Pixamatch

Privacy Policy

Last updated: 20 October 2026

This policy explains what personal data Pixamatch collects, why, where it is kept, who helps us run the service, how long we keep it and what you can ask us to do with it. It covers the Pixamatch website, the studio and album designer, the desktop app, and the pages guests open (face search, client selection links and albums).

Who we are

Pixamatch is run by Pixamatch Private Limited (CIN U74209KL2026PTC105860), Door No. 309/B, Nadeeparambil, Thirumalabhagom P.O, Kuthiathodu, Alappuzha 688540, Kerala, India.

Contact and grievances: support@pixamatch.com, or WhatsApp +91 79944 99974. Write to us to use any of your rights below or to raise a complaint. We acknowledge a complaint within 24 hours and resolve it within 15 days. Our Grievance Officer's details are on the Contact page.

Pixamatch serves photographers and their clients in India.

Who this policy is about

  • Photographers and studios who hold a Pixamatch account (studio admins, team members and freelance designers).
  • Guests and clients who open a link a photographer shares: a guest who searches with a selfie, a client who picks photos on a selection link, or a client who reviews an album.
  • People who appear in event photos that a photographer uploads.

For event photos, the photographer decides what is uploaded and who gets the links. Pixamatch processes those photos on the photographer's behalf to run the service.

Account data

When you sign up or are added to a team we keep:

  • your name, username, email address and studio name;
  • your password, stored only as a scrypt hash — we never store or see the password itself;
  • your role (studio admin, team member or freelance designer) and the studio you belong to;
  • your credit balance, credit history, coupon codes you redeemed and the exports that used credits;
  • your plan, the marketplace looks you bought or sold, and the payments you made (see Payments below);
  • your settings (for example theme and accent).

We use this to sign you in, run your studio, charge exports and answer support messages. We send account email only: sign-up codes, password resets, and plan and payment email (receipts, renewal notices, failed payments and plan-ending warnings). No newsletters.

Payments

When you pay online, the payment is processed by Cashfree. You give your card, UPI or bank details to Cashfree, not to us: Pixamatch never sees or stores your full card number, CVV, UPI PIN or net banking password. Cashfree tells us the result: the amount, date and status, the payment method type (for example UPI or card) with the masked details it shares, the payment reference and, for automatic renewal, the mandate reference. We use this to switch on and renew your plan, send receipts and renewal notices, and answer payment questions. Cashfree handles payment data under its own privacy policy and the card industry's security standard (PCI DSS).

Event photos

Photographers upload event photos, or sync them from their Google Drive. We keep a compressed web copy and a thumbnail of each photo, and for photos uploaded through the album designer, the original file. Photos are stored on Cloudflare R2. Photo details such as capture time, camera model and file name are read from the file to order the album.

Photographers own their photos. We use them only to run the service for that photographer: face search, culling, album design and export.

Face data

When a photo is uploaded, Pixamatch finds the faces in it and turns each face into a set of numbers (a face template). A face template cannot be turned back into a photo.

  • Face templates are kept per photo set and are searched only inside that one photo set. A search never looks at another event, another photo set or another studio.
  • Face counts and face positions are also used to design albums (for example, to keep faces out of the fold or away from a crop edge).
  • When a photographer deletes a photo or a photo set, its face templates are deleted with it.

We do not use face data to identify people by name, to build profiles, or for any other purpose.

Guest selfies

A guest who opens a face-search link takes a selfie (or picks a photo of themselves). The selfie is compared with the face templates of that one photo set, and the matching photos are shown to the guest.

The selfie is used for that one search and deleted from our server as soon as the search finishes. It is never stored, never added to any photo set and never used to train anything. Guests need no account.

Client selection links and album reviews

A client who picks photos on a selection link or reviews an album gives us their choices (keep, skip, unsure, approvals, change requests and comments), and optionally a name, which the photographer sees.

How long we keep data

  • Photos, face templates and albums: kept for the studio's plan retention period — 180 days, or 365 days on the Pro plan — from the first upload to an event, to support culling, customer selection, album production, corrections and delivery. Photos may be deleted earlier when the studio closes the event, and are automatically deleted when the retention period ends unless continued retention is lawfully required; the studio is warned 30, 7 and 1 day before. When a studio's paid plan ends and is not renewed, its photos are deleted 45 days after the end date. Photos uploaded only in the album designer are kept until the photographer deletes them. Deleting a photo, a photo set or an event removes its photos from storage and its face templates from the search index.
  • Backups: we keep nightly backups of the database and the search index; the newest five are kept, so deleted data leaves the backups within about five days.
  • Payment records (payments, receipts and invoices): 8 years, as Indian company and tax law requires.
  • Accounts: kept while the account is active. Ask us to close yours and we delete it, except records we must keep by law (for example payment and credit records).
  • Error logs (the page, the error and the time): 30 days.
  • Help chat conversations: 90 days. Pixamatch staff read them to improve the help and answer tickets.
  • Support tickets: kept while needed to answer them.
  • Audit log (sign-ins and account changes, with the IP address): up to one year.

Cookies and browser storage

We use only what the service needs. There are no advertising or tracking cookies. Page views are counted by analytics software we host ourselves (Umami); it sets no cookies, keeps no IP addresses and cannot recognise you from one day to the next.

  • Sign-in cookie (studio accounts): keeps you signed in; httpOnly, 30 days, renewed each time you use Pixamatch.
  • px_review_browser (album review pages): remembers this browser so your album comments stay yours; 5 years.
  • Browser storage (localStorage): the name you typed on an album review (px_reviewer_name) and display preferences such as zoom, open panels and theme. It stays in your browser; clear it any time from the browser settings.

Service providers

We use these providers to run Pixamatch. They process data only to provide their service to us.

  • Cloudflare R2: storage of photos, thumbnails, exports and backups.
  • Google Drive (only if a photographer connects it): we read the folders the photographer chooses so their photos can be copied into Pixamatch. The access tokens are stored encrypted. Pixamatch's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
  • Cashfree: processes online payments and automatic renewal mandates (see Payments above).
  • Lark Mail: sends account email (sign-up codes, password resets, and plan and payment email).
  • AI models (DeepSeek, and models reached through OpenRouter): the Help chat sends your question and the account details it needs to answer (for example your albums and recent errors) to these models. No photos are sent. This happens only when you use the Help chat.

Security

Connections use HTTPS. Passwords are hashed, Google tokens are encrypted, and original files, graded spreads and reference albums are never served from public links. Studio data is visible only to that studio's members and Pixamatch staff who support it.

Your rights

Under India's Digital Personal Data Protection Act, 2023 you can ask us to:

  • tell you what personal data we hold about you and how we use it;
  • correct or update it;
  • erase it, when it is no longer needed or you withdraw consent;
  • hear a grievance about how we handled your data;
  • name a person to act for you if you cannot.

Write to support@pixamatch.com. If you are a guest and want to be removed from a photographer's photos, tell us the event or send us the link; we will work with the photographer to remove the photos or your face data. You may also contact the Data Protection Board of India.

For photographers: telling your guests

Photographers must tell guests that face search is available before sharing the link — for example with a short note next to the QR code at the venue — and must have the right to upload the photos. Photos of children must be uploaded only with a parent's or guardian's consent.

Children

Pixamatch accounts are for adults. We do not knowingly collect data from children except as part of event photos a photographer uploads on the terms above.

Changes

We will update this page when the service changes, and change the date at the top. For a change that matters, we will tell account holders by email or in the studio.

See also the Terms of Service, the Refund and Cancellation Policy and the Contact page.