Privacy Policy

Effective date: 31 October 2026 · Version 2.4

1. Who is responsible

tratti.ai is operated by Alexander Ellul, a self-employed sole trader established in Malta (Fairwinds PH A14, Tumas Galea Street, Luqa, Malta) ("tratti", "we", "us"). We are the data controller for personal data processed on tratti.ai, except for the photographer's own galleries as explained in section 3a. Contact: [email protected], +356 79260967. We have not appointed a Data Protection Officer, as we are not required to; privacy enquiries go directly to the contact above.

2. The short version

We sell event photos. To help you find yours, we use AI face-matching — that involves biometric data, and we only process yours with your explicit consent. Selfies used for a one-off search are deleted as soon as the search completes. Faces in event photos are indexed so participants can find themselves; you can have your photos removed or excluded at any time, free of charge. We never sell your data, and we never use your face data for anything except finding your photos.

3. What data we process

Visitors and buyers

  • Account data: name, email, password (hashed), email-verification status, or your social-login identifier if you sign in with a social provider.
  • Purchase data: cart contents, orders, any remaining token balance, promo codes used, downloads, and favourites (kept only in your own browser). Card details are handled by Stripe and never touch our servers.
  • Face search data: see section 4 — this is the most important section of this policy.
  • Consent records: when you give a consent or accept an agreement on the site, we store what you accepted, the version, your IP address and the time — we are legally required to be able to demonstrate consent.
  • Technical data: IP address, browser type, and server logs kept for security. We also keep short-lived counts of face searches per account and per IP address to prevent abuse.
  • Booking enquiries: if you use the "Book" form on a photographer's page, your name, email and message are emailed to that photographer so they can reply. We don't keep a separate copy in our database.

Photographers and organisers

  • Account and approval data, sales and payout records, payout account details, and payout receipts.
  • Plan and billing data: plan, renewal dates, photo usage, top-ups, plan credit, and your Stripe customer and subscription references.
  • If you connect a Stripe account: its reference and status. Stripe handles your identity checks and bank details; we don't receive them.
  • Public page and branding: address, name, bio, location, links, avatar, cover photos, logo and watermark settings. Your page and what you publish on it are public.

Event organisers listed from public sources

  • Some events on tratti.ai are imported automatically from public event-listing platforms (currently CompetitionCorner, Circle21, ATHX Games, Races Calendar and HYROX). For these events we store and display the event's public details together with the organiser's name and public business contact details (email address, website) as published on the source listing, so that visitors can discover events and contact the organiser. We rely on our legitimate interest in operating an event directory (Art. 6(1)(f)). We do not use these contact details for marketing and never create an account from them. If you are an organiser and want your listing or contact details corrected or removed, email [email protected] — we action such requests promptly.

Event participants who receive organiser emails

  • An event organiser may give us the email addresses of people who took part in their event, so they can tell them when the photos are online. For these emails the organiser is the controller and is responsible for having your permission to email you; we act as their processor and send the email on their behalf. We store your email address (encrypted) and whether each email was delivered, bounced or reported as spam. We never use these addresses for our own marketing and never share them with other organisers. See section 14.

People appearing in event photos

  • Photos and videos uploaded by photographers — or, on private events that allow it, by other attendees — may show you even if you never visit this site. We process these images, including face indexing, as described in sections 4 and 8.

3a. A photographer's own galleries

Photographers can run their own galleries and events on tratti.ai. For the photos in those galleries, including indexing the faces in them, the photographer is the data controller and decides what to publish and who can see it; we act as their processor under a data processing agreement. Your requests about those photos can come to us or to the photographer, and we will help either way. Your rights in section 8 apply to them too. We remain the controller for your account, your purchases through tratti and your selfie searches.

When a photographer on a paid plan is the seller, your payment goes to their own Stripe account. They and Stripe receive your email address and payment details for that order, and they become an independent controller of that data.

