LensBooth privacy policy and data safety commitments

1. Who We Are & Operator Identity

This Privacy Policy explains how LensBooth (LensBooth Official Website), operated by Kishan Naik ("Founder & Sole Operator", "Data Fiduciary", "Controller", "LensBooth", "we", "us", "our"), based in India, handles information when you use our website, virtual photo booth, and Studio creative tools.

This policy establishes a robust global privacy baseline and provides specific disclosures for jurisdictions including India (under the Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025), the European Economic Area & United Kingdom (under the GDPR & UK GDPR), the United States (including California and other applicable state privacy laws), Canada (under PIPEDA), and Australia (under the Privacy Act 1988).

Privacy & Data Rights Contact / Grievance Officer: Kishan Naik • support@lensbooth.app • LensBooth Contact Support Page

2. What We Collect & Why We Process It

We process only the minimum information necessary to operate, secure, and improve the service. Here is what we process and why:

3. What LensBooth Does NOT Collect or Store

• No Mandatory Accounts: You do not need to sign up, log in, or provide an email address or password to use the camera, photo booth, or Studio creative tools. Google Login is completely optional.
• No Google Token or External Drive Access: When you choose to sign in with Google, we never collect or store passwords, Google access tokens, Google refresh tokens, or ID tokens. We never request or access Google Drive, Google Photos, contacts, or any other Google services, and we make no API calls to Google after authentication.
• No Permanent Server Storage of Guest Photos: Photos you take as a guest in Solo Booth, Instant Cards, Duo Booth, or LensBooth World are processed on your device and saved directly to your local downloads. We never keep a server copy of guest photos (except the temporary 3-minute in-app browser save described in Section 4 below). Only if you choose to sign in and save strips to your account are your finished strips saved in your private cloud gallery.
• No Continuous Microphone Listening: Microphone permissions are requested solely for active audio recording when you explicitly click the record button in Studio Cassette or Tiny Radio, or when you switch on live voice chat in Duo Booth, Build Together, or LensBooth World. LensBooth never listens in the background or records ambient audio.
• No Biometric Templates or Facial Recognition: LensBooth does not extract facial geometry, create biometric templates, or perform facial recognition. Camera frames and background effects are processed strictly as visual pixels in local device memory.
• No AI Model Training on User Content: LensBooth does NOT use your captured photos, video frames, photo strips, letters, voice recordings, or transcripts to train artificial intelligence or machine learning models. Automated audio screening evaluates Tiny Radio voice messages strictly in temporary memory for safety compliance and discards the transcript immediately.
• No Raw IP Address Tracking in Statistics: While our edge infrastructure necessarily processes technical network connection data (such as IP addresses) in transit for essential DDoS mitigation, abuse prevention, rate limiting, and network delivery, we do not log or store raw visitor IP addresses in our website statistics database.
• No GPS Location Tracking: We do not collect, request, or track your real-world GPS or physical device coordinates. Cities in LensBooth World are virtual artistic 3D scenes.
• No Payment or Card Details: LensBooth is a free web app and does not collect or process credit cards, bank accounts, or financial data.
• No Ad Targeting from Camera Pixels or Voice: LensBooth never accesses, scans, analyzes, or shares camera video feeds, photo pixels, or voice audio waveforms for advertising or profile targeting.

4. Camera & Microphone Access, Live Isolation & Media Processing

LensBooth requests camera permissions and microphone permissions strictly to deliver creative photo and audio features while you are actively in a session:

