Privacy Policy
1. Overview
PixMagix ("we", "us", "our") is operated by Power Digital (ABN to be updated). We provide an AI-powered event photo management platform including facial recognition search, BIB number detection, photo distribution, and print fulfillment services.
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform — whether you are an event organizer ("Organizer") or an event attendee ("Attendee").
We take the privacy of biometric data extremely seriously. Facial recognition data is processed to match photos only and is not stored beyond the session without your explicit consent. We do not sell personal data to third parties.
By using PixMagix, you agree to the collection and use of information in accordance with this policy. This policy complies with the Australian Privacy Act 1988, the Australian Privacy Principles (APPs), and where applicable, the EU General Data Protection Regulation (GDPR).
2. Data We Collect
2.1 Information You Provide
- Contact information: Name, email address, phone number provided via contact forms
- Account information: Username, password (hashed), organisation name for Organizer accounts
- Payment information: Processed by our payment provider — we do not store full card details
- Communications: Messages you send us via email or contact forms
2.2 Information Collected Automatically
- Usage data: Pages visited, search queries, download activity, time on site
- Device information: IP address, browser type, operating system
- Session data: Session tokens, CAPTCHA responses (not stored long-term)
- Cookies: See Section 10 for details
2.3 Photos and Media
- Event photos: Uploaded by Organizers — they retain ownership and copyright
- Selfie photos: Submitted by Attendees to perform face search — used for matching only
3. Facial Recognition & Biometric Data
Facial recognition involves the processing of biometric data, which is sensitive personal information under Australian law and a special category under GDPR. We apply the highest standards of protection to this data.
3.1 How Face Search Works
When an Attendee submits a selfie to search for their photos, PixMagix extracts a numerical facial feature vector (embedding) from the image. This vector is compared against embeddings derived from event photos to find matches. The selfie image itself is not permanently stored after the search session completes.
3.2 What We Store
- Facial embeddings derived from event photos are stored to enable search functionality for the duration of the event gallery's active period
- Selfie photos submitted by Attendees are processed in-session and deleted within 24 hours
- We do not build persistent facial identity profiles of Attendees without explicit opt-in consent
3.3 Legal Basis for Processing
- Australia: Processing of sensitive information with consent, or where reasonably necessary for a permitted general situation
- GDPR (EU users): Explicit consent (Article 9(2)(a))
- Organizers are responsible for obtaining attendee consent for facial recognition at their events where required by law
3.4 Opt-Out
Attendees who do not wish to use facial recognition may search by BIB number or event description instead. Face search is always opt-in — you choose to submit a selfie.
4. How We Use Your Data
- To provide, operate, and improve the PixMagix platform
- To match Attendees with their event photos via face recognition or BIB detection
- To process payments and fulfill orders (photo downloads, print orders)
- To send transactional emails (photo delivery, order confirmation, account notifications)
- To respond to enquiries and provide customer support
- To detect and prevent fraud, bot activity, and abuse
- To analyse usage patterns and improve our AI models (using anonymised, aggregated data only)
- To comply with legal obligations
We do not use your data for unsolicited marketing without your explicit consent. We do not sell your personal data to third parties.
6. Storage & Security
Your data is stored on AWS servers in the Asia Pacific (Singapore) region. We implement the following security measures:
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Access controls — staff access to personal data is restricted on a need-to-know basis
- Rate limiting and bot detection to prevent automated data harvesting
- Regular security reviews and vulnerability assessments
- Biometric data stored in isolated, access-controlled storage separate from general data
Despite our best efforts, no system is 100% secure. If you become aware of a security issue, please contact us immediately at [email protected].
7. Data Retention
- Attendee selfies: Deleted within 24 hours of submission
- Facial embeddings from event photos: Retained while the event gallery is active, deleted when the gallery expires or is deleted by the Organizer
- Event photos: Retained per the Organizer's subscription and gallery settings
- Account data: Retained while your account is active, then for 90 days after account deletion
- Transaction records: Retained for 7 years for tax and legal compliance
- Contact form submissions: Retained for 12 months
8. Your Rights
Under the Australian Privacy Act
- Right to access your personal information we hold
- Right to correct inaccurate personal information
- Right to make a complaint to the Office of the Australian Information Commissioner (OAIC)
Under GDPR (EU residents)
- Right of access (Article 15)
- Right to rectification (Article 16)
- Right to erasure / "right to be forgotten" (Article 17)
- Right to restrict processing (Article 18)
- Right to data portability (Article 20)
- Right to object to processing (Article 21)
- Right to withdraw consent at any time (without affecting prior lawful processing)
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
9. Children's Privacy
PixMagix may be used at school events and other situations involving children under 18. We take this responsibility seriously.
- Organizers using PixMagix at events involving minors are responsible for obtaining appropriate parental/guardian consent for photography and facial recognition processing
- We do not knowingly collect personal data directly from children under 13 without verifiable parental consent
- School Organizers must ensure their use of PixMagix complies with applicable education privacy laws in their jurisdiction
- If you believe we have inadvertently collected data from a child without consent, please contact us immediately
11. International Data Transfers
PixMagix operates primarily from Australia. Data is stored in AWS Singapore (Asia Pacific region). If you access our platform from the EU or UK, your data may be transferred to and processed in countries outside the European Economic Area.
We ensure appropriate safeguards are in place for such transfers, including standard contractual clauses where required by GDPR.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.
Continued use of PixMagix after changes take effect constitutes acceptance of the updated policy.
13. Contact Us
For privacy enquiries, data requests, or complaints:
- Email: [email protected]
- WhatsApp: +61 461 423 114
- Company: Power Digital, Australia
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or, for EU residents, your local Data Protection Authority.
Get In Touch
Ready to transform your event photos? We'd love to help.