Live Chilli
Privacy Notice
1. Who we are
Live Chilli (livechilli.com) is operated by Chilli. Contact: hello@livechilli.com.
2. Account data we process
When you sign up or use the Service, we may process:
- name and email;
- login data (password hash or Google account identifiers);
- FTP credentials we generate for your camera uploads;
- IP address, browser/user agent, and basic usage logs;
- terms acceptance (version, time, IP);
- project/gallery settings and operational stats needed to run the Service.
3. Why we process it
To create and secure your account, provide the Service, prevent abuse, send transactional email (such as confirmation), and meet legal obligations. Legal bases include contract performance and legitimate interests in operating a secure service. Where required, we rely on consent (for example certain cookies or optional communications).
4. Event photos and guests
Photos you upload and publish are processed to deliver your galleries. For that Content and for guests who appear in it, you are the controller. You decide what is published and who can access it. See the Terms of Service.
4a. Find me (guest face matching)
When a photographer enables Find me, Live Chilli builds a face index from gallery photos and may match a guest selfie. That is biometric processing. The photographer is the controller and must have a lawful basis to enable indexing; guests who search give separate explicit consent for their selfie. Enabling Find me also accepts the Data Processing Agreement.
- Data: the selfie (processed in memory, not stored), face embeddings derived from gallery photos (stored in
faces.jsonwhile Find me is on), and the guest's email plus consent record. - Purpose: to show the guest only the photos they appear in.
- Legal basis (guest search): explicit consent (Art. 9(2)(a) GDPR where applicable). Guests must be at least 16.
- Legal basis (gallery face index): the photographer's responsibility as controller; Live Chilli acts as processor under the DPA.
- Retention: selfies are not kept; the face index is deleted when the photographer turns Find me off; a browser cookie remembers consent for up to 30 days; consent audit logs are kept until you withdraw or the gallery is deleted.
- Withdrawal: use the one-click link in your confirmation email, the withdraw option in the gallery, or email hello@livechilli.com from the address you used.
- Email: we send a confirmation link to the address you provide; Find me starts after you confirm (link valid 24 hours). We then send a short record copy.
See the Data Processing Agreement for Art. 28 terms between photographers and Live Chilli.
5. Sharing
We use processors needed to run the Service (for example hosting, email delivery, authentication providers such as Google if you choose Google login). We do not sell your account data.
6. Retention
We keep account data while your account is active and for a reasonable period afterward for security, backups, and legal claims. Gallery Content follows your settings and our expiry/deletion practice.
7. Your rights
Depending on applicable law (including GDPR where it applies), you may have rights to access, correct, delete, restrict, or port account data, and to object to certain processing. Contact hello@livechilli.com. You may also complain to a supervisory authority.
8. Security
We apply technical and organisational measures appropriate to the Service. No method of transmission or storage is perfectly secure.
This notice is a practical draft. It is not legal advice. Have qualified counsel review it.