Privacy Policy

1. Introduction

PassSnap (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our passport photo service. We process personal data, including biometric data, in compliance with applicable privacy laws including GDPR, CCPA, and BIPA.

2. Information We Collect

2.1 Photos and Biometric Data

When you upload or take a photo using our service, it is transmitted to our secure servers where AI technology processes it to create your passport photo. This server-side processing involves analyzing facial geometry (biometric data) to:

• Detect and position your face correctly
• Remove the background
• Crop the photo to government specifications

2.2 Order Information

If you choose to order printed photos, we collect:

• Full name
• Email address
• Shipping address
• Phone number (optional)

2.3 Payment Information

We use Stripe for payment processing. We never receive, store, or process your credit card information. All payment data is handled directly by Stripe in compliance with PCI DSS Level 1. See Stripe's Privacy Policy.

3. How We Use Your Information

• To create and deliver your passport photos
• To process and fulfill print orders
• To send order confirmations and shipping updates
• To provide customer support
• To improve our service (anonymous analytics only)
• To detect and prevent fraud

4. Data Retention Schedule

5. Children's Privacy

For passport photos of minors:

• A parent or legal guardian must provide consent
• A parent or guardian must supervise the photo-taking process
• Parents may request deletion of their child's data at any time

If you believe we have collected information from a child without proper consent, please contact us immediately at support@passsnap.com.

6. Data Security

We implement industry-standard security measures to protect your information:

• All data transmissions are encrypted using TLS 1.3
• Photos are processed in memory and never written to disk
• Access to systems is restricted to authorized personnel only
• We regularly audit our security practices
• SOC 2 compliant infrastructure (Cloudflare, Stripe)

7. Third-Party Services

We use the following third-party services:

• Stripe — Payment processing (PCI DSS Level 1 compliant)
• Cloudflare R2 — Temporary photo storage for print orders only
• Sentry — Error tracking (with your consent, session replay data is anonymized)
• Resend — Transactional email delivery

8. International Data Transfers

PassSnap is based in the United States. If you are accessing our service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States.

For EU/EEA Users: We rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate protection for data transfers outside the EU/EEA.

9. Cookies and Tracking

We use cookies and similar technologies with your consent:

• Essential Cookies: Required for site functionality (always active)
• Analytics Cookies: Help us understand usage patterns (optional)
• Error Tracking: Help us fix bugs and improve reliability (optional)

You can manage your cookie preferences at any time through the cookie settings banner.

10. Your Privacy Rights

Depending on your location, you may have the following rights:

For All Users:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Withdraw consent at any time

For EU/UK Users (GDPR):

• Right to data portability
• Right to restrict processing
• Right to object to processing
• Right to lodge a complaint with a supervisory authority

For California Residents (CCPA/CPRA):

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale (we do not sell personal information)
• Right to non-discrimination for exercising your rights

For Illinois Residents (BIPA):

• We obtain informed consent before collecting biometric data
• Biometric data is never sold, leased, or traded
• Biometric data is destroyed immediately after use
• You may request information about our biometric data practices

11. Contact Us

If you have any questions about this Privacy Policy or our data practices:

12. International Users

For EU/EEA users, your data may be transferred to and processed in the United States. We ensure appropriate safeguards through Standard Contractual Clauses (SCCs) as approved by the European Commission.