RACECAPTURE.
PRIVACY POLICY

RaceCapture is built for athletes, organizers, photographers, and the communities around them. That includes how we handle your data. We collect only what we need to deliver your media, protect it carefully, and never sell it.

This policy applies to all users of RaceCapture — including athletes searching for event photos, event organizers, and photographers using the RaceCapture Community Portal.

We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25 / Bill 64).

Last updated: April 2026  ·  Governing law: Federal Canada & Province of Ontario

Back to Galleries Jump to Details
No Data Resale Selfie Consent Controls PIPEDA Compliant Quebec Law 25 Compliant Stripe Secure Payments Photo Removal on Request Canadian Data Residency
Athletes Facial Recognition Community Photographers Payments Data Retention Your Rights Breach Policy Contact

At a glance — what we collect

  • Athletes: Name and email when you purchase media or contact us. Purchase history and transaction metadata. Race photos and bib numbers from events you attend.
  • Selfies (facial search): Used for matching only. If the gallery is live and you consent, your selfie is retained during the active gallery period only to allow re-searching — then permanently deleted when the gallery closes. If you do not consent, or the gallery is closed, your selfie is deleted immediately after matching. We never build profiles from selfies.
  • Community Photographers: Account details, payout information, event data, and sales records necessary to operate your account and process your earnings.
  • All users: Basic usage logs, performance data, and anonymised analytics to keep the platform stable.

We use this data to

  • Deliver your photos and purchase receipts.
  • Help athletes find their images via search tools.
  • Process payouts to Community Portal photographers.
  • Maintain, secure, and improve the RaceCapture platform.
  • Meet our legal obligations under PIPEDA and Quebec Law 25.

We never

  • Sell personal data to advertisers or data brokers.
  • Store or access your full payment card details (Stripe handles this).
  • Retain selfies or long-term facial recognition data.
  • Build biometric profiles, facial datasets, or AI training sets from athlete images.
  • Transfer personal data outside Canada without equivalent privacy protections in place.

ATHLETE DATA

What we collect about you as an athlete, why we collect it, and how long we keep it.

Event Photos

Race Day Media

We photograph and film races to create athlete galleries and event highlight content. This content may include your likeness, bib number, and people near you on course or at the venue.

  • Photos are stored securely in managed Canadian cloud storage.
  • Galleries remain online after race day so athletes can access them.
  • Race photographers operating under the RaceCapture Community Portal are bound by a Photographer Agreement that includes privacy obligations.
  • You may request removal of specific images where you are the identifiable primary subject.
Purchases

Order & Purchase Data

When you purchase photos, we collect the minimum information needed to complete and deliver your order.

  • Name and email address for order confirmation and delivery.
  • Event and package details linked to your purchase.
  • Transaction metadata from Stripe (not your card details — those stay with Stripe).
  • Purchase records are retained for 7 years to meet Canadian tax and accounting obligations.
  • Your email may be used to notify you of delivery status and, with your consent, future events from the same organizer.
Bib Search

Bib Number Search

Bib numbers are used as a search index to help you find your photos quickly.

  • Bib data is linked to event images only — not to personal registration data from organizers.
  • Bib numbers are never sold, shared with advertisers, or used for any purpose other than search.
  • Bib data is retained as long as the event gallery remains active.

FACIAL RECOGNITION

We take facial biometric data more seriously than any other category of personal information. Here is exactly how it works, what we store, and what we don't.

Your Selfie — Find My Photos

What Happens to Your Selfie

When you upload a selfie to find your race photos, the following process occurs:

  • Your selfie is transmitted securely to our matching system.
  • It is compared against facial index data from the event you selected.
  • Matching results are returned to you immediately.
  • If the event gallery is live and active: You will be asked whether you consent to your selfie being retained for the duration of the active gallery only, so you can re-search without re-uploading. If you consent, your selfie is stored temporarily and permanently deleted when the gallery closes. If you do not consent, your selfie is deleted immediately after your search completes.
  • If the gallery is closed: Your selfie is deleted immediately after matching. No exceptions.
  • We do not build a facial profile from your selfie. We do not add it to any dataset. We do not use it to train any model.
Event Photo Indexing

Photos Already at the Event

To enable the selfie search feature, we process uploaded event photos using AWS Rekognition to create a facial index for each event.

  • Facial feature vectors (not photos) are stored temporarily to enable search for the duration the gallery is active.
  • These vectors are mathematical representations — not images — and cannot be used to reconstruct a face.
  • They are deleted when an event gallery is retired or upon request.
  • This processing is performed under the authority of the event organizer, who is responsible for obtaining appropriate consent from athletes through event registration waivers.
  • By using the selfie search feature, you confirm you are the person in the selfie and you consent to this one-time matching process.
Quebec Law 25 — Biometric Data Notice: Facial recognition constitutes the collection of biometric data under Quebec's Act Respecting the Protection of Personal Information in the Private Sector. RaceCapture has conducted a Privacy Impact Assessment (PIA) covering this technology. We act as a data processor on behalf of event organizers, who are the data controllers responsible for athlete consent at registration. Athletes may contact us at info@racecapture.ca to request deletion of any facial index data associated with their image from a specific event.
Content Moderation: All photos uploaded to the RaceCapture platform are automatically screened for inappropriate or explicit content using AWS Rekognition content moderation before they are published or made searchable. Images flagged at high confidence are quarantined and reviewed before any athlete can access them.

COMMUNITY PHOTOGRAPHERS

This section applies to photographers using the RaceCapture Community Portal. As a platform user, you have specific responsibilities regarding the personal data of athletes whose images you upload.