4. Face recognition (biometric data)

Our "Find my photos" feature is an AI system that uses facial recognition, provided by Amazon Web Services (AWS Rekognition, region: eu-central-1, Frankfurt, EU). Facial templates are biometric data, a special category of personal data under Article 9 GDPR. We process them only as follows.

a) One-off selfie search

When you upload a selfie, we ask for your explicit consent before processing. Your selfie is converted into a numerical face template and compared against faces indexed from event photos; results are limited to what you chose to search (one album or gallery, one event, or one photographer's public albums; never private galleries in that last case) and shown with confidence scores. Your selfie is deleted as soon as the search completes, and the face template derived from it is used transiently for the comparison only — it is never stored. So that repeating the same search doesn't run it again, we keep the list of matched photos and a one-way hash of your selfie (not the selfie, and not a face template) for 5 minutes, and for galleries offering a bundle we keep the list of matched photos in your session so the bundle covers the right ones. Match results are suggestions produced by an AI system and may contain errors.

b) Saved selfie and match alerts (optional)

You can choose — via a separate opt-in — to save your selfie to your account. If you do, we store the selfie and compare newly uploaded event photos against it so we can email you when new photos of you appear (no face template is stored; each comparison derives it transiently from your saved selfie). You can withdraw this consent at any time by deleting your saved selfie in account settings; the selfie is deleted immediately and match alerts stop immediately.

c) Face indexing of event photos

When a photographer — or, on private events where the organiser has enabled attendee uploads, another attendee — uploads photos, faces detected in the photos are indexed so that the people photographed can find their own images. This index maps face templates to photos; it is not linked to names or identities of the people in the photos. We rely on our legitimate interest (and that of participants, organisers and uploaders) in making event photos findable by the people in them — a documented balancing assessment is on file. Attendees who upload must first confirm they have the right to share the photos and that the people shown are aware they will be visible to the event's attendees. On private events, photos are only visible to people who have access to that event. Safeguards: only you can search for your own face (with your consent, section 4a); the index is used for no other purpose; face records are deleted when a photo, album or event is removed; and you can object and have your face excluded at any time (section 8).

d) What we never do

We do not use face data for advertising, profiling, identity verification, or training AI models; we do not sell or share it except with AWS as our processor; and we do not allow anyone to search for photos of other adults.

e) Minors

Face search requires users to be 16 or older. A parent or legal guardian may search using a photo of their own child under 18. Event organisers are contractually required to obtain appropriate parental consents for events involving minors.

5. Purposes and legal bases

  • Providing the marketplace (accounts, cart, checkout, delivery, downloads) — performance of a contract (Art. 6(1)(b)).
  • Face search and saved selfies — your explicit consent (Art. 9(2)(a) with Art. 6(1)(a)).
  • Face indexing of event photos — legitimate interests (Art. 6(1)(f)), with the safeguards in section 4c; for the biometric element we additionally apply the measures described there and honour objections without requiring justification.
  • Order and match-alert emails — contract performance and consent respectively.
  • Payouts to photographers/organisers — performance of a contract.
  • Tax and accounting records — legal obligation (Art. 6(1)(c)).
  • Imported event listings and organiser contact details — legitimate interests (Art. 6(1)(f)); see section 3.
  • Organiser emails to participants — the organiser's own lawful basis (usually your consent given at registration); we process the addresses on the organiser's instructions (Art. 28).
  • Keeping a list of addresses that unsubscribed, bounced or reported spam — legal obligation and legitimate interests (Art. 6(1)(c) and (f)), so that we can honour your opt-out permanently.
  • Security, fraud prevention, logs — legitimate interests (Art. 6(1)(f)).

6. Processors and recipients

  • Amazon Web Services — photo/video storage (S3), face matching (Rekognition), video transcoding (MediaConvert). Region: eu-central-1 (Frankfurt, EU).
  • Stripe — payment processing, plan billing and connected accounts for photographers selling directly. Stripe is an independent controller for some payment data; see Stripe's privacy policy.
  • Hetzner — server hosting (Germany/EU).
  • Amazon Web Services (Amazon SES) — email delivery for order, account and organiser emails. Region: eu-central-1 (Frankfurt, EU).
  • Zoho Mail — our support mailbox (replies you send us).
  • Photographers see sales data for their own albums, and booking enquiries sent to them; organisers see aggregate sales statistics for their events. Neither receives your face data.

All processors are bound by data processing agreements. Where any processing occurs outside the EEA (e.g. some Stripe or Zoho operations), transfers are protected by the EU–US Data Privacy Framework or EU Standard Contractual Clauses.

