AR Mirror Privacy Policy

1. Effective date and scope

This policy applies only to GrowPile AR Mirror experiences and related processing needed to operate those experiences, including capture delivery and service analytics. It does not cover other GrowPile services unless explicitly stated in a separate policy.

2. Who we are / contact

GrowPile provides and operates AR Mirror experiences. For privacy requests, questions, or complaints, contact us at hello@growpile.com.

Depending on the event or campaign, GrowPile and the event organizer or client partner may each determine specific uses of mirror data. In those cases, both parties may act as separate or joint data controllers for their respective processing activities.

3. Data we collect

For AR Mirror operations, we may process:

• Captured photos generated through the mirror experience.
• Operational metadata such as mirror ID, kiosk ID, event code, app version, and timestamped technical logs.
• Usage analytics counters (for example: session starts/ends, lens interactions, capture attempts, upload success/failure, and impression counts).
• Link delivery metadata required to present downloadable captures.

GrowPile does not use AR Mirror data for biometric identification or biometric profiling of individuals.

4. How data is collected

• Directly from camera interactions with the AR Mirror during a session.
• Automatically via mirror telemetry and application logs needed to run, secure, and troubleshoot the experience.
• Automatically via analytics events generated by user interaction with lenses and capture controls.

5. Purposes of processing

We process data to:

• Provide and operate the AR Mirror experience at events or installations.
• Generate and deliver participant captures through QR or link-based access.
• Monitor service reliability, detect faults, and improve performance and quality.
• Measure campaign engagement and operational outcomes.
• Support security, misuse prevention, and legal/compliance obligations.

6. Legal bases (GDPR)

Where GDPR applies, we rely on one or more of the following legal bases:

• Consent, where required for specific processing activities.
• Legitimate interests, including safe operation, analytics, and service improvement.
• Performance of a contract, when processing is necessary to deliver an agreed event/campaign service.
• Legal obligation, where retention or disclosure is required by law.

7. Sharing and recipients

We may share relevant data with:

• Cloud infrastructure and hosting providers used to store captures and operational records.
• Authorized GrowPile personnel and authorized event/client operators who need access to deliver and support the campaign.
• Event organizers or client partners when they are involved in campaign operation, delivery, reporting, or compliance.
• Competent authorities where disclosure is legally required.

Recipients are expected to handle data under applicable confidentiality, contractual, and data protection obligations.

8. Public link/photo access warning

Captures may be delivered through shareable links (for example via QR code). Anyone who obtains the link may be able to access the associated photo. Please treat these links as sensitive and share them only with intended recipients.

9. International transfers (where applicable)

Some processing or storage providers may operate outside your country. Where required, GrowPile applies appropriate safeguards for cross-border transfers, such as contractual protections and other measures recognized under applicable data protection law.

10. Retention approach (campaign-based)

We use a campaign-based retention model. Captured media is retained only as long as needed for campaign delivery, participant access, operational support, and related legal requirements. Operational and analytics records may be retained longer in aggregated or service-level form to support reliability, reporting, security, and compliance.

11. Security measures (high-level)

We apply reasonable technical and organizational safeguards appropriate to the risk, including access controls, authentication measures, service monitoring, and secured infrastructure practices. No system is guaranteed to be fully secure, but we continuously work to reduce risk and respond to incidents.

12. Data subject rights

Subject to applicable law (including GDPR), you may have rights to request access, rectification, erasure, restriction, objection, and data portability. You may also have the right to lodge a complaint with your local supervisory authority.

To exercise rights related to GrowPile processing, contact hello@growpile.com. If your request relates to event/client partner processing, we may direct you to that partner where appropriate.

13. Children's privacy

Where required by law, use of AR Mirror experiences by minors should occur with parent or legal guardian consent and supervision. Event organizers and participating guardians are responsible for obtaining any required permissions in their jurisdiction.

14. Changes to this policy

We may update this policy from time to time to reflect legal, technical, or operational changes. The latest version will be posted on this page with an updated effective date.

This page provides informational policy content and does not constitute legal advice.