LensBooth privacy policy and data safety commitments

1. Who We Are & Operator Identity

This Privacy Policy explains how LensBooth (LensBooth Official Website), operated by Kishan Naik ("Founder & Sole Operator", "Data Fiduciary", "Controller", "LensBooth", "we", "us", "our"), based in India, handles information when you use our website and virtual photo booth services.

This policy establishes a robust global privacy baseline and provides specific disclosures for jurisdictions including India (under the Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025), the European Economic Area & United Kingdom (under the GDPR & UK GDPR), the United States (including California and other applicable state privacy laws), Canada (under PIPEDA), and Australia (under the Privacy Act 1988).

Privacy & Data Rights Contact / Grievance Officer: Kishan Naik • support@lensbooth.app • LensBooth Contact Support Page

2. What We Collect & Why We Process It

We process only the minimum information necessary to operate, secure, and improve the service. Here is what we process and why:

3. What LensBooth Does NOT Collect or Store

• No Mandatory Accounts: You do not need to sign up, log in, or provide an email address or password to use the camera or photo booth. Google Login is completely optional.
• No Google Token or External Drive Access: When you choose to sign in with Google, we never collect or store passwords, Google access tokens, Google refresh tokens, or ID tokens. We never request or access Google Drive, Google Photos, contacts, or any other Google services, and we make no API calls to Google after authentication.
• No Permanent Server Storage of Guest Photos: Photos you take as a guest in Solo Booth or Shared Booth are processed on your device and saved directly to your local downloads. We never keep a server copy of guest photos (except the temporary 3-minute in-app browser save described in section 4 below). Only if you choose to sign in and save strips to your account are your finished strips saved in your private cloud gallery.
• No Raw IP Address Tracking in Statistics: While our edge infrastructure necessarily processes technical network connection data (such as IP addresses) in transit for essential DDoS mitigation, abuse prevention, rate limiting, and network delivery, we do not log or store raw visitor IP addresses in our website statistics database.
• No Biometric Templates or Facial Recognition: LensBooth does not extract facial geometry, create biometric templates, or perform facial recognition. Camera frames are processed strictly as visual pixels for photo rendering.
• No GPS Location Tracking: We do not collect, request, or track your precise GPS or physical device coordinates.
• No Payment or Card Details: LensBooth is a free web app and does not collect or process credit cards, bank accounts, or financial data.
• No AI Model Training on Your Photos: LensBooth does not use your photos, video frames, or photo strips to train machine learning or artificial intelligence models.
• No Ad Targeting from Camera Pixels: LensBooth never accesses, scans, analyzes, or shares camera video feeds or photo pixels for advertising or profile targeting.

4. Camera Access, Live Isolation & Photo Processing

LensBooth requests camera permissions strictly for capturing photos while you are in an active booth session:

• Solo Booth: Camera frames remain entirely inside your device. Photo strip layout, filters, and rendering happen locally on your computer or phone. In standard browsers (such as Chrome, Safari, Firefox, or Edge), your photos are never sent to our servers. The finished strip is saved straight from your browser to your local device storage.
• Active Camera Isolation: Live camera feeds and countdown captures are strictly private. Sponsored ad placements and offerwalls appear only on browsing pages, informative articles, tool utilities, or post-capture result screens once photo processing is complete. Video streams and camera data are never accessible to advertising networks.
• Saving to Your Account (Optional): If you choose to sign in with Google, photo strips you choose to save (or migrate from a guest session) are stored in secure private cloud storage associated with your account so you can view, download, and manage them across devices.
• Saving inside an In-App Browser (Temporary 3-Minute Transit): When you open LensBooth from a link inside another app (such as Instagram or Facebook), restricted in-app browsers often cannot save files directly to your device storage. To allow saving in those environments, the finished photo strip is uploaded temporarily to our server under a one-time random link. It is automatically deleted after 3 minutes (180 seconds), and is never linked to your identity, never reviewed, and never used for any other purpose.
• Shared Booth (Multiplayer): Video is streamed directly between you and your friend using peer-to-peer technology. During countdowns, temporary low-resolution previews are held briefly in server memory solely to synchronize dual-camera captures. These previews expire automatically on a fixed 3-minute timer and are never retained.

5. Voluntary Community Spotlight Submissions

LensBooth allows users to optionally submit their finished photo strips to be featured on our public Community Spotlight showcase:

• Entirely Voluntary: Submitting a photo strip is completely optional and is never required to use LensBooth.
• Information Submitted: The photo strip image itself and an optional display name or nickname of your choice (no email or account required).
• Permissions & Age Requirement: When submitting, you confirm that you are at least 16 years old (or have parental permission) and that everyone appearing in the photo has granted explicit, unambiguous consent to have their likeness displayed publicly.
• Human Moderation: All submissions are reviewed by a human moderator before appearing on the website to ensure safety, authenticity, and community appropriateness.
• Prompt Removal & Takedowns: If you or anyone appearing in a featured photo strip wants it removed, email us at support@lensbooth.app or use our Contact Page. We review and remove verified requests promptly.

