From picture day to protected data: how we handle school (FERPA), children’s (COPPA), and biometric privacy
This plain-language overview explains how Captura works with photography studios, schools, families, and their communities to protect student data, children’s data, and biometric information. It is intended for non-lawyer audiences and summarizes how our Services operate today. This overview is current as of May 2026.
This overview is for general informational purposes only and is not legal advice. It does not replace Captura’s Privacy Policy, Biometric Information Privacy Policy, Data Processing Addendum, or Internet Master Services Agreement, and it is not a contract and does not create any rights or obligations. If there is any conflict, Captura’s governing policies and agreements control.
Who we are and how we handle your data
Captura provides an online platform that helps photography studios manage galleries and orders. In most cases, the studio decides how personal information is used and shared. When a studio uses our Services, the studio is responsible for telling people what information is collected and why, and for obtaining any required permissions. Captura processes that information to provide the Services at the studio’s direction.
In limited cases, Captura may handle certain information independently where the law permits or requires it, such as to maintain and secure the Services, prevent fraud or abuse, comply with legal obligations, or generate aggregated, deidentified analytics. No matter who collects the information, we use security measures designed to protect it, and we do not use studio-collected personal information for Captura’s own marketing or unrelated analytics unless it has first been aggregated and deidentified so it cannot reasonably identify a person.
School photos: our approach under FERPA
In this overview, “Student Data” means information from “Education Records” and “personally identifiable information” derived from Education Records, as those terms are defined under the Family Educational Rights and Privacy Act (FERPA), that is uploaded to, transmitted through, collected by, or otherwise processed by the Services in connection with a School.
When a studio serves an educational agency or institution (a “School”) and Student Data is processed through our Services, the School and the studio control how Student Data is used. In that context, Captura may act as a “school official” with a legitimate educational interest under FERPA when we perform an outsourced service for the School, are under the School’s direct control with respect to the use and maintenance of education records, and are subject to FERPA’s limits on use and re-disclosure. In other cases, the School may determine another FERPA disclosure exception applies.
What this means in practice is simple. We use Student Data only to provide the Services and for no other purpose except as required by law. We do not redisclose Student Data unless the School authorizes it or FERPA permits it. We keep Student Data under the School’s and studio’s direction with respect to how it is used and maintained. We do not use Student Data that is personally identifiable to train, develop, or improve any artificial intelligence or machine learning model. If a School asks us to return or delete Student Data, we do so and provide confirmation, except where we are legally required to retain specific records.
If you are a parent or eligible student and want to access, correct, or delete Student Data, please contact your School. We will cooperate with the School to help it respond to your request.
Children’s privacy and COPPA
The Children’s Online Privacy Protection Act (COPPA) can apply to services directed to children or services that have actual knowledge they are collecting personal information from children under 13.
Our Services are not directed to children under age 13, and children under 13 are not permitted to create or use accounts on our Services. Captura does not knowingly collect personal information directly from children under 13 through any Captura-operated interface, and children under age 13 are not permitted to create accounts or use our Services. If we learn that a child under 13 has provided personal information directly to Captura, we will promptly delete it.
When children’s information is involved, all collection provided to Captura occurs through adults or institutions:
School directed uses. If a feature is used in the classroom or on a School’s behalf, Schools may provide consent on parents’ behalf for the collection of children’s personal information, but only for a school-authorized educational purpose and not for any other commercial use. We provide the required notices to the School, make those notices available to parents where feasible, and allow the School to review and request deletion of children’s information. We do not use children’s information for advertising, profiling, or other commercial purposes unrelated to the Services.
Nonschool studio uses. Outside the school context, studios are responsible for obtaining any legally required parental permissions before they provide children’s personal information to Captura for order fulfillment or gallery access. Captura processes that information at the studio’s direction and does not engage with children under 13 directly.
How we handle biometric information (face templates derived from photos)
What we collect and when. Captura offers optional photo matching features that use face geometry information derived from photos (the “SelfieMatch Feature”). These features are disabled by default and are enabled only by a studio for a specific job or gallery, or by an individual age 13 or older who chooses to use the feature. Children under 13 may not use any Captura-operated biometric feature directly. If a School or studio uses photomatching for young children, any necessary notices and parental permissions are provided and managed by the School or studio, and Captura processes at their direction.
Consent comes first. Before any face template is collected, we or the studio obtain informed consent from the person (or, where legally required, from a parent or guardian for minors). When the studio enables the feature, the studio is responsible for providing required notices and obtaining required consents. When Captura offers a feature that collects face templates directly from individuals age 13 or older, Captura provides the required notices and obtains consent itself.
