Privacy & Security

• Encrypted in transit. Every connection is served over HTTPS; insecure requests are automatically upgraded, and browsers are instructed (HSTS) to keep using encrypted connections. A valid, trusted TLS certificate is presented on every request.
• Encrypted at rest. Application data, images and records are held in a managed Postgres database and object storage that encrypt data at rest.

To deliver each guest their own photos, the AI Photoshoot Studio matches a guest's selfie to their professional images using Amazon Rekognition, AWS's managed face-analysis service. We designed this privacy-first:

• Explicit consent. A guest must affirmatively consent before their selfie is used for face matching. No selfie is used for face matching without it.
• AI portraits. TFP makes AI portraits with Google's Gemini image models, sending each photo directly to Google; the studio can also choose an image model from OpenAI or Ideogram, or a video model from Runway or Higgsfield, for a portrait. Google also reads each photo used to make portraits, including guest selfies, and writes a text description of the person's appearance, which guides the likeness; OpenAI does that step if Google's read fails, or when the studio switches it. TFP stores that description with the photo.
• Purpose limitation. Face data is used only to match a guest to their own event photos, never for advertising, tracking, profiling, or sale.
• Per-event isolation. Each event has its own dedicated face collection; face data is never shared or pooled across events or clients.
• Server-side face data. Raw face data from matching is handled only by server-side code; guests and the app's browser code cannot read it.
• No model training by TFP. Guest data is not used by TFP to train or improve any AI model.
• Retention & deletion. An event's face data is deleted when the event is archived. Archiving is a step our team takes once an event is complete; it is not automatic. At archiving, the event's entire face collection is deleted at Amazon Rekognition and the related face records are removed from our database. The event's photos, portraits and guest selfies are then removed from the app and kept in TFP's private media archive (see Subprocessors: Dropbox). To find guests in group photos, the system detects every face in an event's photos. Faces of people who haven't signed up are never matched to anyone, and they're deleted with the rest of the event's face data when the event is archived.
• Regional processing. Face matching is processed in AWS US East (N. Virginia).

• Row-level security. Row-level security is switched on for every table in the app's database.
• Admin access. Administrative access requires a signed-in account with an admin role.
• Server-side processing. Sensitive operations run in server-side code, and raw face data is never sent to the browser.
• Secret management. Keys and credentials are held in managed secret storage — never in application code or client bundles.

Enforced at the platform level and checked by our application platform's trust center (see section 7):

• HTTPS enforcement, HSTS, and a valid TLS certificate.
• Protection against MIME-type sniffing.
• A referrer policy limiting what is shared on outbound links.
• The initial page avoids loading active resources over insecure connections.

• Deployment traceability. Our application platform's security checks are tied to the exact published revision, content hash, and deployment time.
• Availability monitoring. Our application platform runs scheduled health checks on the published app.

We update this list as our providers change.

• Certified infrastructure. Our core infrastructure providers maintain independent audits and certifications. Amazon Web Services holds SOC 2 Type II and ISO 27001; our facial-matching data resides in AWS US East.
• Live trust center. Our application platform publishes a live, automatically-generated trust center for this app that lists the controls it checks. View it at https://aipstudio.tfp.nyc/.well-known/trust.html. That page is generated by the platform and cannot be edited by us — which is precisely what makes it worth trusting.
• SOC 2. Turner Family Portraits does not hold its own SOC 2 report. Our core infrastructure providers hold their own SOC 2 audits, and that is the SOC 2 coverage this app relies on. This page is informational and is not itself a certification.

If you believe you've found a security or privacy issue, please contact the studio. We investigate every report promptly.

• Consent. Facial matching happens only with a guest's explicit consent.
• Access & deletion. Guests and clients may request access to, or deletion of, their data at alec@turnerfamilyportraits.com. On request we delete the guest's gallery, their selfie and the face data made from it. All of an event's face data is deleted when the event is archived.
• No sale, no ad use. TFP never sells personal data and never uses guest images or face data for advertising.

Questions? Contact the studio

• Shared event photos. At events where the community pool is on, guests can add event photos to a shared pool. Other guests with access to that event's gallery experience can see those pool photos while the pool is open. Confident face matches appear privately in each signed-up guest's Photos of you section.
• Closing window. The pool normally stops accepting new photos 48 hours after the event ends. The host can set a different closing time and may provide a professional-gallery link afterward.
• Reporting & review. Guests can report a pool photo. A photo leaves guest view after repeated reports, or when the studio hides it, while the studio reviews it.
• Paid portrait unlocks. At some events, the host chooses to offer paid unlocks after the first free portrait. Stripe processes card payments. Turner Family Portraits receives the purchase details needed to open the selected portraits, but we never see or store your card number.