6. Third-Party Service Providers & International Data Transfers

We work with trusted infrastructure providers to host, secure, and operate LensBooth. Because our service relies on global cloud infrastructure, your information may be processed on secure servers located outside your country of residence (including in the United States and other global data center locations).

7. Cookies & Browser Storage

LensBooth uses browser storage to provide essential functionality and, only with your explicit permission, analytics and advertising:

• Essential Functionality: Used locally in your browser to generate photo strips, handle camera frames, and remember your cookie preferences. These are necessary for the website to work.
• Account Authentication (Optional): If you choose to sign in with Google, a secure authentication cookie is created to maintain your login session. It expires automatically after 30 days.
• Guest Device Storage: Used in your browser to temporarily keep photo strips on your device during guest use so you can easily migrate them if you later choose to sign in.
• Privacy by Default: All optional analytics and advertising cookies are strictly blocked by default on your first visit and remain blocked unless you explicitly choose to accept them.

You can review, change, or withdraw your cookie consent at any time by clicking Cookie Preferences in the website footer.

8. How Long We Keep Information (Retention Schedule)

We follow strict data minimization principles and retain information only as long as necessary for the purpose for which it was processed:

9. Security Safeguards & Incident Management

We employ modern technical and organizational safeguards to protect user interactions:

• Encryption in Transit: All web traffic is encrypted using industry-standard HTTPS encryption.
• Application Protection: Strict Content Security Policies and modern security headers are enforced across all web pages to prevent malicious scripts, tampering, or unauthorized embedding.
• Automated Abuse Defense: Edge rate limiting and firewalls protect the service against automated abuse, brute-force attacks, and denial-of-service attempts.
• Incident Response: If a personal data breach occurs that creates a risk of harm, we maintain an incident response process to contain the event, investigate root causes, and notify affected users and supervisory authorities (such as the Data Protection Board of India or relevant global regulators) in accordance with statutory timelines.
• While we implement industry-standard safeguards, no method of electronic transmission or cloud storage is 100% impenetrable, and absolute security cannot be guaranteed.

10. Global Privacy Baseline & User Rights

Regardless of your geographic location, LensBooth provides the following practical privacy controls:

• Self-Service Account & Data Deletion: You can permanently delete individual photo strips or delete your entire LensBooth account and all associated cloud data at any time directly in your Profile Settings ("Delete account"). Deletion is immediate, permanent, and removes all of your account information and cloud-saved photos. Deleting your LensBooth account deletes all data held by LensBooth and does not alter or delete your Google Account.
• Right to Access & Summary: You can request a summary of the personal data we hold about you by emailing us.
• Right to Correction: You can request updates or corrections to any inaccurate information you have provided.
• Right to Withdraw Consent: You can change or withdraw your consent for optional analytics and advertising cookies at any time via Cookie Preferences in the footer.
• Right to Content Removal (Takedown): If your likeness appears in any featured Community Spotlight photo strip, you can request immediate removal via support@lensbooth.app or our Contact Page.
• Right to Grievance Redressal: You have the right to direct any privacy concern, inquiry, or complaint directly to our designated contact for prompt review.

11. Notice for Users in India (DPDP Act, 2023 & DPDP Rules, 2025)

For individuals located in India, the processing of your digital personal data is governed by the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025:

• Data Fiduciary: Kishan Naik, Founder & Sole Operator of LensBooth, India. Email: support@lensbooth.app.
• Notice & Consent: When you voluntarily sign in with Google, submit feedback, or submit a photo strip, this policy serves as the statutory notice describing the specified purpose of processing. Processing occurs either on the basis of your freely given, specific, informed, and unambiguous consent, or for legitimate uses specified under Section 7 of the DPDP Act (such as responding to voluntary inquiries and feedback).
• Data Principal Rights: Under the DPDP Act, you have:
  • The Right to Access information about personal data processed and a summary of processing activities;
  • The Right to Correction and Erasure of personal data that is inaccurate, incomplete, or no longer necessary for the purpose;
  • The Right to Grievance Redressal through our Grievance Officer;
  • The Right to Nominate another individual to exercise your rights in the event of death or incapacity.
• Children's Personal Data: LensBooth does not knowingly process personal data of children under 18 without lawful guardian guidance. We do not track or behaviorally monitor children, nor do we serve targeted ads to minors. Community Spotlight submissions require 16+ age confirmation and parental consent if under 18.
• Grievance Redressal Timeline: As required under the DPDP Rules, 2025 and IT Intermediary Rules, 2021, all privacy grievances and takedown requests submitted to our Grievance Officer will be acknowledged within 24 hours and redressed within 15 days (or within 72 hours for urgent content takedowns involving non-consensual imagery).
• Recourse to the Data Protection Board of India: If you are not satisfied with the resolution of your grievance by our Grievance Officer, you have the right to file a complaint before the Data Protection Board of India (DPBI) in the manner prescribed under the DPDP Act and Rules.

