Privacy and face data
DotUtsav uses face recognition to give event guests their own photos. That means we handle biometric data, so this page states plainly what is collected, why, how long it is kept and how to have it removed. Last updated 22 July 2026.
Who is responsible
DotUtsav is operated by DotTut, India. For anything on this page, including a request to delete data, contact admin@dotutsav.com or message +91 87784 45463.
Under India's Digital Personal Data Protection Act, 2023, the event host (the photographer or the family running the event) is the Data Fiduciary for their guests' data. DotUtsav acts as the Data Processor on their instructions, and processes that data only to run the service described here.
What we collect
If you hold an account
- Your name, email address and, if you enter one, your business name and phone number.
- A password, stored only as a salted hash. We never see it.
- Your events, the photos you upload, and storage usage figures.
- Records of computers you pair with the desktop app: a device name, timestamps and a hashed token. Never your password.
If you are a guest at an event
- A selfie you choose to take, used to find your photos. Taking it is entirely optional: you can browse or leave without one.
- A face embedding derived from that selfie: a list of numbers describing facial geometry. It cannot be turned back into a photograph of you. This is biometric data and is treated as sensitive.
- A record that you gave consent, and when.
- A cookie on your device so the gallery remembers you between visits. It identifies a guest session for one event, and carries no advertising or tracking purpose.
Why, and on what basis
Guest face data is processed only on your consent, which you give explicitly before taking a selfie, and only to match you to photographs within that single event. It is never used to identify you at a different event, never sold, never shared with advertisers, and never used to train models for anyone else. Guests who do not opt in are not matched at all.
How long it is kept
- Face data is kept for a retention window the event host sets, 30 days after the event by default, and is then purged automatically.
- Event photos are kept while the host keeps the event. Deleting an event deletes its photos, its guests and their face data.
- Account data is kept while the account exists.
Where it is stored
On servers located in Mumbai, India. Photos and face data do not leave India. Traffic to and from the site is encrypted in transit (HTTPS), and face embeddings are stored in the same database as the event, not with any third party.
Who else sees it
The event host and anyone they authorise can see photos from their own event. Other guests may see photos of you only if the host has set that event to a browsable gallery; otherwise a guest sees only photos they appear in. We use no advertising networks, no analytics brokers, and no third-party trackers.
Your rights
Under the DPDP Act you may:
- Ask what data we hold about you, and get a copy.
- Have it corrected if it is wrong.
- Withdraw consent and have your face data deleted, at any time and without giving a reason.
- Nominate someone to act for you if you are unable to.
- Raise a grievance with us, and escalate to the Data Protection Board of India if we do not resolve it.
Write to admin@dotutsav.com. We answer requests within 30 days, and deletion requests are actioned as soon as we can verify who is asking.
Children
DotUtsav is not directed at children, and accounts are for adults. Weddings and family functions inevitably include children in photographs. We do not knowingly build face profiles of children: a child should not register a selfie, and a parent or guardian who finds one should contact us and we will remove it.
If something goes wrong
If a breach affects your personal data, we will notify affected users and the Data Protection Board of India as the Act requires.
Changes
If this policy changes in a way that affects how your data is handled, the date at the top changes and account holders are told.