Fotista

Privacy Policy

Last updated: 11 October 2026

Fotista ("we", "us") helps photography studios deliver event photos to their guests. Studios upload photos from an event; guests open the event link, take a selfie, and see the photos they appear in. This policy explains what data we collect, how we use it, where it is stored, and the choices you have. It applies to fotista.com, the studio console, and the Fotista photographer app.

1. Who uses Fotista

  • Studios (owners and their photographers) create events, upload photos, and connect their own Google Drive to store them.
  • Guests open an event link shared by a studio to find and download their photos.

2. Information we collect

Account information

  • When you sign in with Google (scopes openid, email, profile): we store your name, email address, and Google account ID. We do not store your profile picture.
  • When a studio account is created with email and password: name, email, phone number (if provided), and a securely hashed password.
  • Studio profile details the studio enters: studio name, logo, address, GSTIN, social handles.

Selfies and face data

  • When you take a selfie to find your photos, we process the image to create a face embedding — a list of numbers describing facial features. We use it only to find matching photos in the event you opened.
  • We do not store your selfie image. It is processed in memory and discarded. If you are signed in, the face embedding is saved to your account so you do not need a new selfie for each event; you can ask us to delete it at any time.
  • Face embeddings of people in event photos are generated on our servers so guests can be matched. They are never sold, shared, or used for advertising, identification outside the event, or training models.

Event photos

Photos uploaded by studios, along with basic metadata (file name, size, camera model, photographer, upload time).

Technical data

IP address, browser type, and request logs used for security, debugging, and abuse prevention. We do not use advertising or third-party tracking cookies. We use a session cookie to keep you signed in.

3. Google user data

Google Sign-In

We use your Google name, email, and account ID only to create and sign in to your Fotista account and to show who is signed in. Guest sign-in does not request access to your Google Drive or any other Google data.

Google Drive (studios only)

Studios can connect their own Google Drive so event photos are stored in the studio's account instead of ours. We request the drive.file scope, which only lets Fotista access files and folders that Fotista itself creates. We cannot see, read, or change any other files in your Drive.

  • We create a Fotista folder with original and thumbnail sub-folders organised by event and function.
  • We upload event photos and thumbnails there, read them back to show them in the studio console and to guests who appear in them, and delete them when the studio deletes photos or the event's retention period ends.
  • OAuth tokens are encrypted at rest and used only to perform these actions. A studio can disconnect Drive at any time from Settings → Storage or from Google account permissions.

Limited Use

Fotista's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, use it to train AI or machine-learning models, or allow humans to read it except with your consent, for security purposes, or where required by law.

4. How we use information

  • To provide the service: run events, store and deliver photos, and match guests to photos.
  • To secure accounts, prevent abuse, and troubleshoot problems.
  • To send service emails such as verification codes and password resets.
  • To comply with legal obligations.

We do not sell personal data and do not use it for advertising.

5. Where data is stored

  • Photos and thumbnails: in the studio's own Google Drive.
  • Uploads in transit: briefly in Amazon S3 while being transferred, then deleted once the photo reaches Google Drive.
  • Accounts, event data, and face embeddings: on our servers hosted on Amazon Web Services.

Data is encrypted in transit (HTTPS) and access is restricted to authorised systems.

6. Sharing

We share data only:

  • Between a studio and its guests as needed to deliver photos (for example, a guest sees the photos they appear in).
  • With service providers that run the service for us (Google for sign-in and Drive storage, Amazon Web Services for hosting, our email provider), under their own privacy terms.
  • When required by law or to protect the rights and safety of users.

7. Retention and deletion

  • Event photos are kept for the studio's retention period (60 days after the event by default) and then deleted, along with the event's face data. Studios can delete photos earlier.
  • Temporary upload copies are deleted from S3 as soon as they reach Google Drive.
  • Your saved selfie embedding is kept until you ask us to delete it or delete your account.
  • To delete your account or saved face data, email support@fotista.com from the address on your account. We complete requests within 30 days.

8. Your rights

You can ask to access, correct, export, or delete your personal data, or withdraw consent for face matching, by emailing support@fotista.com. If a studio uploaded a photo of you and you want it removed, contact that studio or us and we will help.

9. Children

Fotista accounts are not intended for children under 13. Children may appear in event photos uploaded by studios; parents or guardians can request removal by contacting us.

10. Changes

We may update this policy. We will change the "Last updated" date above and, for significant changes, notify studios by email.

11. Contact

Fotista, India — support@fotista.com. See also our Terms of Service.