Biometric Data Retention & Destruction Policy

Story Wall Systems provides photography studios with an optional feature that groups the photographs in a gallery by the people in them. When a studio turns it on for a gallery, each face detected in that gallery’s photographs is converted into a face template — a mathematical representation of facial geometry. A face template is a biometric identifier, and this policy governs it.

The feature is off by default for every studio. It does nothing unless a studio enables it and then confirms, for each individual gallery, that they hold the consent of the people in it.

We create and store:

• a face template for each face detected in the gallery, held by our processor (Amazon Web Services) in storage dedicated to that single gallery;
• the position of each face within each photograph, and a reference that links it to its template;
• a group label — a role such as “Bride”, or a name, but only if the studio types one.

We do not:

• compare a template created for one gallery against any other gallery, session, or studio. There is no identity that follows a person between galleries;
• use face templates to train any model, to build a profile, or for advertising;
• sell, lease, trade, or otherwise profit from biometric identifiers or biometric information, in any circumstances;
• disclose them to anyone other than the processor that performs the analysis on our behalf, except where a subpoena, warrant, or other legal requirement compels it.

A gallery’s face templates are destroyed at the earliest of the following:

• immediately, when the studio deletes the gallery;
• immediately, when the studio clears the gallery’s face data, which they can do at any time, including after they have switched the feature off;
• immediately, when we receive a valid deletion request for a person in that gallery and it is the only gallery their data appears in;
• 18 months (548 days) after the gallery’s face data was created, automatically, whether or not anyone asks.

The final condition is enforced by a scheduled job that runs daily and is not discretionary. It is deliberately well inside the three-year outer limit the Illinois statute allows, because a shorter period we reliably honour is worth more than a longer one we could argue for.

Destroying face data never deletes photographs. The gallery and every image in it are untouched.

Deletion removes the templates from our processor’s storage first, and only then removes our own records of them. That order matters: the reverse would leave biometric data in existence with nothing in our systems pointing at it. If the processor call fails, the event is recorded and alerted on, and the deletion is retried — we do not treat a failed destruction as a completed one.

If you appear in a gallery and want your face data destroyed, you can ask the studio that created the gallery, or us directly at hello@thephotographersframer.com. You do not have to give a reason, and there is no charge.

We will act within 30 days. Your photographs are not affected — only the face data derived from them.

Depending on where you live you may also have the right to know what we hold, to obtain a copy, and to complain to a data protection authority. Our Privacy Policy explains how to exercise those.

The photographer who creates a gallery is the controller of the biometric data it produces, and is responsible for obtaining the consent of the people in it before enabling the feature. Our Terms of Service require this of them, they must confirm it for each gallery before any scan can begin, and we record that confirmation.

If you believe a studio has used this feature on photographs of you without your consent, contact us. We will investigate and, where appropriate, destroy the data.

If we shorten the retention period, the change applies to existing data as well as new. If we lengthen it, or change what we collect, we will say so here and date the change before it takes effect.