also the photo taken or uploaded by the school, the target formats cut from it and the measurements of the check; if the school edits the photo or has the background replaced, also the values of the edit and a mask of the background.

Messages: for each invitation or reminder its kind, channel, time and delivery status. The address is kept only with the request; the text of the message is not stored. If a person has their link sent from the phone to an email address of their own, that address is kept with the request only until the email is sent and is then deleted; the school does not see it.

3. For what purpose

The data serves one purpose: to collect a person's portrait photo on behalf of their school, to check it, crop it, post-process it if the school wishes and hand it over to the school. There is no face recognition, no biometric features for recognising anyone are computed, and faces are not altered generatively.

4. Check and post-processing

Approval: the school can set every photo to wait for its approval. If it rejects a photo with a reason, a new request is created for the same person; on request the person receives a new link with a tip.

Editing: the school can move the crop, rotate the photo and adjust the tones of the whole photo. Only these values are stored; the photo is always computed from the original.

Background: if the school chooses to replace the background, a model on the operator's server computes a mask that separates the person from the background. The model supplies only this mask and no image; it is not a generative method. The background is replaced by a single colour; inside the person's outline every pixel stays the original, only the edge is blended. The service runs without any connection to the outside, and no image leaves the platform for it.

5. Uploads by the school and the interface

Uploading: the school can upload existing photos itself. The ID number is read from the file name; the file name itself never reaches the server. Every photo is checked like a capture, and the school confirms it in place of the person.

Interface: the school decides whether a school administration system is connected. It issues the access in the console itself and revokes it there; each access is valid for its school only and only for the permissions it chooses when issuing it. Stored are the name of the system, a check value of each access and when it was last used, and for each uploaded photo a check value of its content, deleted together with the photo. The system collects photos through links that expire after 10 minutes. Notifications to the system (webhooks) go only to the address the school gives. The school is responsible for what the connected system does with the data.

6. For how long

A personal link is valid for 30 days unless the school chooses a different deadline. The raw image of a capture expires in the store after one day; for post-processing, a copy of the original is kept.

The original photo is kept for editing until the school has collected the photo. It is then deleted, usually within 10 minutes, together with the mask. The finished formats and the person's details are deleted 30 days after collection. The person's details are the ID number, the recipient and the label. If the link expires or the school cancels the request, everything is deleted 30 days later. The same applies to a rejected photo. If the school never collects a photo, it is deleted 90 days after it was sent. This deadline can differ per school. The school can also delete a completed request at once.

A log with identifiers and codes, without names and without images, is kept for traceability, as are the status and class of the request and the figures of the reports, which contain no personal data.

7. Subprocessors

Hetzner Online GmbH, Germany: servers for the database, the image store, the check, the cropping and the post-processing, including the background mask.

Infomaniak Network SA, Switzerland: only if the operator switches on the additional check. An image understanding model then checks the image; only a preview of 768 pixels edge length is sent, without personal references.

Twilio Ireland Limited, Ireland: SMS, once the operator switches them on. It receives the mobile number and the text of the message, never a photo. Both are kept in Twilio's Ireland region and deleted at Twilio shortly after sending (in backups for up to 30 days). For operations and support, the parent company Twilio Inc. in the USA may access them, safeguarded by the EU–US and Swiss–US Data Privacy Framework and standard contractual clauses.

mailXpert GmbH (Mailomat), Switzerland: emails, once the operator switches them on. It receives the email address and the text of the message, never a photo. If a school has switched on its own mail server or Microsoft 365, its emails to learners go through that instead.

There are no other subprocessors. If the school connects its own system through the interface, that system receives its school's data, as a recipient the school itself determines.

8. No disclosure, no trackers

Data is neither sold nor used for advertising. The pages load no external fonts, scripts or analytics, and the platform keeps no access log with IP addresses.

The QR code with which learners take their link from the computer to the phone is created on the operator's server; no third-party service sees the link. A school's logo is stored anew without metadata and loaded from the platform's address, in the emails too.

9. Your rights

You have the right to access, correct and delete your data. Learners first contact their school, which commissioned the processing; schools and everyone else write to kontakt@validportrait.ch.

10. Version

This policy describes the state of the platform under development. It is updated when the processing changes; the version in force is on this page.