• Solo Booth & Instant Cards: Camera frames remain entirely inside your device. Photo strip layout, instant card typography, stickers, filters, and rendering happen locally on your computer or phone. In standard browsers (such as Chrome, Safari, Firefox, or Edge), your photos are never sent to our servers. The finished strip is saved straight from your browser to your local device storage.
• On-Device AR & Background Segmentation: When using virtual backdrops, background blur, or green screen effects, camera frames are processed directly on your device inside your web browser. Your video frames and background cutouts never leave your device.
• Microphone Permissions & Audio Keepsakes: Microphone access is requested only when you choose to record voice in Studio Cassette, broadcast on Tiny Radio, or turn on live voice chat in Duo Booth, Build Together, or LensBooth World. Audio is recorded or transmitted only while actively engaged by you.
• Strict Live Isolation: Active camera feeds, capture countdowns, microphone recordings, and real-time video streams are 100% private and ad-free. Google AdSense ads and the offerwall appear only on browsing pages, articles, Studio tools, or post-capture result screens once photo or audio processing is complete. Media streams are never accessible to Google or any advertising network.
• Studio Keepsakes Storage & 30-Day Auto-Purge: When you share a Studio Letter or Studio Cassette, the assets are stored in secure cloud storage under private unguessable links, ensuring they cannot be crawled, guessed, or discovered. All shared Letters and Cassette recordings are automatically and permanently deleted after 30 days by automated background cleanup tasks. Tiny Radio broadcasts are public by design and stay on the air until listener reports or moderation take them down; you can also ask us to remove your own message at support@lensbooth.app.
• Saving inside an In-App Browser (Temporary 3-Minute Transit): When you open LensBooth from a link inside another app (such as Instagram or Facebook), restricted in-app browsers often cannot save files directly to your device storage. To allow saving in those environments, the finished photo strip is uploaded temporarily to our server under a one-time random link. It is automatically deleted after 3 minutes (180 seconds), and is never linked to your identity, never reviewed, and never used for any other purpose.
• Duo Booth (Multiplayer): Video is streamed directly between you and your friend (peer-to-peer) across your devices without passing through server recording. During countdowns, temporary low-resolution previews are held briefly in temporary memory solely to synchronize dual-camera captures. These previews expire automatically on a fixed 3-minute timer and are never retained.
• Studio Build Together (3D Scene Design & Voice Chat): Build Together allows two participants to design a 3D scene collaboratively in real time. Optional voice chat connects directly between participants without being recorded on our servers. Participants can upload up to 6 custom photos per scene for picture frames or wallpaper finishes. All uploaded photos, scene coordinates, and session state are held in temporary session storage and are automatically and permanently purged 1 hour after both users leave.
• LensBooth World (3D Virtual Cities & Group Exploration): LensBooth World allows you and up to six friends to explore 3D cities, customize 3D avatars, talk over live voice chat, and take photo strips together at landmark booths. Your avatar look is stored locally on your device. City movement and real-time interactions are shared only with participants in your active session and are never recorded. Voice chat streams directly between participants. Any photo strips you create are processed locally in your browser, and all session data is automatically and permanently purged 1 hour after all participants leave.

5. Voluntary Community Spotlight Submissions

LensBooth allows users to optionally submit their finished photo strips to be featured on our public Community Spotlight showcase:

• Entirely Voluntary: Submitting a photo strip is completely optional and is never required to use LensBooth.
• Information Submitted: The photo strip image itself and an optional display name or nickname of your choice (no email or account required; external links are disallowed).
• Permissions & Age Requirement: When submitting, you confirm that you are at least 18 years old and that everyone appearing in the photo has granted explicit, unambiguous consent to have their likeness displayed publicly.
• Human Moderation: All submissions are reviewed by a human moderator before appearing on the website to ensure safety, authenticity, and community appropriateness.
• Prompt Removal & Takedowns: If you or anyone appearing in a featured photo strip wants it removed, email us at support@lensbooth.app or use our Contact Page. We review and remove verified requests promptly.

6. Third-Party Service Providers & International Data Transfers

We work with trusted infrastructure providers to host, secure, and operate LensBooth. Because our service relies on global cloud infrastructure, your information may be processed on secure servers located outside your country of residence (including in the United States and other global data center locations).

7. Cookies & Browser Storage

LensBooth uses browser storage to provide essential functionality and, only with your explicit permission, analytics and advertising:

• Essential Functionality: Used locally in your browser to generate photo strips, handle camera frames, and remember your cookie preferences. These are necessary for the website to work.
• Account Authentication (Optional): If you choose to sign in with Google, a secure authentication cookie is created to maintain your login session. It expires automatically after 30 days.
• Guest Device Storage: Used in your browser to temporarily keep photo strips on your device during guest use so you can easily migrate them if you later choose to sign in.
• Privacy by Default: Optional analytics cookies are strictly blocked by default on your first visit and remain blocked unless you explicitly choose to accept them. Until you accept, Google AdSense shows only non-personalized ads; Google may still use cookies or similar identifiers for these ads to limit repeats, count impressions, and prevent fraud.

You can review, change, or withdraw your cookie consent at any time by clicking Cookie Preferences in the website footer.

If you visit from the European Union or European Economic Area, the United Kingdom or Switzerland, your consent for analytics and advertising is collected through Google’s certified consent message (a Google-certified consent management platform) instead of the LensBooth banner. We load Google Analytics and Microsoft Clarity only if you agree there to storing information on your device and to measurement, and Cookie Preferences reopens that message so you can change your choice.

