Face search: retention and destruction schedule

Aurant offers photographers an optional feature called face search: a gallery visitor can find the photographs they appear in by taking a selfie. It is off by default, and switching it on for a gallery requires the photographer to confirm that they hold the consent of the people in that gallery’s photographs. This page is the written schedule for how long the resulting data is kept and exactly when it is destroyed.

What is created

When a photographer turns face search on for one gallery, the faces in that gallery’s photographs are indexed with Amazon Web Services Rekognition, in the region named on the gallery’s own notice. Hidden photographs are never indexed.

• A face template (a numeric representation of a face, not an image) is created for each face found, up to fifteen per photograph. The templates are held inside a Rekognition collection belonging to that one gallery.
• Aurant itself stores only the mapping between a template’s identifier and the photograph it came from, so that a match can be turned back into photographs you can see.
• No face crops, facial landmarks or inferred attributes (age, gender, emotion) are requested or stored, and the templates are never used to train any model.
• A visitor’s search selfie is processed in memory only: it is decoded, resized, compared and discarded within the request. It is never written to disk and never stored.

How long it is kept

A gallery’s face index exists only while that gallery has face search switched on and is live. It is destroyed as soon as any one of the following is true:

• the photographer turns face search off for the gallery;
• the gallery’s link reaches its expiry date;
• the gallery’s link is deactivated;
• the gallery is deleted;
• the photographer turns face search off for their whole account, or their plan no longer includes it;
• the photographer deletes their account’s AI data, or their account.

The longest a gallery’s face index can therefore exist is until that gallery expires. A gallery with no expiry date keeps its index until the photographer switches the feature off or deletes the gallery, and no longer.

How it is destroyed

Destruction is carried out by a background process that re-checks every indexed gallery against the conditions above, and runs continuously rather than on a periodic purge date:

• the gallery’s Rekognition collection, and with it every face template in it, is deleted at Amazon Web Services;
• every stored template-to-photograph mapping held by Aurant is then deleted;
• if Amazon Web Services cannot be reached, the deletion is retried until it confirms, and the index stays marked for destruction in the meantime — it is never marked destroyed on an unconfirmed attempt.

Consent

Before face search can be switched on for a gallery, the photographer must confirm in writing, in the app, that they have the consent of the people in that gallery’s photographs for their faces to be indexed. That confirmation is recorded with their identity, the time and the version of the text they agreed to, in the gallery’s audit log. Declining leaves the feature off.

Separately, a visitor who wants to search must tick an explicit consent before their selfie is used, having been told that it is biometric processing of their face, who processes it, where, and that the selfie is never stored.

If you are in the photographs and object

Every gallery whose faces are indexed carries a notice to that effect, naming the photographer and giving their email address as the route to object. Write to them and ask for your faces to be removed; they can switch face search off for the gallery, which destroys the index entirely.

If you cannot reach the photographer, or you believe this schedule has not been followed, write to us at hello@aurant.io