Privacy Policy | Smart Passport Photo

Who we are

Smart Passport Photo is an online passport photo service operated by Supertensor Limited (company number 16791776), registered office: 167-169 Great Portland Street, 5th Floor, London, United Kingdom, W1W 5PF. Our website is smartpassportphoto.com. You can contact us at support@smartpassportphoto.com.

What data we collect

We only collect what we need to provide the service:

Your photo — uploaded by you to create a passport photo. This is biometric data.
Your email address — to send your download link and receipt.
Payment information — processed by Stripe (website and digital purchases) or Google Play Billing (in-app purchases on Android). We never see or store your card details.
Shipping address and phone number — for print orders only, to post your prints to you.
Country and document type — to apply the correct photo specification.
IP address — for fraud prevention and to detect approximate country of access.

How we use your data

To process your photo and check compliance
To generate your IDPC code (UK users only)
To send you your download link and order confirmation
To provide customer support if you contact us
To prevent fraud and abuse of the service

We do not use your photo or personal data for AI model training, marketing, or any purpose beyond delivering the service you paid for.

Photo deletion

Your uploaded and processed photos are automatically deleted from our servers within 24 hours of your order. We do not retain biometric data beyond what is necessary to fulfil your order. Once deleted, photos cannot be recovered.

If you order prints, the print-ready file is kept for up to 48 hours so our print partners can retrieve it, then deleted the same way.

Download links also expire after 24 hours. If you need your photo again after this period, you will need to place a new order.

Order records (such as your email address, order history, and — for print orders — your shipping details) are kept for longer, for accounting and fraud-prevention purposes. See "Your rights" below for how to request deletion of this data.

Where your data is stored

Your photos and order data are processed and stored on secure servers located in the United Kingdom (AWS eu-west-2, London). We do not transfer your personal data outside the UK or EU.

Third-party services

We use the following third-party services to operate:

Stripe — payment processing for website and digital purchases. Stripe is PCI-DSS compliant. Stripe Privacy Policy
Google Play Billing — payment processing for in-app purchases on Android. Google Privacy Policy
AWS Rekognition — face detection and compliance checking. Data processed in eu-west-2 (London).
PhotoRoom — background removal. Photos are sent to their API and deleted after processing.
Resend — transactional email delivery.
idphoto.ai — UK IDPC code generation (UK orders only).
Prodigi — print fulfilment for orders shipped to the UK. Your processed photo and delivery address are shared with them to produce and post your prints.
Cloudprinter — print fulfilment for orders shipped to India. Your processed photo and delivery address are shared with them to produce and post your prints.
Anthropic (Claude) — powers our support chat. Messages you send the chatbot, and your email address if you request a transcript, are processed by Anthropic to generate a response.
Google Analytics and Google Ads — site analytics and ad performance measurement, only if you accept non-essential cookies. See "Cookies" below.

Each provider is contractually bound to process your data only as instructed and not to retain or repurpose it.

Cookies

We use essential cookies by default — those required for the site to function (session management, CSRF protection). If you accept non-essential cookies via our cookie notice, we also use Google Analytics and Google Ads to understand site traffic and measure ad performance. You can decline these at any time via the cookie notice.

Your rights (UK GDPR)

Under UK GDPR, you have the right to:

Access — request a copy of the data we hold about you
Erasure — your photos are deleted automatically (see "Photo deletion" above); you can request deletion of your remaining order records (email, order history, shipping details) at any time
Rectification — correct inaccurate data
Portability — receive your data in a machine-readable format
Object — object to processing in certain circumstances

To exercise any of these rights, email us at support@smartpassportphoto.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Legal basis for processing

We process your data on the basis of contract performance — you provide your photo and email in order to receive the service you purchased. We process payment data on the basis of contract performance and legal obligation.

Children

Our service is not directed at children under 16. If you are under 16, please ask a parent or guardian to complete the order on your behalf.

Changes to this policy

We may update this policy from time to time. Material changes will be noted at the top of this page with an updated date. Continued use of the service after changes constitutes acceptance.

Contact

For any privacy-related questions: support@smartpassportphoto.com