Help · biometric processing
Biometric data, plainly: what we keep, what we delete.
PodiumBase can match your face to race photos using AWS Rekognition. This page explains what data we process, how long we keep it, and your rights. We last updated it on June 6, 2026.
What we process
When an athlete uploads a selfie to find their race photos, we compute a face embedding — a mathematical representation of facial geometry — and compare it against the embeddings extracted from photographers’ uploaded race photos for the same event. The embeddings are biometric identifiers under U.S. state laws including the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and Washington’s RCW 19.375.
Face embeddings are scoped to a single race’s AWS Rekognition Collection. We do not cross-match faces between events. We do not sell or rent biometric data. We do not share embeddings with third parties beyond AWS Rekognition (our sub-processor, under a written data-processing agreement).
Retention schedule for biometric data
- Face embeddings (mathematical representations) are stored in a per-event AWS Rekognition Collection.
- Embeddings are permanently deleted when the event closes, OR upon explicit race director purge action, OR within 60 days of the event date, whichever occurs first.
- Raw selfie images uploaded by athletes are permanently deleted within 60 seconds of matching — only matched-photo IDs are returned.
- In all cases, no biometric data is retained beyond 3 years from the data subject’s last interaction with the service.
State biometric laws
For our V1 launch, the selfie photo-search surface is gated for visitors located in Illinois. Illinois athletes can still find their race photos by searching their bib number; the face-matching upload option is hidden in that state pending external counsel review of our consent flow against the latest BIPA case law. Texas and Washington residents see the normal flow.
Your rights
You can opt out of biometric processing at any time in your athlete settings. If you want us to delete face data we’ve already processed for you, email privacy@podiumbase.io or use the data-deletion request flow in your account.
Race directors can purge an entire event’s Rekognition Collection from event settings. EU/UK residents retain GDPR rights (access, erasure, portability, objection to processing) independent of our default flow.
Contact
For privacy questions or to exercise a data right, email privacy@podiumbase.io. For a full account of how we handle data, see our Privacy Policy.