Security and privacy
How we handle photos and data
This page says what the platform does and where the data is kept. Anything not written here, it does not do.
Principles
Eight rules anchored in the code
Each rule is a recorded decision and enforced by tests.
Faces are never altered generatively
Cropping, rotation, tone values of the whole photo, sharpness and upscaling are allowed. On request a single colour replaces the background along a mask. No generative image model in production.
No face embeddings
The check neither computes nor stores biometric vectors. A photo cannot be used to recognise anyone.
One rule set for browser and server
The live check on the phone and the check on the server read the same file of thresholds.
A transit station, not an archive
The original photo is kept for editing until the school has collected the photo. It is then deleted, usually within 10 minutes, together with the mask. The finished formats and the person's details are deleted 30 days after collection. What remains is a log with identifiers and codes, without names and without images.
Separate stores
The database never holds image content; the image store never holds names, numbers or addresses. The two come together only at the moment of the download.
The link is the secret
Learners need no account. The link has a random key, expires and is protected against guessing.
Every school its own tenant
A school's data is filtered by school in every query; the database enforces the separation as well.
No trackers, nothing external
No external fonts, scripts or analytics. The pages load only from their own address.
What the school decides
After the capture, the school decides
Approval, editing, background, uploading and the interface are up to the school. The platform carries out what it chooses, and nothing else.
- Approval. The school sets whether a photo must be accepted before it can be collected. If it rejects a photo, a new request is created; on request the person receives a new link with a tip.
- Editing. Crop, rotation and tones of the whole photo. Only the values are stored; the photo is always computed from the original.
- Background. Only if the school chooses it. A model on the platform's own server supplies a mask, not an image, and the background is replaced by a single colour. No image leaves the platform for it, and no generative method is used.
- Uploading. Photos the school already has go through the same check. The school confirms them in place of the person; a blocked photo is not accepted.
- Interface. The school decides whether a school administration system is connected. Its access is valid for that school only and only for the permissions chosen, revoking takes effect at once; notifications go only to the address the school gives.
- Deletion. The school can delete a completed request at any time. Otherwise it happens 30 days after completion, without the school doing anything.
- Reports. Figures per day and month, without names and without ID numbers. They remain when photos and personal data are deleted.
- Logo and QR code. The logo is stored anew without metadata. The QR code with which learners move from the computer to the phone is created on the platform's own server; no third-party service sees the link.
Storage locations
Where the data is kept
The provider runs the platform in Europe. The subprocessors are named, with what they receive.
| What | Where | Note |
|---|---|---|
| Database, image store, check, cropping, post-processing, background mask | Hetzner, Germany | One server, encrypted connections, access for the provider only. The mask is computed by a service without any connection to the outside. |
| Additional check (image understanding) | Infomaniak, Switzerland | Only if the provider switches it on. It then receives only a preview of 768 pixels edge length, never the original, never personal references. |
| Invitations by SMS and email | A sending service | The message contains the link and the name of the school, no photo. The privacy policy names the services. |
| School administration system through the interface | At the school | Only if the school connects it. Access per school; photos through links that expire after 10 minutes. |
The privacy policy names retention periods, rights and contacts. A data processing agreement is concluded with each school.
Let us talk about your school
Tell us how many learners and which formats. We will get back to you with the next steps.
No prices on this page: the terms are agreed per school.