Iris Booth Privacy Policy
Effective date: July 31st, 2026
Who We Are
Iris Booth Inc. (“Iris Booth,” “we,” or “us”) is a Canadian company registered in Toronto, Ontario. This Privacy Policy describes how we handle personal information, in accordance with applicable privacy laws including PIPEDA, GDPR, CCPA.
Contact: privacy@irisbooth.com Address: 1656-329 Howe St, Vancouver, BC, V6C 3N2
What We Collect
Aa) Contact information — email address
B) Photographic data — headshot photographs captured using Iris Booth services
C) Photo enhancement data — technical settings and edit selections used to apply automated enhancements (see Photo Processing below)
D) Session metadata — timestamps, session identifiers, edit selections
E) Communications — support correspondence
F) Website data — analytics and usage data collected via cookies and similar technologies
Why We Collect It
We collect personal data to deliver headshot photography services, communicate with you about your photos and our services, comply with legal obligations, and (with your opt-in consent) send marketing communications. Our legal basis is consent and legitimate business interests.
Photo Processing
To deliver studio-quality headshots, our software applies automated professional enhancements such as lighting, color, background, and skin retouching. Some of these enhancements detect and analyze facial features in order to improve the photo. This is used solely to edit your image — it does not involve facial recognition, does not create a faceprint or any other biometric identifier that could identify you, and no facial-analysis data is retained after your photo is processed. We do not use your photographs or any derived data for identification, recognition, AI or model training, or marketing. For questions about photo processing, email privacy@irisbooth.com.
Who We Share With
We share personal data with the following categories of recipients only to the extent necessary:
Cloud infrastructure and hosting providers
Image processing and enhancement service providers
Authentication, security, and customer support providers
Marketing communication providers (only for users who have opted in)
Iris Booth clients who provided the booth you used, where relevant to fulfilling that engagement
We do not sell personal data.
International Transfers
Personal data is processed and stored on cloud infrastructure located in the United States. Transfers from the United Kingdom, European Economic Area, or other jurisdictions with cross-border restrictions are governed by Standard Contractual Clauses, the UK International Data Transfer Agreement, or other lawful transfer mechanisms.
Retention
We keep personal data only as long as necessary for the purposes described in this policy, then delete it or irreversibly de-identify it. You can ask us to delete your data sooner (see Your Rights).
A) Session data — your photographs and any supplementary identifiers you provide to access the service (e.g. an employee/student ID) are deleted 12 months after the session date, or sooner upon request.
B) User account — When you request deletion, we promptly and irreversibly remove the personal data associated with your account — your photographs and any identifiers you provided, such as your email address or employee/student ID — so that the account can no longer identify you or be used. A de-identified record containing only metadata and no information that identifies you may remain for operational, security, and legal-compliance purposes; it cannot be linked back to you.
C) Consent and acceptance records — retained only as long as necessary to demonstrate compliance with applicable law, then deleted.
D) Session metadata — operational data such as studio/tag routing, timestamps, and session identifiers, which does not identify you once Session Data is deleted — retained indefinitely for operational, security, and reporting purposes.
Your Rights
You may access, correct, delete, restrict, or port your personal data, object to processing, withdraw consent, or file a complaint with the relevant supervisory authority (in Canada, the Office of the Privacy Commissioner at priv.gc.ca). To exercise any right, contact privacy@irisbooth.com.
Marketing
We do not send marketing communications without your opt-in consent. You may unsubscribe at any time using the link in any email. We comply with CASL and CAN-SPAM.
Security
We use industry-standard technical and organizational safeguards to protect personal data, including encryption in transit and at rest, access controls, multi-factor authentication, and documented incident response procedures. Where a confirmed data breach affects your personal data, we will notify you and the relevant authorities within the timeframes required by applicable law.
Children
Iris Booth services are intended for users 16 and older, with parental consent required for users 13 to 15. We do not knowingly collect personal data from children under 13.
Updates
The current version of this Privacy Policy is posted at irisbooth.com/privacy-policy. We update it from time to time to reflect changes in our practices or applicable law. Material updates will be communicated by email or in-product notification where you have an account.
Contact
For privacy inquiries, or to exercise your rights:
Email: privacy@irisbooth.com
Mail: Iris Booth Inc., 1656-329 Howe St, Vancouver, BC, V6C 3N2
