Privacy Notice
Last updated 2026-08-06
Who is responsible for your data
Bayaan Consultancy (“Ayna”) is the Data Fiduciary for the personal data described here, under the Digital Personal Data Protection Act, 2023.
Registered office: Harua Road, Deulia, North 24 Parganas, West Bengal, India, 743424
Contact: bayaan@consultancy.firm.in
Face recognition, in plain terms
Ayna finds photos you appear in by comparing a selfie you take against photos from the event you are attending. Because this is biometric data, it deserves a direct explanation rather than a buried clause:
- Your selfie image is never stored. It is sent to Amazon Rekognition for comparison and discarded as soon as the comparison finishes. It is not written to our databases or storage.
- A face template derived from your selfie is stored. This is a mathematical representation, not a picture. It is kept so that photos uploaded after your scan can still be matched to you without you having to scan again.
- Searching is limited to one event. Each event has its own isolated face collection. Your face is never matched against another event, and never used to identify you elsewhere.
- Face recognition is optional. You can browse the full event gallery without it.
If you are an event guest
This is everything collected when you scan at an event.
| What | Why | How long | Shared with |
|---|---|---|---|
| Your selfie photo | Compared against photos from this event to find the ones you appear in. | Never stored. The image is sent directly to the face-matching service and discarded once the comparison completes. | Amazon Rekognition (AWS), processed in India (ap-south-1). |
| A face template derived from your selfie | Kept so that photos uploaded after your scan can still be matched to you without you having to scan again. | Held for the event’s retention period, then deleted automatically along with the event. You can delete it yourself at any time from your results page. | Amazon Rekognition (AWS), processed in India (ap-south-1). |
| A device identifier | Recognises your device so you can return to your photos, and limits how many sessions one device can create. | Deleted with the event, or when you delete your face data. | — |
| Your name and phone number (only if you provide them) | Credits photos you contribute, and — if you opt in — sends your photo links over WhatsApp. | Deleted with the event, or when you delete your face data. | AiSensy (WhatsApp Business provider), only if you opt in. |
| Photos you take at the event | Added to the event gallery for other attendees to see. | Deleted with the event at the end of its retention period. | — |
If you have an account (hosts and photographers)
| What | Why | How long | Shared with |
|---|---|---|---|
| Name, email address and phone number | Runs your account, and sends service notifications about your events. | Kept while your account is active. Deleted on request. | Amazon SES (email). AiSensy, if you enable WhatsApp notifications. |
| Business details and profile image | Shown to hosts choosing a photographer, and credited on photos you upload. | Kept while your account is active. Deleted on request. | — |
| Photos you upload | Processed for face matching, quality scoring and moderation, then shown in the event gallery. | Deleted with the event at the end of its retention period. | Amazon Rekognition (AWS), processed in India (ap-south-1). |
| Payment records | Takes payment for events and keeps a billing record. | Retained as long as tax and accounting law requires, even after account deletion. | Razorpay. Card details are handled by Razorpay and never reach our servers. |
| Sign-in activity | Detects repeated failed sign-in attempts so accounts can be locked against brute-force attacks. | Automatically discarded within an hour. | — |
What deleting your face data does
You can delete your face data at any time from your results page, or from Your Data Rights. Being precise about its limits matters more than sounding reassuring.
This is deleted:
- The face template created from your selfie.
- Your session, including your name, phone number and the list of your matched photos.
- Your device identifier.
This is not:
- Photos you appear in that were taken by others. These belong to the event and remain in its gallery until the event is deleted.
- Photos you contributed to the event gallery.
Photos of you taken by other people are not deleted, because each detected face in a shared photo is stored individually — removing yours would make that photo unfindable for everyone else in it. After deleting, you will no longer be findable by face search at this event. You can scan again later to start over. To have a specific photo removed from the gallery, contact the event host or us.
Who else processes your data
| Who | What for | Where |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, storage, and face matching via Amazon Rekognition. | India (ap-south-1) |
| Razorpay | Payment processing for event fees. | India |
| AiSensy | Sends WhatsApp messages, only where the recipient opted in. | India |
| Google Maps | Shows the venue map when a host sets an event location. Guests never load it. | Global (Google LLC) |
| Cloudflare Turnstile | Bot protection on sign-up and sign-in. | Global (Cloudflare, Inc.) |
Photos, face templates and account data are stored and processed in AWS’s Mumbai region (ap-south-1). We do not sell personal data to anyone.
Children
Ayna is not intended for anyone under 18. Face recognition requires confirming you are 18 or older, and we do not knowingly create face templates for children.
Event photography can capture children incidentally. If a child’s photo appears at an event and a parent or guardian wants it removed, contact the Grievance Officer below and it will be removed without requiring an account.
Your rights
Under the DPDP Act you may:
- Ask what personal data we hold about you, and get a copy.
- Ask us to correct anything inaccurate or incomplete.
- Ask us to erase your data, where we are not required by law to keep it.
- Withdraw consent at any time — as easily as you gave it.
- Nominate someone to exercise these rights if you are unable to.
- Complain to the Data Protection Board of India.
Start any of these from Your Data Rights. Withdrawing consent does not undo processing already carried out lawfully.
Grievance Officer
As required by section 13 of the DPDP Act, you can raise any concern about how your data is handled directly with our Grievance Officer:
Reshma Khatun
bayaan@consultancy.firm.in
We respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
Changes to this notice
If we change how personal data is used, this notice is updated and the date at the top changes. Material changes affecting face recognition will be surfaced in the app before they take effect.