7. How long we keep data

  • One-off search selfies: deleted as soon as the search completes (a daily automated sweep additionally removes anything left behind by errors within 24 hours). No face template is retained.
  • Saved selfies: until you delete them or your account.
  • Event photo face indexes: while the album is on sale; face records are deleted when the photo, album or event is removed.
  • Account data: until account deletion (see our Data Deletion Policy).
  • Purchase and payout records: retained as required by Maltese tax and accounting law (up to 10 years), with personal data minimised where possible.
  • Consent and acceptance records: for as long as needed to demonstrate compliance.
  • Imported event listings: while the event remains listed; organiser contact details are removed on request.
  • Organiser contact lists and email recipients: 12 months after the end of the event they relate to, then deleted automatically; earlier if the organiser deletes the list or closes their account, or if you ask us to erase your address.
  • Unsubscribe, bounce and spam-report list: kept permanently, but only as a one-way hash of your email address (not the address itself), so we can make sure you are not emailed again.
  • Backups: up to 90 days after deletion from active systems.
  • Server logs: application logs 14 days; web-server access logs up to 30 days.

8. If you appear in event photos

Photographers warrant that they were authorised to photograph the event, and organisers are required to notify participants that photos will be published here and that faces are indexed for self-search. Regardless of that, you can at any time, free of charge and without giving reasons:

  • have specific photos of you removed from the site; or
  • have your face excluded from face-search indexing while the photos remain.

Email [email protected] with links to the photos (or event details plus a description). We action removal requests within 30 days at the latest, usually much faster. For photos of minors, a parent or guardian may make the request.

9. Cookies

  • Strictly necessary cookies — session, authentication, cart (including any bundle), CSRF protection, and event-password unlock. No consent needed.
  • Browser storage — your favourites and recent search matches stay in your own browser, to make the album page work. They aren't sent to us as analytics.
  • Organiser referral cookie — if you arrive via an organiser's referral link, we remember that referral so the organiser is credited with commission on your purchases. For your current visit this is kept in your session; a 30-day cookie is stored only if you accept cookies in the cookie banner.

We use no analytics or advertising cookies. You can change your cookie choice at any time via the cookie settings link in the footer.

10. Your rights

Under the GDPR you can: access your data (Art. 15); correct it (Art. 16); have it erased (Art. 17); restrict processing (Art. 18); receive it in portable form (Art. 20); object to processing based on legitimate interests, including face indexing (Art. 21); and withdraw any consent at any time without affecting prior processing (Art. 7(3)). Exercise any right via [email protected] — we respond within one month. We may need to verify your identity first.

You may lodge a complaint with the Information and Data Protection Commissioner (IDPC), Malta (idpc.org.mt), or with the supervisory authority of your country of residence.

11. Security

Data is encrypted in transit (TLS) and at rest. Access to personal data is limited to the operator and processors under contract. Original (unwatermarked) files are stored privately and only delivered after purchase. Payment data is handled entirely by Stripe.

12. Children

Accounts and face search require a minimum age of 16. We do not knowingly collect data directly from younger children; photos of minors taken at events are handled under the safeguards in sections 4e and 8. Parents or guardians can request deletion of a child's data at any time.

13. Changes to this policy

We will announce material changes on the site before they take effect, and where a change requires fresh consent (for example, any new use of biometric data), we will ask for it explicitly — continued use alone will not be treated as consent to new biometric processing.

14. Emails from event organisers

If you took part in an event, its organiser may email you through tratti.ai when the photos are online. Each email names the organiser, explains why you are receiving it and goes out from our mail domain with replies going to the organiser.

  • Unsubscribe: every email has a one-click unsubscribe link. It stops emails from that organiser; the page that opens also lets you stop all organiser emails sent through tratti.ai. Unsubscribing never stops order or download emails for purchases you make.
  • Erasure: email [email protected] and we will remove your address from every organiser's list and block it from future organiser emails. We will let the organiser know if your request concerns their email.
  • Questions about why you were emailed: contact the organiser (reply to their email) — they decide who is on their list. You can also contact us.

15. Contact

Alexander Ellul trading as tratti.ai · Fairwinds PH A14, Tumas Galea Street, Luqa, Malta · [email protected] · +356 79260967