Privacy Policy

1. Who We Are

Digital Circle LLC ("Digital Circle", "we", "us") operates SafeFrame. For privacy inquiries, use the contact details at the end of this policy.

2. Scope

This policy applies to the SafeFrame mobile application and related services (authentication, APIs, photo hosting, and processing) used by participating Institutions.

3. Data We Collect

Depending on your role and Institution settings, we may process:

• Account data: email address, password (stored in hashed form by our auth provider), profile display name, role (parent, educator, admin).
• Family and group data: child first name, group/kindergarten association, membership and approval status.
• Device data: device identifiers and status used to enforce device-linking rules for parent accounts.
• Photos and metadata: images uploaded by staff, processing status, album associations, published versions shown to authorized viewers.
• Technical logs: timestamps, error codes, and pipeline step records for security and operations (not intended to include photo content in logs).

4. How We Use Data

• Provide sign-in, authorization, and gallery access.
• Register and validate devices where required.
• Upload, process (including automated face detection/blurring where configured), review, and publish photos to authorized parents.
• Maintain security, debug failures, and improve reliability.
• Respond to support and legal requests.

5. Legal Bases (EEA/UK users)

Where applicable, we rely on performance of a contract (providing the Service), legitimate interests (security, fraud prevention, service improvement), and consent or Institution/legal obligation where required for photographing minors.

6. Sharing and Processors

We do not sell your personal data. We use service providers that process data on our instructions, such as:

• Cloud database and authentication (Supabase).
• Photo analysis for privacy processing (e.g., Amazon Rekognition in the EU region where configured).
• Private hosting for published photo files.

We may disclose data if required by law or to protect rights, safety, and security.

7. Retention

• Account and profile data are kept while your account is active and as needed afterward for legal or operational purposes.
• Published photos may remain under Institution control for other authorized viewers; see account deletion.
• Operational logs are typically retained for up to 90 days, then deleted or anonymized where feasible.
• Backup systems may retain deleted data for up to 30 days before overwrite.

8. Security

We use industry-standard measures such as encryption in transit (HTTPS/TLS), access controls, and role-based permissions. No method of transmission or storage is 100% secure.

9. Children

SafeFrame is not directed at children to use as registered users. Institutions may process photos that depict children; parents/guardians use adult accounts. Institutions are responsible for appropriate consents and policies under local law.

10. Your Rights

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal data, or to object to certain processing. To delete your account, follow these instructions. You may also contact us or your Institution.

11. International Transfers

Data may be processed in the European Union and other countries where our providers operate, with appropriate safeguards where required.

12. Changes

We may update this Privacy Policy. We will revise the "Last updated" date when we do.