Last updated 30 July 2026
Privacy policy
TechKnowlogy Consulting Ltd · SC-PRIV-001 · v1.0
Say Cheese lets guests at an event share photographs and video from their phones. Photographs of people are personal data, so this policy explains what we collect, why we hold it, who we share it with, how long we keep it and what rights you have. It sits alongside our Terms & Conditions and our Cookie Policy.
1 Who We Are
- Controller: TechKnowlogy Consulting Ltd, trading as Say Cheese
- Company number: 15308472
- Registered office: 4 Moonshine Way, Stevenage, Hertfordshire
- Privacy contact: [email protected]
- Website: www.say-cheese.io
- Version: 1.0 · effective 30 July 2026
2 Who Is Responsible For What
Two organisations are usually involved in an event, and it matters which one you need to contact.
If your request concerns a photograph a Host has downloaded or published, contact that Host. For anything on the platform, contact us.
| Party | What they are responsible for |
|---|---|
| Say Cheese (controller) | The platform itself: your account, the event gallery, storage of uploaded photographs and video, moderation, security, and the emails and text messages we send. We decide how the platform processes this information and this policy covers it. |
| The Event Host (separate controller) | What they do with photographs after they download them, including keeping them, printing them, and any marketing use permitted by our Terms. Once content leaves the platform, the Host decides what happens to it and their own privacy information applies. We cannot control or retrieve those copies. |
3 What We Collect
| Who | Information |
|---|---|
| Event Hosts | Name, email address, password (stored only as a hash, never in readable form), telephone number where you enable two-step sign-in, language and currency preference, organisation membership and role, event settings, and records of sign-in sessions. |
| Guests | The display name you enter, your email address if you choose to give one, an optional profile photograph, and a device recognition identifier used for safety. You do not create an account and you never set a password. |
| Photographs and video | The images and clips you upload, any caption you add, and technical details such as file type, size and length. Images may show you and other people, and may carry information embedded by your phone such as the time taken and, on some devices, location. |
| Activity | Reactions, guesses, award votes, anonymous posts, reports you submit, and which items you have downloaded, all linked to your guest record for the event. |
| Technical | IP address, browser and device information, and security records such as failed access-code attempts. |
| Payments | Purchase records, plan and price. Card details are entered directly with our payment provider and never reach our servers. |
4 Why We Use It, And Our Lawful Basis
Where we rely on legitimate interests we have considered whether our interest is overridden by your rights. You can object to that processing at any time using the contact details in section 1.
| Purpose | What this involves | Lawful basis |
|---|---|---|
| Running an event | Letting you join, upload, view the gallery and appear on the live screen | Performance of a contract, and our legitimate interest in operating the service for guests who have no account |
| Moderation and safety | Screening uploads, reviewing reports, removing content, banning abusive participants | Legal obligation, and our legitimate interest in keeping the service safe and lawful |
| Marketing use by a Host | Passing your photographs to a business Event Host for promotional use | Your consent, given by a separate tickbox that is not required in order to take part |
| Account and security | Sign-in, two-step verification, session management, fraud and abuse prevention | Performance of a contract, and our legitimate interest in securing accounts |
| Service messages | Verification, password reset, invitations, your photo link, event reminders and recaps | Performance of a contract, and our legitimate interest in telling you your photos are ready |
| Payments and records | Taking payment, issuing receipts, keeping accounting records | Performance of a contract, and legal obligation |
| Improving the service | Diagnosing faults and understanding how features are used | Our legitimate interest in maintaining and improving the platform |
5 Photographs Of People
A photograph showing an identifiable person is personal data about that person, whether or not they uploaded it. That means a photograph you upload may contain personal data belonging to other guests.
A photograph is not automatically special category data simply because it shows a face. We do not carry out facial recognition, we do not create biometric templates and we do not use images to uniquely identify anyone. Our Terms prohibit Event Hosts from doing so through the platform. If we ever introduced such a feature we would obtain explicit consent first and update this policy before switching it on.
A photograph can still reveal sensitive things about a person, such as their apparent health, religion or ethnicity. We do not use images to infer any of that, and we ask Event Hosts and guests to think before uploading a photograph of someone who would not expect it.
6 Children
You must be 18 or over to create an account or purchase an event. Anyone under 18 may take part in an event only with the knowledge and agreement of a parent or guardian.
