Privacy Policy

BSoura ("BSoura", "we", "us") is operated by Tarek Abou Rjeily, an individual sole operator based in Kaslik, Lebanon. BSoura is not a separately incorporated company. We are the controller responsible for the data described in this policy, including any face template we create to match you to your photos.

We use your selfie and temporary face template to locate the photos you appear in at the specific named event you opened, and to let you view and download them. If you confirm a photo of yourself, we use the event-photo face template from that photo, not your selfie, to look for more of your photos at the same event. We also retain the submitted selfie and search outcome so administrators can troubleshoot failed or incorrect searches at that event. The selfie is not used for other events.

Optional test use. Only if you tick a separate, unticked box on the consent screen, we may also use your saved selfie to test and improve how well BSoura finds photos (for example, comparing whether different matching settings or engines would have found your photos). This happens only on BSoura's own server, never with outside services; the selfie is never shared or used to train an AI model, and it is deleted on the same schedule as other saved selfies. You can withdraw this permission at any time by email.

• ✕We do not use your face template for advertising or marketing.
• ✕We do not use it to build a profile of you or to train AI models, and we use your saved selfie for testing only if you opt in.
• ✕We do not match you across other events or against any external database.

Because a face template is biometric data, we rely on your explicit, specific, opt-in consent as our legal basis in every market — this is the only basis available for biometric processing, and you give it on a separate consent screen before any face template is created. You can withdraw it at any time. For users in the EU, where photo retrieval is performed without biometrics it may instead rest on our legitimate interest in helping attendees find their own photos; biometric matching always requires your explicit consent.

A BSoura event involves three parties: the event photographer, who takes the photos and owns the copyright; the event organizer, who runs the event and invites BSoura in; and BSoura, the controlled layer that privately distributes the photos to the people in them. Permission to photograph attendees is obtained by the organizer and photographer at the event itself. BSoura is the controller for the face templates it creates.

We share data only as needed to run the service: with the photographer and organizer of the event you opened; and with the processors and hosting providers that store and serve the photos and run the face-matching on our behalf under contract. We do not sell your data, and we do not share it with advertisers or data brokers.

Face templates, saved selfies and the original event photos are kept on BSoura’s own server in Lebanon. So that galleries load quickly, watermarked copies of the event photos (never your selfie or face template) are also stored with Cloudflare R2 in a storage location restricted to the European Union. They are delivered through Cloudflare’s network only after your private gallery link is checked, and they are deleted on the same schedule as the originals. Traffic reaches BSoura through Cloudflare’s network, which provides the secure connection and does not keep your selfie. If you are in a market whose data is processed in another country, we rely on the appropriate safeguard for that route — an adequacy decision, standard contractual clauses, or your explicit consent — depending on where you are and where the data is hosted. Where a market requires a permit or prior authorization before biometric processing may take place, BSoura will hold that authorization before operating there.

Saved selfies are checked for deletion every minute while the server is running and again on startup. If the server is offline or a file cannot be removed, deletion is retried when it is running again. Expired selfies cannot be viewed through the app.

When an event's retention window ends, or if the photographer deletes the event sooner, the photos and every associated face template are permanently deleted. This retention-and-destruction schedule is published here and kept publicly reachable.

Depending on where you live, you can ask us to access, correct, or delete your data; object to or restrict its use; receive a portable copy; and withdraw your consent at any time. Stop searching to prevent new processing. To remove an already saved selfie before expiry, contact the event administrator and provide the event and approximate search time.

• ✓Remove a photo. From your results you can request removal of any photo you appear in with one tap.
• ✓Email us. Send any request to hello@bsoura.app and we will action it.
• ✓Complain. You may lodge a complaint with your local data-protection authority or the competent courts in your country.

BSoura is intended for users aged 18 and over, unless the event organiser has arranged a parent's or guardian's consent for visitors under 18 (for example a school or university for its open day). In that case the consent screen names the organiser, and you confirm that you are 18 or older or that your parent or guardian has agreed through that organiser before any face template is created. Other events may ask you to confirm you are 18 or older. For events with younger visitors we recommend that organisers turn selfie saving off, so selfies are deleted as soon as each search finishes. If we learn we have processed a minor's biometric data without such an arrangement, we delete it.

We use technical and organizational measures appropriate to the sensitivity of biometric data — including encrypted transport, access controls, rate limiting, and private, token-authenticated access to event galleries — to protect against unauthorized access, loss, or misuse. No system is perfectly secure, but we design BSoura to minimize what is collected and how long it is held.

We may update this policy from time to time. When we make a material change we will update the effective date and version above and, where appropriate, notify you in the app. The current version is always available at this public link.