8. How Long We Keep Information (Retention Schedule)

We follow strict data minimization principles and retain information only as long as necessary for the purpose for which it was processed:

9. Security Safeguards & Incident Management

We employ modern technical and organizational safeguards to protect user interactions:

• Encryption in Transit: All web traffic is encrypted using industry-standard HTTPS encryption.
• Application Protection: Strict Content Security Policies and modern security headers are enforced across all web pages to prevent malicious scripts, tampering, or unauthorized embedding.
• Automated Abuse Defense: Edge rate limiting and firewalls protect the service against automated abuse, brute-force attacks, and denial-of-service attempts.
• Incident Response: If a personal data breach occurs that creates a risk of harm, we maintain an incident response process to contain the event, investigate root causes, and notify affected users and supervisory authorities (such as the Data Protection Board of India or relevant global regulators) in accordance with statutory timelines.
• While we implement industry-standard safeguards, no method of electronic transmission or cloud storage is 100% impenetrable, and absolute security cannot be guaranteed.

10. Global Privacy Baseline & User Rights

Regardless of your geographic location, LensBooth provides the following practical privacy controls:

• Self-Service Account & Data Deletion: You can permanently delete individual photo strips or delete your entire LensBooth account and all associated cloud data at any time directly in your Profile Settings ("Delete account"). Deletion is immediate, permanent, and removes all of your account information and cloud-saved photos. Deleting your LensBooth account deletes all data held by LensBooth and does not alter or delete your Google Account.
• Right to Access & Summary: You can request a summary of the personal data we hold about you by emailing us.
• Right to Correction: You can request updates or corrections to any inaccurate information you have provided.
• Right to Withdraw Consent: You can change or withdraw your consent for optional analytics and advertising cookies at any time via Cookie Preferences in the footer.
• Right to Content Removal (Takedown): If your likeness appears in any featured Community Spotlight photo strip, you can request immediate removal via support@lensbooth.app or our Contact Page.
• Right to Grievance Redressal: You have the right to direct any privacy concern, inquiry, or complaint directly to our designated contact for prompt review.

11. Notice for Users in India (DPDP Act, 2023 & DPDP Rules, 2025)

For individuals located in India, the processing of your digital personal data is governed by the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025:

• Data Fiduciary: Kishan Naik, Founder & Sole Operator of LensBooth, India. Email: support@lensbooth.app.
• Notice & Consent: When you voluntarily sign in with Google, submit feedback, or submit a photo strip, this policy serves as the statutory notice describing the specified purpose of processing. Processing occurs either on the basis of your freely given, specific, informed, and unambiguous consent, or for legitimate uses specified under Section 7 of the DPDP Act (such as responding to voluntary inquiries and feedback).
• Data Principal Rights: Under the DPDP Act, you have:
  • The Right to Access information about personal data processed and a summary of processing activities;
  • The Right to Correction and Erasure of personal data that is inaccurate, incomplete, or no longer necessary for the purpose;
  • The Right to Grievance Redressal through our Grievance Officer;
  • The Right to Nominate another individual to exercise your rights in the event of death or incapacity.
• Children's Personal Data: LensBooth does not knowingly process personal data of children under 18. We do not track or behaviorally monitor children, nor do we serve targeted ads to minors. Features that save personal data (sign-in, Tiny Radio broadcasts, Studio Letters and Cassettes, Community Spotlight) are 18+.
• Grievance Redressal Timeline: As required under the DPDP Rules, 2025 and IT Intermediary Rules, 2021, all privacy grievances and takedown requests submitted to our Grievance Officer will be acknowledged within 24 hours and redressed within 15 days (or within 72 hours for urgent content takedowns involving non-consensual imagery).
• Recourse to the Data Protection Board of India: If you are not satisfied with the resolution of your grievance by our Grievance Officer, you have the right to file a complaint before the Data Protection Board of India (DPBI) in the manner prescribed under the DPDP Act and Rules.

12. Notice for Users in the European Economic Area (EEA) & United Kingdom

If you are located in the European Union / European Economic Area or the United Kingdom, the processing of your personal data is governed by the EU General Data Protection Regulation (GDPR) or the UK GDPR / Data Protection Act 2018.

• Your Data Subject Rights: Under Articles 15-22 of the GDPR and UK GDPR, you have the right to request access to, rectification of, or erasure of your personal data; the right to restrict or object to processing; the right to data portability; and the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• International Transfers: Personal data is transferred to and processed in India, the United States, and other global edge locations where our service providers operate. Transfers rely on European Commission-approved Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum, supplemented by technical safeguards including HTTPS encryption in transit and data minimization.
• Supervisory Authority Recourse: You have the right to lodge a complaint with an EU Member State Data Protection Authority (Supervisory Authority) or the UK Information Commissioner's Office (ICO) (ico.org.uk) if you believe our processing infringes applicable data protection law.

