Overview
Lasso (“we,” “us,” or “our”) operates a post-event photo platform that helps event organizers distribute photos to attendees and measure the marketing impact of that distribution. This Privacy Policy explains how we collect, use, and protect information from both event organizers and event attendees.
This policy covers two distinct user types:
- Organizers — individuals or businesses who create a Lasso account to publish and share event photo albums
- Attendees — individuals who access a Lasso photo album via a shared link to find and download photos of themselves
Information We Collect
From Organizers
| Data | Purpose |
|---|---|
| Full name and email address | Account creation and login |
| Password (hashed, never stored in plain text) | Account authentication |
| Brand name, logo, brand color | Album customization |
| Billing information | Processed by Stripe; we do not store full card details |
| Event and album data (event name, date, occasion type, venue, attendee count, ticket link) | Album creation and management |
| Uploaded photos | Face matching and album delivery to attendees |
| Usage and analytics data | The album report and dashboard analytics shown to the organizer |
| Terms acceptance record (when you accepted, the version you accepted, your IP address and browser) | Proof that you accepted the Terms of Service and this Privacy Policy |
From Attendees
| Data | Purpose |
|---|---|
| Mobile phone number or email address | One-time passcode (OTP) sign-in, and shown to the organizer whose album you join |
| First and last name | Your account, and shown to the organizer whose album you join |
| Selfie image / facial recognition data | Matching you to your photos from the event. Never shared with organizers |
| Marketing preferences (email and text opt-ins, per organizer) | Recording whether an organizer may contact you, and showing that choice to the organizer |
| Photo interaction data (views, saves, shares, likes) | Engagement reporting to the event organizer in aggregate form |
| Album visits, counted per browser using a random identifier stored on your device, and how you arrived (QR code, a shared link, the organizer’s link) | Showing the organizer how many people opened the album and where they came from, as counts only |
| Consent records: what you agreed to and when, the wording version shown, the album an opt-in was given from, your IP address and browser (user agent) | Proof of your biometric consent and of each marketing opt-in or opt-out, should it ever be questioned |
How We Use Your Information
Organizer data
- Create and manage your Lasso account
- Power your album dashboard and album reports
- Process subscription payments via Stripe
- Send transactional emails such as password reset links
- Improve the platform
Attendee data
- Verify identity via a one-time SMS passcode
- Match your face to photos from the event you attended
- Provide access to your matched photos for viewing and downloading
- Show the organizer whose album you joined the name, phone number and email you entered, when you joined, and whether you opted in to hear from them
- Send you marketing email or texts from an organizer only if you opted in to that organizer
- Report aggregate engagement metrics to the event organizer (e.g. total views, total saves)
SMS Communications
Verification codes. By entering your phone number on a Lasso sign-in page, you consent to receive a one-time passcode via SMS to verify your identity. Message and data rates may apply. You will not receive further verification messages unless you sign in again.
Guest upload invitations. An organizer may enter a phone number to invite someone to add photos to their album. That person receives a single transactional text with a one-time link. It is not marketing.
Marketing texts from organizers. When you join an organizer's album you may choose to receive marketing texts from that organizer. The box is never pre-checked and is never required to use Lasso or to see your photos. If you opt in, the organizer may send automated marketing texts to your number through Lasso. Message frequency varies. Message and data rates may apply.
To stop any texts, reply STOP to any message from us. For help, reply HELP or contact hello@lasso.pics.
Biometric Data and Facial Recognition
Lasso uses facial recognition technology to match event attendees with photos in which they appear. This section is our biometric notice and retention schedule, and it applies to attendees.
Collection. When you take a selfie during onboarding, your facial geometry is extracted and used to search for matching photos in the event album. Your consent to this is explicit and in writing: you must check the biometric consent box, which is never pre-checked, before the camera opens. The selfie itself is retained alongside the face data so matching can run on albums you join later.
Processing. Facial recognition processing is performed using a combination of our own infrastructure and Amazon Web Services (“AWS”). AWS processes facial data solely under our instruction and is contractually prohibited from using it for any independent purpose. No other third party receives your facial data in identifiable form.
We do not sell, lease, trade, or profit from biometric data. Facial recognition data is a mechanism for delivering the photo-finding service — it is not itself a product we monetize or share.
Retention and deletion. Your selfie and facial recognition data are permanently destroyed when the first of these happens: 12 months pass with no sign-in, no new album joined and no photos claimed; you delete your selfie from Account; or you delete your account. Deleting your selfie or account removes the face data from our matching index and the selfie from storage immediately. You can also request deletion by contacting hello@lasso.pics.
Organizer responsibility. Event organizers upload photos to Lasso that may contain images of attendees. By uploading photos to Lasso, organizers represent that they have the right to do so and that attendees have been or will be given the opportunity to access and manage their data through this policy.
How We Share Your Information
We do not sell personal information belonging to organizers or attendees.
We may share information with:
- Stripe — for payment processing on organizer accounts. Stripe's privacy policy governs their handling of billing data.
- Amazon Web Services — for cloud infrastructure and facial recognition processing, under strict data processing agreements.
- Other infrastructure providers — for hosting, storage, and SMS delivery, each bound by confidentiality and data processing obligations.
With event organizers. When you join an organizer's album, that organizer can see the name, phone number and email address you entered, the date you joined, and whether you opted in to hear from them by email or text. Organizers are told that only guests who opted in may be contacted. We never share your selfie, your facial data, or which photos you were matched in with organizers; they receive engagement metrics in aggregate.
Data Retention
| Data type | Retention period |
|---|---|
| Organizer account data | Retained while the account is active; removed by our deletion process after you delete your account |
| Album and event data | Retained while the account is active; albums are soft-deleted when the organizer deletes them or their account |
| Attendee account data (name, phone, email) | Retained while the account is active; removed when you delete your account |
| Selfie and biometric / facial data | Deleted after 12 months of inactivity, when you delete your selfie from Account, or when you delete your account, whichever comes first |
| Consent records | Retained indefinitely as proof of consent. When you delete your account, your identity, IP address and browser details are removed and the rest of the record is kept anonymized |
| Event tracking data | Raw events kept up to 2 years, then aggregated; your identifier is anonymized when you delete your account |
| SMS and email delivery logs | Retained for delivery troubleshooting and consent proof; message content is not stored beyond the template used |
Your Rights
Both organizers and attendees have the right to:
- Access the personal information we hold about you
- Correct inaccurate or incomplete data
- Delete your account and associated personal data
- Withdraw consent for biometric data processing at any time
- Export your data in a portable format upon request
Attendees can delete their selfie and facial data at any time from Account without deleting their account, and can delete their account from the same page. Organizers can delete their account from Settings. Account deletion is irreversible and is confirmed by email.
To exercise any other right, contact hello@lasso.pics. We will respond within 30 days.
Scope. Lasso is designed to meet the Telephone Consumer Protection Act (TCPA) for text messages, the California Consumer Privacy Act (CCPA) for California residents, and the Illinois Biometric Information Privacy Act (BIPA) for biometric data. This service is intended for US residents. EU residents may contact hello@lasso.pics for data requests.
Children's Privacy
Lasso is not directed at individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it promptly.
Security
We implement reasonable technical and organizational safeguards to protect personal information, including encrypted storage, access controls, and secure transmission protocols. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
Changes to This Policy
We may update this Privacy Policy from time to time. We will update the “Last updated” date at the top of this page when we do. Continued use of Lasso after changes are posted constitutes acceptance of the updated policy. For material changes, we will notify organizers by email.
Contact
For questions, data requests, or privacy concerns:
Lasso
hello@lasso.pics