Privacy notice · version notice-v1

How SEP Recognition handles your photos and your data

Draft, published 30 September 2026. This notice is under legal review and may change; any change is published here as a new, dated version.

Avonlea Studio and SEP digital are trading names of Avonlea Photography Studio Inc., a photography studio in Edmonton, Alberta. This notice explains what we collect when you use SEP Recognition, our photo delivery service, why we collect it, where it is kept, how long, and how to reach us. It applies to event galleries, to photos our photographer tags for you, and to the paid photo search.

What we collect, and why

A selfie and face data. When you enroll, you take a selfie on your own phone, or you agree after our photographer tapped your face in a photo. We turn that into a face template (a set of numbers, not a picture) and compare it to the photos from that one event, so we can send you the ones you are in. We never compare it to photos from other events, and we never use it to find out who you are.

Your phone number or email. So we can send you your private gallery link, and updates when more photos arrive. If you choose the optional boxes, we also use it for our own offers, or share your name and email with the event's host. Both are optional and you can stop either at any time.

Your photos. The photographs we take at the event, and which of them you appear in.

Consent records and logs. When you agreed, which version of the wording you saw, and a record of when a gallery was opened or a photo downloaded, so we can show what happened if you ask.

We do not collect your name unless you type it, your age, or anything about you from your face other than the template. Our photo enhancement is automatic and only adjusts exposure, colour and light skin smoothing; it never changes who you are.

Where your data is kept

Your selfie, face template, contact and consent records are stored on our own systems in Alberta, Canada. Delivery copies of photos are stored in a Canadian data centre (Toronto) so your gallery loads quickly.

Two service providers we use are in the United States: Twilio sends our text messages (your number and the message; never a photo) and Dropbox stores our photographs (never your selfie or face data). Under Alberta's Personal Information Protection Act you can ask us how these providers handle information by contacting the privacy officer below. If you pay for a search or a download, Moneris, a Canadian payment processor, handles your card; we never see the card number.

How long we keep it

• Selfie and face template: deleted when the gallery closes, and no later than 30 days after the event, whichever comes first.
• Your contact and gallery: 12 months after the gallery closes, unless you delete them sooner.
• Consent records: 3 years after the event.
• Access logs: 2 years.
• Purchase records (no photos, no face data): 7 years, as tax law requires.
• Photo search: your selfie and the search's face data are deleted the moment the search ends.

Your choices and rights

• Delete everything now. Open your gallery, choose Account, then Delete my data. Within 24 hours your template, selfie, contact, matches and gallery are gone, and we send you a confirmation. We keep only the record that you asked.
• Stop texts. Reply STOP to any message.
• See what we hold. Email the privacy officer; we verify it is you and reply within 45 days, usually within a week.
• Correct your contact. From the gallery's Account page.
• Opt out of offers or of sharing with the host. From the Account page, or the link in any email.
• Complain. Contact the privacy officer first. You can also complain to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca).

Text messages

We only text a number that someone gave us for their own photos: typed on our enrollment page on their own phone, or sent to us by texting the event number shown at the event. Before any photo is matched, the enrollment page shows this consent, with the box unticked:

What we send, and nothing else:

How often: one text when we find you, one each time more of your photos arrive, and one before the gallery closes. Message and data rates may apply. We never send marketing by text unless you ticked the separate, optional offers box.

Children

We never enroll a child directly. At events with children, our photographer tags the child's photo and the parent or guardian receives the link and gives consent. A member of our team checks every match involving a child before any photo is sent. Photos of children appear in a host's shared gallery only with a separate written consent from the parent for each image.

The paid photo search

You can pay us to look for your own photos (or your child's, as their parent or guardian) in our past work. We narrow by the details you give us, search only that set, and a person checks every result before it is released. We do not search for other people, and we refund the fee when we cannot confirm you are the person in the photos.

How we protect it

Encrypted storage and connections, separate keys for face data that only the matching system can use, private links that expire, staff access limited to people with a job to do and logged, and a breach plan. If a breach creates a real risk of significant harm to you, we will notify you and the Commissioner as the law requires.

Who to contact

Privacy officer: Devon Riel, devon@avonleastudio.com, 780.482.4747. Avonlea Photography Studio Inc., Edmonton, Alberta.

Changes

We date every version of this notice at the top. A change never applies to data you gave us under an earlier version in a way you would not expect.