12. Notice for Users in the European Economic Area (EEA) & United Kingdom

If you are located in the European Union / European Economic Area or the United Kingdom, the processing of your personal data is governed by the EU General Data Protection Regulation (GDPR) or the UK GDPR / Data Protection Act 2018.

• Your Data Subject Rights: Under Articles 15-22 of the GDPR and UK GDPR, you have the right to request access to, rectification of, or erasure of your personal data; the right to restrict or object to processing; the right to data portability; and the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• International Transfers: Personal data is transferred to and processed in India, the United States, and other global edge locations where our service providers operate. Transfers rely on European Commission-approved Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum, supplemented by technical safeguards including HTTPS encryption in transit and data minimization.
• Supervisory Authority Recourse: You have the right to lodge a complaint with an EU Member State Data Protection Authority (Supervisory Authority) or the UK Information Commissioner's Office (ICO) (ico.org.uk) if you believe our processing infringes applicable data protection law.

13. Notice for Users in the United States (California & State Privacy Laws)

This section provides disclosures for residents of California (under the California Consumer Privacy Act / California Privacy Rights Act - CCPA/CPRA) and other US states with comprehensive privacy legislation (such as Colorado, Connecticut, Virginia, Utah, Texas, and Oregon):

• Categories of Personal Information Collected: In the preceding 12 months, LensBooth has collected:
  • Identifiers: Google account identifier, email address, display name, avatar URL (only when you choose to sign in); anonymous cookie/consent identifiers;
  • Internet or Network Activity: Interactions with our website, pages viewed, browser/device type (only when optional analytics cookies are accepted);
  • User-Generated Content: Saved photo strips (if you create an account) and community spotlight submissions (if voluntarily submitted);
  • Inferences: None. LensBooth does not create consumer profiles.
• No "Sale" or "Sharing" of Personal Information: LensBooth does not sell your personal information for monetary consideration. LensBooth does not share your personal information with third parties for cross-context behavioral advertising unless you have explicitly accepted advertising cookies.
• No Sensitive Personal Information Misuse: LensBooth does not collect or process sensitive personal information (such as government IDs, financial accounts, precise geolocation, racial origin, or genetic/biometric data) to infer characteristics.
• Your State Privacy Rights: Depending on your state of residence, you may have the right to:
  • Know & Access the categories and specific pieces of personal information collected;
  • Delete personal information held by LensBooth (available instantly via Profile Settings);
  • Correct inaccurate personal information;
  • Opt Out of targeted advertising or profiling via our Cookie Preferences manager;
  • Non-Discrimination: We will never discriminate against you, deny services, or provide a different quality of service for exercising your privacy rights.
• Do Not Track & Global Privacy Control (GPC): If your browser transmits a Global Privacy Control (GPC) or Do Not Track signal, LensBooth honors this signal by blocking non-essential analytics and advertising cookies by default.

14. Canada, Australia & International Frameworks

• Canada (PIPEDA): Personal information is collected, used, and disclosed in accordance with the 10 Fair Information Principles under the Personal Information Protection and Electronic Documents Act (PIPEDA). Canadian users may request access, correction, or deletion, or contact the Office of the Privacy Commissioner of Canada (OPC).
• Australia (Privacy Act 1988): We handle personal information consistently with the Australian Privacy Principles (APPs). Where personal information is processed overseas by cloud providers (APP 8), reasonable steps are taken to ensure recipient infrastructure upholds comparable security safeguards. Australian users may also contact the Office of the Australian Information Commissioner (OAIC).
• Brazil (LGPD - Law 13.709/2018): Brazilian users may exercise rights under Article 18 of the LGPD (access, confirmation, correction, anonymization, deletion, portability, consent revocation) and direct inquiries to our contact address or the National Data Protection Authority (ANPD).
• Singapore (PDPA 2012): We comply with the consent, purpose limitation, notification, access, correction, accuracy, protection, and retention limitation obligations under the Personal Data Protection Act.
• Japan (APPI) & South Korea (PIPA): Cross-border data processing is conducted with appropriate organizational and technical safeguards, and users may exercise statutory access and deletion rights at any time.

15. Children's Privacy & Age Policy

• General Platform Use (13+): LensBooth is intended for users aged 13 and older. If you are between 13 and 18, please use LensBooth under the guidance and consent of a parent or guardian. We do not knowingly collect personal information from children under 13 without verifiable parental consent in accordance with COPPA, GDPR Article 8, and the DPDP Act.
• Community Submissions (16+): Submitting photo strips for public display on the website requires being at least 16 years of age (with explicit parental/guardian consent if under 18).
• Zero Tolerance for Child Harm: We maintain strict zero tolerance for Child Sexual Abuse Material (CSAM) or any exploitation of minors. Any detected abusive imagery is immediately purged and reported to the National Center for Missing & Exploited Children (NCMEC) and relevant cyber crime law enforcement authorities.

16. Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect service enhancements, new features, or changes in applicable legal frameworks. When updates occur, the revised document will be posted on this page with an updated "Effective Date" and version number. Continued use of LensBooth after changes are published constitutes acknowledgment of the updated policy.

17. Grievance Redressal, Contact & Inquiries