Some events, including public and festival events, are configured so that images showing children are rejected in moderation and never reach the gallery or the live screen. Where a parent or guardian asks us to remove an image of their child, we will do so without needing a reason.
7 Moderation, Screening And Automated Tools
Every photograph and video is automatically screened against a database of known unlawful images before it can be published anywhere. This is a hash-matching check, not artificial intelligence, and it does not attempt to identify anyone. If the check cannot be completed the item is withheld rather than published.
People also review content. Depending on how the Event Host has configured the event, either every item is approved by a moderator before it appears, or items appear on submission and are reviewed following a report. Everyone with moderation access is 18 or over and is bound by a written confidentiality and data protection undertaking.
We may introduce artificial intelligence tools to help detect unsuitable content. We will update this policy and our Terms before applying such tools to live events. Where an automated tool restricts or removes your content, you can ask for a person to review that decision. We do not make decisions producing legal effects, or similarly significant effects, on you by solely automated means.
9 Where Your Information Goes
Our infrastructure is operated within the United Kingdom and the European Economic Area wherever the provider offers it. Some of our providers are established in the United States. Where personal data is transferred outside the United Kingdom, we rely on the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, or on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it.
10 How Long We Keep It
| Information | Retention |
|---|---|
| Photographs and video | Up to 12 months from the event, unless a different period is agreed for that event, then deleted from the platform |
| Guest record and display name | Deleted with the event to which it belongs |
| Guest session | Expires when the event ends, and in any case within 30 days |
| Photo revisit links | 24 hours, single use, and stored only as a hash |
| Host account | For as long as the account is open, then deleted or anonymised |
| Safety and ban records | Kept while needed to protect events from repeat abuse, then deleted |
| Payment and accounting records | Six years, as required by tax law |
| Backups | Deleted content may persist in encrypted backups for a limited period and is not restored except for disaster recovery |
11 How We Protect It
- Photographs and video are held in private storage with no public access. They are delivered only through links that expire after one hour, and are never served from a public web address.
- Files are stored under random identifiers that cannot be guessed or enumerated.
- Access to an event requires the host's access code. Guest sessions are restricted to a single event and can be revoked.
- Passwords are hashed and never stored in readable form. Event access codes are encrypted at rest.
- Traffic is encrypted in transit. Upload endpoints are rate limited and file types are checked before storage.
- Moderation access is restricted to people bound by a written confidentiality undertaking, and is withdrawn after the event.
12 Your Rights
Under UK data protection law you have the right to:
Email [email protected]. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive. We may ask for enough information to be satisfied who you are, particularly where a request concerns a photograph, so that we do not disclose someone else's image to the wrong person.
A photograph of you that someone else uploaded. You do not have to have used Say Cheese yourself to ask us to remove an image of you. Tell us the event and describe the photograph and we will find it and take it down.
- ask for a copy of the personal data we hold about you
- have inaccurate information corrected
- ask us to delete your information, including any photograph of you
- ask us to restrict how we use it, or object to our use of it
- withdraw consent at any time, where we rely on consent, without affecting use before you withdrew
- receive certain information in a portable format
- ask for a person to review a decision made about your content by an automated tool
13 What We Cannot Undo
We can remove a photograph from the gallery, the live screen and our storage. We cannot recall copies that have already been downloaded, printed, published or shared by someone else. Where an Event Host holds such copies, they are responsible for acting on your request, and we will pass it on and support it.
15 Complaints
If you are unhappy with how we have handled your information, please tell us first at [email protected] so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection.
- Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · 0303 123 1113 · www.ico.org.uk
16 Changes To This Policy
We update this policy when the service changes or the law requires it. The version number and effective date are shown in section 1. Where a change materially affects how we use your information, we will tell affected Event Hosts by email and show a notice on the platform before it takes effect. If we introduce artificial intelligence moderation tools, or any use of images to train models, we will update this policy before doing so, as stated in section 7.
17 How To Contact Us
- Privacy and image removal: [email protected]
- Postal address: TechKnowlogy Consulting Ltd, 4 Moonshine Way, Stevenage, Hertfordshire
- Related documents: Terms & Conditions (SC-TC-001) and Cookie Policy (SC-COOK-001), both at www.say-cheese.io