Privacy

1. Who we are

Code Cacto is the developer of FotuNex and the controller of the data described here. Data Protection Officer (DPO) for privacy matters: [email protected].

2. What data we collect

• Registration data: name, email and phone number you provide when creating your account. Your password is stored only as a hash — we cannot read it.
• Account: name, email, username, phone (if you provide it) and your language, currency and email preferences.
• Orders: the photos you bought, the amounts, the payment method reported by the gateway and your download history.
• Photographers and organizers: public page details, team members and the payout account.
• Selfie search: the image is used only during the search and deleted right after; we keep only which photos matched, for 24 hours.
• Payment data: provided by you on the payment gateway's page, not here. We only receive back the confirmation and the charge identification — never the card number.
• Approximate location: the city and country estimated from your IP address when you use the service, so we know in which regions it is used. We don't use GPS, and the IP address is not stored.
• Messages you send us through feedback or contact forms, with whatever you type in — so we can reply.

3. What we use it for

We use the data to operate FotuNex, respond to what you write to us, process billing and improve the product. We do not sell personal data, and we do not use it for third-party advertising.

4. Legal basis

We process data to perform the contract with you (what the product needs to work), to comply with legal obligations (e.g. tax record-keeping), and for the legitimate interest of keeping the service secure and improving it. Where the law requires consent, it is requested explicitly.

5. Who we share data with

We share the minimum necessary, always under a confidentiality obligation:

• Event photographer: receives your first name and last-name initial with the sale, to check the order.
• Infrastructure providers that host the service.
• Payment gateway, to process billing.
• Authorities, when there is a legal order to do so.

6. How long we keep it

For as long as your account exists. When you request deletion, your account will be permanently deleted after 30 days; during that period it stays locked, with the data kept, so you can change your mind. On permanent deletion, we erase the associated personal data, except what the law requires us to keep (tax and access records). Contact messages are kept for the duration of the support case.

7. Your rights

Brazil's General Data Protection Law (LGPD) entitles you to confirm the existence of processing, and to access, correct, port and delete your data, as well as to withdraw consent. Deleting your account is available directly in the website: your account will be permanently deleted after 30 days from the request, and during that period you can change your mind. For any of these requests, write to [email protected] — we reply within 15 days.

8. Children and teenagers

The service is not intended for anyone under 13 years old, and we do not knowingly collect data from that age group. If this happens, delete it on the website or let us know at [email protected] and we will remove it.

9. Biometrics (selfie search)

The selfie you send for a search is biometric data. It is used only to find your photos, is never shared and is deleted as soon as processing ends — neither the image nor the face vector is kept.

We ask for your consent before every search. If you turn on photo alerts, we keep the face vector (not the image) with consent renewed every 12 months, and you can delete it at any time.

10. Your right to your own image

Don't want to appear in a photo? Use Remove my photo: we hide it in every event and reply within 2 business days. Photos of minors are hidden immediately.

11. Changes

This policy may be updated. Relevant changes are published on this page, with the revised date — and, when they affect the use of your data, we notify you within the product.