Privacy Policy | Smart Passport Photo

Who we are

Smart Passport Photo is an online passport photo service operated by Supertensor Limited (company number 16791776), registered office: 167-169 Great Portland Street, 5th Floor, London, United Kingdom, W1W 5PF. Our website is smartpassportphoto.com. You can contact us at support@smartpassportphoto.com.

What data we collect

We only collect what we need to provide the service:

Your photo — uploaded by you to create a passport photo. This is biometric data.
Your email address — to send your download link and receipt.
Payment information — processed entirely by Stripe. We never see or store your card details.
Country and document type — to apply the correct photo specification.
IP address — for fraud prevention and to detect approximate country of access.

How we use your data

To process your photo and check compliance
To generate your IDPC code (UK users only)
To send you your download link and order confirmation
To provide customer support if you contact us
To prevent fraud and abuse of the service

We do not use your photo or personal data for AI model training, marketing, or any purpose beyond delivering the service you paid for.

Photo deletion — 24 hours

Your uploaded and processed photos are automatically deleted from our servers within 24 hours of your order. We do not retain biometric data beyond what is necessary to fulfil your order. Once deleted, photos cannot be recovered.

Download links also expire after 24 hours. If you need your photo again after this period, you will need to place a new order.

Where your data is stored

Your photos and order data are processed and stored on secure servers located in the United Kingdom (AWS eu-west-2, London). We do not transfer your personal data outside the UK or EU.

Third-party services

We use the following third-party services to operate:

Stripe — payment processing. Stripe is PCI-DSS compliant. Stripe Privacy Policy
AWS Rekognition — face detection and compliance checking. Data processed in eu-west-2 (London).
Remove.bg — background removal. Photos are sent to their API and deleted after processing.
Resend — transactional email delivery.
Imagicam — UK IDPC code generation (UK orders only).

Each provider is contractually bound to process your data only as instructed and not to retain or repurpose it.

Cookies

We use essential cookies only — those required for the site to function (session management, CSRF protection). We do not use advertising or tracking cookies without your consent. See our cookie notice at the bottom of the page.

Your rights (UK GDPR)

Under UK GDPR, you have the right to:

Access — request a copy of the data we hold about you
Erasure — request deletion of your data (photos are deleted automatically after 24h)
Rectification — correct inaccurate data
Portability — receive your data in a machine-readable format
Object — object to processing in certain circumstances

To exercise any of these rights, email us at support@smartpassportphoto.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Legal basis for processing

We process your data on the basis of contract performance — you provide your photo and email in order to receive the service you purchased. We process payment data on the basis of contract performance and legal obligation.

Children

Our service is not directed at children under 16. If you are under 16, please ask a parent or guardian to complete the order on your behalf.

Changes to this policy

We may update this policy from time to time. Material changes will be noted at the top of this page with an updated date. Continued use of the service after changes constitutes acceptance.

Contact

For any privacy-related questions: support@smartpassportphoto.com