Your Account Data

What We Collect From You

To operate your photographer account, we collect:

  • Full legal name, email, and contact information.
  • Stripe Connect account details to process and remit your earnings.
  • Event data you create and manage on the platform.
  • Sales records, transaction history, and payout logs.
  • Platform usage data and login history.
  • Any support communications between you and RaceCapture.
Your Responsibilities

Photographer Obligations

By using the Community Portal, you agree to the RaceCapture Photographer Agreement and accept the following responsibilities:

  • You own or hold appropriate rights to all images you upload.
  • You are responsible for ensuring event organizers have obtained appropriate consent from athletes for photography and facial recognition processing at registration.
  • You are the data controller for athlete images you upload. RaceCapture acts as a data processor on your behalf.
  • You must not upload content that is explicit, illegal, or in violation of any individual's rights.
  • You are solely responsible for the content you upload. RaceCapture is a passive platform host.
  • Violations of these obligations may result in account suspension and legal liability.
Platform Liability

Limitation of Liability

RaceCapture operates as a technology platform and is not a publisher, editor, or co-creator of photographer-uploaded content.

  • RaceCapture is not liable for content uploaded by Community Portal photographers.
  • Photographers indemnify RaceCapture against any claim, loss, or expense arising from their uploaded content, their events, or their use of the platform.
  • RaceCapture reserves the right to remove any content and suspend any account at its sole discretion, without notice and without refund, where content or conduct violates these terms.
  • RaceCapture's maximum liability to any photographer is limited to subscription fees paid in the prior three months.

PAYMENTS & SECURITY

How your payment data is handled and how we keep all data secure.

Payments

Stripe Payment Processing

All payment processing on RaceCapture is handled by Stripe, a PCI-DSS Level 1 certified payment processor.

  • RaceCapture never sees, stores, or has access to your full card number, CVV, or banking details.
  • Payment data is encrypted and stored exclusively by Stripe.
  • Community Portal photographer earnings are disbursed via Stripe Connect directly to photographer-configured bank accounts.
  • Apple Pay and Google Pay are supported and operate under Stripe's tokenization — no card data passes through RaceCapture servers.
Security

How We Protect Your Data

We use industry-standard security practices to protect all personal data.

  • All data is stored in Canadian AWS infrastructure (ca-central-1 region) to ensure Canadian data residency.
  • Data in transit is encrypted via TLS. Data at rest is encrypted via AES-256.
  • Access to personal data is restricted to authorised RaceCapture personnel on a need-to-know basis.
  • Automated content moderation runs on all uploads before public access is granted.
  • We do not use your personal data for advertising, profiling, or sale to third parties under any circumstances.

RETENTION & THIRD PARTIES

How long we keep data, and who else may have limited access to it.

Selfies

Deleted Immediately

Selfies submitted for face search are deleted permanently after matching completes. Retention: zero.

Event Galleries

Active Gallery Period

Event photos and facial index vectors are retained while the gallery is active. Athletes may request early removal at any time.

Purchase Records

7 Years

Purchase and transaction records are retained for 7 years to comply with Canadian tax and accounting law. Contact details linked to purchases follow the same schedule.

Photographer Accounts

Duration of Account + 7 Years

Account data is retained while the account is active. Financial records are retained for 7 years after account closure per CRA requirements.

Third-Party Service Providers: RaceCapture uses a limited number of trusted third-party services to operate the platform: AWS (cloud storage and facial recognition infrastructure, Canadian region), Stripe (payment processing), and Bluehost / WP Engine (web hosting). Each provider is bound by appropriate data processing agreements. We do not share personal data with any other third parties without your explicit consent, except where required by law.

YOUR RIGHTS

Under PIPEDA and Quebec Law 25, you have specific rights regarding your personal information. We take these seriously and will respond to all requests within 30 days.

Access & Portability

Access Your Data

You have the right to know what personal information we hold about you and how it is used.

  • Request a summary of personal data linked to your email or purchases.
  • We will respond within 30 days of a verified request.
  • Requests may be verified to prevent unauthorised access.
Correction

Correct Your Data

If any personal information we hold about you is inaccurate, you may request a correction.

  • Contact us with the specific correction required.
  • We will update records and notify any third parties who received the incorrect data where feasible.
Deletion

Delete Your Data

You may request deletion of personal data we hold about you, subject to legal retention obligations.

  • Request removal of specific event photos where you are the clearly identifiable subject.
  • Request deletion of facial index data from a specific event.
  • Purchase records are subject to 7-year retention under Canadian tax law and cannot be deleted early.
  • Deletion requests for photographer account data will be processed within 30 days of account closure.

DATA BREACH POLICY

In the unlikely event of a data breach, we follow strict notification obligations under PIPEDA and Quebec Law 25.

Notification Timeline

72-Hour Rule

Under Quebec Law 25, we are required to notify:

  • The Commission d'accès à l'information (CAI) within 72 hours of confirming a breach that presents a risk of serious injury.
  • Affected individuals as soon as reasonably possible following notification to the CAI.
  • Under PIPEDA, we are required to notify the Office of the Privacy Commissioner of Canada (OPC) and affected individuals of any breach that creates a real risk of significant harm.
What We'll Tell You

Breach Notification Contents

In any breach notification to affected individuals, we will clearly describe:

  • What personal information was involved.
  • When the breach occurred and when it was discovered.
  • What we have done or are doing to contain the breach.
  • Steps you can take to protect yourself.
  • How to contact us for more information.

PRIVACY CONTACT

For any privacy questions, data access requests, image removal requests, or concerns — contact us directly. We handle all requests personally and will respond within 30 days.

RaceCapture Inc.

Privacy Officer: Sean Menezes

Email: info@racecapture.ca

This policy was last updated April 2026. We reserve the right to update this policy at any time. Material changes will be communicated to registered users by email. Continued use of the platform after a policy update constitutes acceptance of the revised terms.

All rights reserved