RealShot Privacy Notice Live Check
How RealShot processes personal and biometric data when a platform sends you to a live check what we collect, why, how long we keep it, and the rights you have.
1. What RealShot does
RealShot confirms, for online platforms, that a profile photo belongs to a real, present person. When a platform you use sends you to a RealShot live check, you take a short selfie video; RealShot confirms a live person is present and compares that person with the profile photo the platform provided.
RealShot does not collect or verify your name, identity documents, date of birth or age.
2. Who is responsible
For the live check, RealShot is the data controller and Amazon Web Services EMEA SARL (Ireland) is our processor for liveness detection and face comparison (Amazon Rekognition). The platform that sent you to the check is a separate controller for your account on that platform.
3. What data is processed
| Data | Purpose | Kept by RealShot? |
|---|---|---|
| Selfie video frames (biometric data) | Liveness detection: confirm a live person is present | No. Processed by AWS Rekognition in Ireland and not stored by RealShot. |
| One reference frame from the video | Compared with the profile photo | No. Used for the comparison and then discarded. |
| The profile photo supplied by the platform | The image you are compared against | Held only for the duration of the check (at most 15 minutes), then deleted. A SHA-256 fingerprint of the photo is kept. |
| Result of the check: verified / not verified, liveness and similarity scores, timestamps | Issue the verification; detect repeated fraud attempts; audit | Yes. Kept in RealShot's records (EU, Ireland). |
| Your platform user ID (as chosen by the platform) | Link the result to your account on that platform | Yes. RealShot never receives your name or email. |
| Technical data: IP address, device/browser type, timestamps | Security, rate limiting, error diagnosis | Yes, for [90] days. |
4. Legal basis
Facial data used to identify a person is "special category" data under the GDPR. RealShot processes it on the basis of your explicit consent (Article 9(2)(a)), which you give by tapping "I agree, start the live check". You can decline by closing the page; nothing is recorded before you tap Start. The non-biometric results are processed on the basis of our legitimate interest in providing a trustworthy verification service and preventing fraud (Article 6(1)(f)).
5. Where data is processed
All processing takes place in the European Union (Ireland and Germany). RealShot's records are hosted with [Supabase, Inc. EU region (Ireland)] and [Render Services, Inc. EU region (Frankfurt)]; verification signatures are produced with Amazon Web Services in Frankfurt. [Confirm each provider's DPA and any onward-transfer terms.]
6. How long we keep data
- Biometric data (video, reference frame): not retained by RealShot.
- Profile photo: deleted on completion of the check or after 15 minutes, whichever comes first.
- Verification results, scores and photo fingerprint: [retained for the life of the verification plus 12 months], then deleted or anonymised.
- Technical logs: [90] days.
7. Who receives your data
- The platform that sent you to the check receives the result (verified / not verified / re-check required / revoked), the photo fingerprint, timestamps, and a signed verification record. It does not receive your face or the video.
- Amazon Web Services (processor) receives the video frames and the profile photo for the duration of the check.
- No other third parties. RealShot does not sell or share data for advertising.
8. Your rights
You can ask RealShot to access, correct, delete or restrict the data we hold about your check, to object to processing, and to withdraw consent (which does not affect processing already carried out). Because RealShot holds only a platform user ID and no name, please contact the platform first; it can identify your record and pass the request to us, or contact realshot.app@gmail.com with the platform name and your user ID. You can complain to the Irish Data Protection Commission (dataprotection.ie) or your local authority.
9. Automated decisions
The live check is automated. A failed check does not by itself block your account; the platform decides what a result means. You can retry, and you can contact the platform for a human review.
10. Changes
We will post changes here with a new "last updated" date.