RGB PRIVACY POLICY

Version 1.0. Effective October 10, 2026

This Privacy Policy (the “Policy”) explains how RGB AI LTD, company number 517386975, 7 Nava Semel Street, Kiryat Ono, Israel (“RGB”, “we”, “us”), collects, uses, shares and deletes personal information in connection with rgb-ai.com, the photographer dashboard, the guest galleries and the messages RGB sends on WhatsApp (together, the “Service”).

RGB is a service for event photographers. It finds each guest in the photos of an event and sends the guest a personal gallery on WhatsApp.

1Summary
1. 1.1
  We use face recognition only to find your photos at an event you attended.
2. 1.2
  Your selfie is deleted once it has been matched. We keep a Face Vector for 30 days after the event, unless you agree to a Permanent Profile.
3. 1.3
  We never sell your data, and never use your face for advertising or to train models.
4. 1.4
  Event photos belong to the event. We share them with the photographer and the event owner, not with advertisers.
5. 1.5
  You can delete your data at any time by sending STOP, DELETE or הסר to RGB’s WhatsApp number, or by writing to privacy@rgb-ai.com.
2Definitions
1. 2.1
  Face Vector means a set of numbers computed from a face in a photo. It is not a photo.
2. 2.2
  Permanent Profile means a Face Vector and phone number that RGB keeps, with the guest’s separate consent, to deliver the guest’s photos from future events.
3. 2.3
  Photographer means a photographer who uses the Service to process the photos of an event.
4. 2.4
  Event Owner means the person who held the event and provided its guest list.
5. 2.5
  Guest means a person invited to an event, or who joined through a link shared by another guest.
3Information We Collect
1. 3.1
  Website visitors: details entered in a contact form (name, phone, email), cookies and IP address.
2. 3.2
  Photographers: login details, a phone number verified by a WhatsApp code, a public profile, the events the Photographer creates, and account and billing records.
3. 3.3
  Event Owners: name, phone and email provided by the Photographer, a one-time WhatsApp code for each new device, and activity in the full event gallery.
4. 3.4
  Guests:
  1. 3.4.1
    from the Event Owner’s guest list: phone number and, optionally, name;
  2. 3.4.2
    from the Guest: a selfie, WhatsApp messages and button taps;
  3. 3.4.3
    from WhatsApp: delivery and read receipts;
  4. 3.4.4
    from the Service: activity in the Guest’s personal gallery.
5. 3.5
  Anyone who appears in event photos: the photos, and a Face Vector for each face found in them.
6. 3.6
  Guests’ phone numbers come from the guest list the Event Owner provides. The Event Owner confirms, when uploading the list, that the Event Owner is entitled to provide it.
7. 3.7
  No one is required by law to provide information to RGB. A Guest who does not send a selfie will not receive a personal gallery, because RGB cannot find the Guest’s photos without it. A Guest may ignore RGB’s messages at any time.
8. 3.8
  RGB does not ask for any ID document.
4Face Recognition
1. 4.1
  Face data is sensitive information, and RGB handles it under stricter rules than other personal information.
2. 4.2
  Face recognition runs only on events that a Photographer chooses to upload to RGB. RGB computes a Face Vector for each face in the photos of those events. When a Guest sends a selfie, RGB computes a Face Vector from it and compares it with the event’s Face Vectors, to find the photos the Guest appears in.
3. 4.3
  The match is made by a face recognition model that RGB licenses commercially and runs itself, on cloud infrastructure that RGB rents. RGB does not use any third party’s face recognition service.
4. 4.4
  RGB asks for consent at two levels:
  1. 4.4.1
    This event. When a Guest replies to RGB’s message with a selfie, RGB uses it to find the Guest’s photos at the events the Guest was invited to. The selfie is deleted once it has been matched. The Guest’s Face Vector is kept for 30 days after the event, so that photos uploaded later can be added.
  2. 4.4.2
    Permanent Profile (optional). RGB asks separately, with an “I agree” button. If the Guest agrees, RGB keeps the Guest’s Face Vector and phone number, and sends the Guest photos from future events of any RGB Photographer, even if the Guest was not invited and did not send a selfie. A Guest receives a gallery whether or not the Guest agrees.
5. 4.5
  Faces of people who did not send a selfie are not linked to any name or phone number. Their Face Vectors are deleted 30 days after the event, unless they match a Permanent Profile.
6. 4.6
  Matching is not perfect. A Guest may miss a photo, or receive one the Guest is not in. A Guest can report this in WhatsApp, and RGB will stop sending based on that match. Authorized RGB staff may review borderline matches and such reports, and every such access is logged.
7. 4.7
  RGB never:
  1. 4.7.1
    sells face data, or gives it to third parties other than the service providers in clause 6;
  2. 4.7.2
    uses face data for advertising or marketing;
  3. 4.7.3
    uses face data to train models;
  4. 4.7.4
    infers age, gender, ethnicity, health or any other trait from a face;
  5. 4.7.5
    identifies people outside the events processed in the Service, or offers identification to anyone else.
5How We Use Information
1. 5.1
  To provide the Service: match photos to Guests, send personal galleries, and give the Event Owner the full event gallery.
2. 5.2
  To run Photographer accounts: verify Photographers and prevent duplicate accounts.
3. 5.3
  To keep the Service safe: rate limits, detecting impersonation, and monitoring unusual account activity.
4. 5.4
  To answer support requests.
5. 5.5
  To improve the Service, from aggregated data and Photographer feedback, never from Guests’ faces.
6. 5.6