13. Notice for Users in the United States (California & State Privacy Laws)

This section provides disclosures for residents of California (under the California Consumer Privacy Act / California Privacy Rights Act - CCPA/CPRA) and other US states with comprehensive privacy legislation (such as Colorado, Connecticut, Virginia, Utah, Texas, and Oregon):

• Categories of Personal Information Collected: In the preceding 12 months, LensBooth has collected:
  • Identifiers: Google account identifier, email address, display name, avatar URL (only when you choose to sign in); anonymous cookie/consent identifiers;
  • Internet or Network Activity: Interactions with our website, pages viewed, browser/device type (only when optional analytics cookies are accepted);
  • User-Generated Content: Saved photo strips (if you create an account) and community spotlight submissions (if voluntarily submitted);
  • Inferences: None. LensBooth does not create consumer profiles.
• No "Sale" or "Sharing" of Personal Information: LensBooth does not sell your personal information for monetary consideration. LensBooth does not share your personal information with third parties for cross-context behavioral advertising unless you have explicitly accepted advertising cookies.
• No Sensitive Personal Information Misuse: LensBooth does not collect or process sensitive personal information (such as government IDs, financial accounts, precise geolocation, racial origin, or genetic/biometric data) to infer characteristics.
• Your State Privacy Rights: Depending on your state of residence, you may have the right to:
  • Know & Access the categories and specific pieces of personal information collected;
  • Delete personal information held by LensBooth (available instantly via Profile Settings);
  • Correct inaccurate personal information;
  • Opt Out of targeted advertising or profiling via our Cookie Preferences manager;
  • Non-Discrimination: We will never discriminate against you, deny services, or provide a different quality of service for exercising your privacy rights.
• Do Not Track & Global Privacy Control (GPC): If your browser transmits a Global Privacy Control (GPC) or Do Not Track signal, LensBooth treats it as if you chose “Reject Non-Essential”: analytics stay blocked, Google AdSense shows only non-personalized ads, and the cookie banner is not shown. You can still opt in at any time via Cookie Preferences.

14. Canada, Australia & International Frameworks

• Canada (PIPEDA): Personal information is collected, used, and disclosed in accordance with the 10 Fair Information Principles under the Personal Information Protection and Electronic Documents Act (PIPEDA). Canadian users may request access, correction, or deletion, or contact the Office of the Privacy Commissioner of Canada (OPC).
• Australia (Privacy Act 1988): We handle personal information consistently with the Australian Privacy Principles (APPs). Where personal information is processed overseas by cloud providers (APP 8), reasonable steps are taken to ensure recipient infrastructure upholds comparable security safeguards. Australian users may also contact the Office of the Australian Information Commissioner (OAIC).
• Brazil (LGPD - Law 13.709/2018): Brazilian users may exercise rights under Article 18 of the LGPD (access, confirmation, correction, anonymization, deletion, portability, consent revocation) and direct inquiries to our contact address or the National Data Protection Authority (ANPD).
• Singapore (PDPA 2012): We comply with the consent, purpose limitation, notification, access, correction, accuracy, protection, and retention limitation obligations under the Personal Data Protection Act.
• Japan (APPI) & South Korea (PIPA): Cross-border data processing is conducted with appropriate organizational and technical safeguards, and users may exercise statutory access and deletion rights at any time.

15. Children's Privacy & Age Policy

• General Platform Use (13+): LensBooth is a general-audience service for users aged 13 and older and is not directed to children under 13. The photo booth processes your photos on your own device and does not save them to our servers. We do not knowingly collect personal information from children under 13 (COPPA, GDPR Article 8, DPDP Act).
• Features That Save Personal Data (18+): Google sign-in and saving strips to your cloud gallery, Tiny Radio broadcasts, Studio Letters, Studio Cassettes, and Community Spotlight submissions are only for users aged 18 and older. Under the DPDP Act, anyone under 18 is a child whose personal data needs verifiable parental consent, so we do not offer these features to minors. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we delete it. Contact support@lensbooth.app if you believe this has happened.
• Zero Tolerance for Child Harm: We maintain strict zero tolerance for Child Sexual Abuse Material (CSAM) or any exploitation of minors. Any detected abusive imagery is immediately purged and reported to the National Center for Missing & Exploited Children (NCMEC) and relevant cyber crime law enforcement authorities.

16. Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect service enhancements, new features, or changes in applicable legal frameworks. When updates occur, the revised document will be posted on this page with an updated "Effective Date" and version number. Continued use of LensBooth after changes are published constitutes acknowledgment of the updated policy.

17. Grievance Redressal, Contact & Inquiries