What we use it for—and what we do not. We use face templates only to provide photomatching requested by a studio or the end user. We do not sell, lease, trade, or otherwise profit from biometric data. We do not use biometric data to train, develop, test, validate, or improve any artificial intelligence or machine learning system. If a photographer opts in to our separate AI training program, we may use specifically designated photographs for AI training focused on stylistic attributes such as composition and lighting, but we do not derive or use any biometric identifiers or biometric information for that purpose.
Who we share it with. We share biometric data only with our authorized service providers who are bound to use it solely to provide photo matching for Captura and to delete it on our instruction. When we use Amazon Web Services (including Amazon Rekognition) to power the SelfieMatch Feature, AWS acts as our subprocessor and is contractually prohibited from using biometric data to train its own models or for any other purpose. We remain responsible for our subprocessors’ handling of biometric data.
How long we keep it. We maintain a written biometric retention schedule and destruction guidelines. We permanently delete face templates when the original photomatching purpose has been satisfied or within one year of the individual’s last interaction with the SelfieMatch Feature—whichever comes first—and in all cases no later than three years after the individual’s last interaction with Captura. If you or your studio requests earlier deletion, we delete it sooner unless the law requires us to keep it.
How we protect it. We store, transmit, and protect biometric data using safeguards designed to be appropriate for the sensitivity of biometric data. Access is limited, encryption is used where appropriate, and we regularly review our safeguards.
State and local biometric rules that may affect studios
We design our program to meet or exceed leading biometric privacy requirements. Some jurisdictions add specific rules for businesses that collect face geometry or other biometric data. If you operate in these places, your studio may have additional obligations. Captura helps studios configure features and notices to support compliance.
Examples of common requirements include: prior notice that explains the specific purpose and duration of collection, storage, and use of biometric data; informed written consent prior to collection (including parental or guardian consent where required by law); a publicly available retention and destruction policy; restrictions on disclosure to third parties; prohibitions on selling, leasing, trading, or otherwise profiting from biometric data; deletion within a reasonable time after the purpose is satisfied (with some states setting specific maximums); and, in some jurisdictions, individual rights or remedies.
Enforcement and remedies vary. Illinois provides a private right of action. Texas empowers the Attorney General to seek civil penalties. Washington’s biometric statute is enforced by the Attorney General. New York City’s ordinance prohibits selling or profiting from biometric data and requires clear signage at customer entrances for commercial establishments that collect biometric information; it also allows individuals to sue and provides statutory damages. Portland, Oregon, prohibits private businesses in places of public accommodation from using facial recognition technologies and allows private suits; we disable facial recognition features for Portland venues.
Note: Many state privacy laws treat biometric data as “sensitive,” which typically requires opt-in consent and careful handling. Our consent-first, purpose-limited, no-sale approach is designed to meet those expectations.
AI and training data
We do not use biometric identifiers or biometric information to train AI or machine learning models. We may use aggregated and deidentified information (which cannot reasonably identify a person) to improve our products and services. Separately, a photographer may opt in to allow us to use specifically designated images to train AI models focused on stylistic attributes such as composition and color. That opt-in program never involves extracting or using faceprints or other biometric identifiers.
Your choices and how to reach us
If your personal information was collected by a studio using our Services and you want to exercise a privacy right (for example, to access or delete your information), please contact the studio that collected it. We will work with the studio to help it respond. If Captura collected your information directly—for example, if you used a Captura operated feature—contact us at privacy@captura.io. If you ask us to delete a Capturamanaged account, we will delete the account within 30 days and send a confirmation, subject to any legal retention requirements. Biometric data follows the stricter deletion timeline described above.
Subprocessors
We use carefully selected service providers to help us operate the Services. Where they process personal information on our behalf, they are bound by contractual obligations to use the information only to provide services to us, to protect it, and to delete it upon instruction.
Contact us
Questions? Please contact us at privacy@captura.io. If your question relates to Student Data or records for a specific school, please contact the School first and copy us if helpful so we can support their response.
Legal notice: This page is for general information only and is not legal advice. It does not modify any contract or policy and does not create any rights or obligations. Laws change and vary by location; this is not an exhaustive summary. Where studios or schools direct collection and use of personal information, they are responsible for required notices and permissions. Captura remains responsible for its own Services and legal obligations. We may update or withdraw this page at any time without notice. Nothing here limits your rights under applicable law.