  For marketing, only to Photographers and to people who left their details on rgb-ai.com, and only with their separate consent. Messages RGB sends to Guests and Event Owners are service messages only.
7. 5.7
  To meet legal duties: invoices, records and proof of consent.
6Sharing and Storage
1. 6.1
  RGB does not sell personal information.
2. 6.2
  The Photographer sees delivery status for the Photographer’s events, not Guests’ contact details.
3. 6.3
  The Event Owner receives the full gallery of the event, without any link between photos and people.
4. 6.4
  Other Guests see a photo in which a Guest appears if they appear in it too.
5. 6.5
  Anyone holding a link to a personal gallery can see it. A Guest may forward the link. RGB cannot control photos after they are downloaded or forwarded.
6. 6.6
  Service providers process data for RGB under contract, only to provide the Service:
  1. 6.6.1
    Railway: hosts RGB’s servers and database, including Face Vectors. Located in the United States.
  2. 6.6.2
    Cloudflare (R2): stores event photos and galleries. Located in Cloudflare’s Eastern Europe region.
  3. 6.6.3
    Modal: runs RGB’s face recognition model. Located in the United States.
  4. 6.6.4
    Meta Platforms (WhatsApp Business Platform): carries every WhatsApp message, including selfies. Located in Meta’s data centers.
  5. 6.6.5
    Google (Google Workspace): the mailbox for privacy requests. Located in Google’s data centers, which may be outside Israel.
  6. 6.6.6
    Vercel: hosts the website rgb-ai.com. Located in the United States and Vercel’s global network.
7. 6.7
  RGB discloses information to authorities when the law requires it, or to protect the rights of RGB and its users.
8. 6.8
  A buyer or successor of RGB’s business will be bound by this Policy.
9. 6.9
  RGB’s service providers store and process data in Israel, Europe and the United States. Data is transferred outside Israel under the Privacy Protection Regulations (Transfer of Data to Databases Abroad), 5761-2001, with contractual commitments from each provider.
7Retention
1. 7.1
  Selfie: deleted once it has been matched.
2. 7.2
  Face Vectors from a selfie or from event photos: 30 days after the event, unless linked to a Permanent Profile.
3. 7.3
  A pending request for consent to a Permanent Profile: 30 days, then deleted.
4. 7.4
  Permanent Profile: until the Guest withdraws consent, or after 12 months in which the Guest was not recognized at any event.
5. 7.5
  Event photos and galleries: until the Photographer deletes them, the Event Owner asks to delete the event, or the Guest asks RGB to delete the Guest’s data.
6. 7.6
  Photographer account: until the account is deleted. Invoices and payment records are kept as the law requires.
7. 7.7
  Backups: up to 7 days.
8. 7.8
  When a period ends, RGB deletes the data, or keeps only aggregated statistics that identify no one.
8Your Rights
1. 8.1
  You may ask to see and correct your data by writing to privacy@rgb-ai.com. RGB answers within 21 days, after verifying your identity.
2. 8.2
  A Guest may delete the Guest’s data by sending STOP, DELETE or הסר to RGB’s WhatsApp number at +972 55-9751572, or by writing to privacy@rgb-ai.com. Deletion covers, across all events, the selfie, Face Vectors, the Permanent Profile, personal galleries and their links, contact details and messages. RGB confirms only once the deletion is done.
3. 8.3
  After deletion, the following remain:
  1. 8.3.1
    the event photos themselves, in the Event Owner’s gallery and in the galleries of other Guests who appear in them;
  2. 8.3.2
    a hashed record of the phone number, so that RGB knows the person asked to be removed;
  3. 8.3.3
    delivery records linked only to an internal ID, without name or phone number;
  4. 8.3.4
    backup copies, until they expire.
4. 8.4
  A Guest may ask RGB by email to hide a photo in which the Guest appears from Guests’ galleries.
5. 8.5
  A person who appears in event photos and never contacted RGB may write to RGB, including to ask RGB to delete that person’s Face Vectors.
6. 8.6
  A Photographer may delete the Photographer’s account in the dashboard.
7. 8.7
  Marketing consent may be withdrawn at any time, through the link in every marketing message.
8. 8.8
  You may complain to the Israeli Privacy Protection Authority.
9. 8.9
  The full steps are set out in RGB’s Data Deletion Instructions at https://rgb-ai.com/data-deletion.
9Cookies
1. 9.1
  RGB uses essential cookies only, which the Service needs to work, for example to keep a Photographer signed in. RGB does not use analytics or advertising cookies.
2. 9.2
  If RGB adds analytics or advertising tools to its marketing site, RGB will update this Policy first and ask visitors for consent. Guest galleries and screens that receive selfies will continue to use essential cookies only.
10Security
1. 10.1
  RGB protects personal data with access controls, encryption of contact details and Face Vectors, short-lived signed links to photos, and logging of access to personal data.
2. 10.2
  If a serious security incident occurs, RGB will notify as the law requires.
11Children
1. 11.1
  RGB does not create a Permanent Profile for anyone under 18.
2. 11.2
  Children may appear in event photos, such as at a bar or bat mitzvah. Their faces are handled like any Guest’s face and deleted 30 days after the event.
12Changes to this Policy
1. 12.1
  Each version of this Policy has a version number and an effective date.
2. 12.2
  RGB will post a material change 30 days before it takes effect, and notify Photographers by email.
3. 12.3
  A change that affects consent a Guest gave will require that Guest’s new consent.
13Contact
1. 13.1
  RGB AI LTD, company number 517386975, 7 Nava Semel Street, Kiryat Ono, Israel. Email: privacy@rgb-ai.com.

1Summary

2Definitions

3Information We Collect

4Face Recognition

5How We Use Information

6Sharing and Storage

7Retention

8Your Rights

9Cookies

10Security

11Children

12Changes to this Policy

13Contact