Privacy & Biometrics Notice
Last updated: · Prepared under Rule 3 of the NZ Biometric Processing Privacy Code 2025
If you appear in footage that was processed by Tabor8, Tabor8 holds the clips you appear in and the face templates used to group them, for as long as the videographer keeps that project. Both are deleted when the videographer deletes your person folder or the project, and you can ask us to remove them. Email privacy@tabor8.com.
If you appear in photos that were processed by Tabor8, Tabor8 holds the photos you appear in, for as long as the videographer keeps that project. No face templates are stored for photos. See the Photos section below.
Who we are
| Field | Detail |
|---|---|
| Organisation | Tabor8 Limited |
| Operator | Tabor8 Limited, Hamilton, New Zealand |
| Service | Keeping and sharing footage and photos, and sorting them by face matching, at tabor8.com |
| Contact | privacy@tabor8.com |
| Regulator (NZ) | Office of the Privacy Commissioner - privacy.org.nz |
Who this notice is for
This notice is for anyone whose face appears in video footage or photos uploaded to Tabor8 - not just people who hold a Tabor8 account. If you attended an event, played in a match, or appeared in footage that a videographer later processed with Tabor8, this notice describes what Tabor8 did with data about you and what rights you have.
What Tabor8 collects
When footage is uploaded to Tabor8 for processing, the following data is derived from the video:
- Face templates (biometric information) - a numeric vector derived from the position and proportions of facial features in each detected face. This is the face data that Tabor8's shorter notices refer to, and it is biometric data. Tabor8 matches these templates against each other to group clips by person: within one project, and between projects when a videographer merges them (see "Why we collect it" below). Templates are stored with the videographer's project, labelled only with a folder number.
- Detection metadata - timestamps and frame positions where a face was detected, used to cut clips.
Tabor8 does not collect names, contact details, gender, ethnicity, or any other identifying information from individuals appearing in footage, and does not use templates to work out who anyone is. A videographer can choose to give a person folder a label of their own, such as a name. If you are a Tabor8 account holder, see the section below for what we collect about you as a registered user.
Photos
A project can hold still photos as well as video. Photos are sorted by person in the same way, by matching faces. In this notice "videographer" means whoever uploaded the files, photos included. Photos differ from video in these ways:
- Face templates made from photos are not stored. A template is made for each face found in a photo and compared with the other faces in the same batch of photos, to group them by person. The templates exist only in the memory of the processing job and are discarded when the job ends. They are never written to storage, so there are none to keep, share or delete afterwards.
- Photos and video are sorted separately. Faces in photos are never compared with faces in video, in the same project or in any other.
- Original photo files are kept as they were uploaded, for as long as the videographer keeps the project. An original file contains whatever the camera recorded in it. That can include the date and time, the camera model and, if the camera recorded one, the location. The smaller copies Tabor8 makes for viewing on screen do not contain that information. Anyone the videographer gives a shared link to can download the original files.
- A photo with several people in it appears in each of those people's folders. It is stored once.
- Each folder shows a small picture of one face, cropped from one of its photos. That picture is an image, not a template.
What we collect from account holders
When you create a Tabor8 account, we collect the following data about you as a registered user - separate from any biometric processing of footage you upload:
| Data | Source | Purpose | Retention |
|---|---|---|---|
| Email address | Signup | Account management, verification, service notices | Until account deletion |
| IP address + device info | Automatic | Security, abuse prevention | 12 months rolling |
| Usage analytics (page views, events) | Vercel Analytics | Product improvement - aggregated, not linked to individuals | Per Vercel retention policy |
| Error logs (user ID + context) | Application | Debugging, support | 12 months rolling |
| Product usage data (which control was used, on which page, when) | Application - beta participants only | Finding and fixing problems | 90 days rolling |
| Billing records (Stripe customer ID, plan, payment status) | Stripe | Billing and subscription management | 7 years (NZ Inland Revenue requirements) |
| Beta application (name, email, business, how you heard of us, and whether you opened the form from a "Sent with Tabor8" shared page) | The application form | Deciding on the application, and learning how people find Tabor8 | Until you ask us to delete it |
Product usage data records the name we gave a control in our own source code - never the text displayed on your screen. Your project names, person names and footage therefore never form part of this record. Only controls we have explicitly tagged are recorded; anything untagged is not registered at all. It is collected from beta participants only, is never sold, is held only by the service providers listed in this notice, and is deleted after 90 days.
Legal basis (GDPR Art. 6): performance of contract for account management and billing; legitimate interests for security, analytics, and debugging.
What we collect when you open a shared link
A videographer can share a project, or part of one, with a link. You can open that link without a Tabor8 account. Before any footage is shown, the page asks you to tick a box accepting this notice and the Terms of Service. There are two kinds of link, and they keep different records.
A link to a sorted project
This link shows clips and photos grouped by person. When you tick the box, we record the following:
| Data | Source | Purpose | Retention |
|---|---|---|---|
| A random session identifier | Created when you tick the box | Lets the page show you the shared footage and recognises you on a return visit from the same browser | See below |
| IP address and browser type of that session | Automatic, recorded by our sign-in provider (Supabase) | Security, abuse prevention | Kept with the session |
| The time you accepted, and which version of the notice you were shown | Created when you tick the box | A record that the notice was accepted | For as long as the project the link belongs to is held in our systems |
| Country and region, derived from your IP address at the moment you accept | Automatic | Knowing which privacy law applies to the acceptance | Same as the acceptance record |
| A log of downloads made through the link (which file, when) | Application | Enforcing download limits, investigating misuse of a link | Same as the acceptance record |
We do not ask for or record your name or your email address. Because there is no sign-in, we cannot tell who ticked the box, and we cannot look up "your" record from a name or an email. If you want it removed sooner, tell us the link you opened and roughly when, and we will delete the records for that link from that time.
The session identifier is held in a cookie in your browser. It is used only to keep the shared page working. It is not used for advertising or to follow you to other sites. Clearing your browser's cookies removes it from your device. A session that was started but never accepted the notice is deleted automatically after 30 days.
A link to files as uploaded
This link shows one file, one folder, a whole project, or a share folder (files the videographer collected from any of their projects), as the files were uploaded. A share folder can also hold clips and photos that a scan sorted, which the videographer picked for one person. Either way, no face matching is run for the link, and it shows only the files picked: no person folders and no face data. We record the following:
| Data | Source | Purpose | Retention |
|---|---|---|---|
| That you ticked the box, and which version of the notice | Stored in your own browser, not by us | So the page does not ask again on a return visit from the same browser | Until you clear your browser's site data |
| Each visit to the link and each original file viewed or downloaded through it, with a scrambled form of your IP address and the time | Application | Limiting how much one link can be used, investigating misuse of a link | 30 days, then deleted automatically |
The scrambled form of your IP address is made with a secret key, so it cannot be turned back into the address. We keep no separate record that the box was ticked, and no cookie is set.
If you choose to sign in instead, the account holder section above applies.
Legal basis (GDPR Art. 6): legitimate interests in keeping a record of acceptance and preventing misuse of shared links.
Why we collect it
Tabor8 processes face templates for one purpose: to group video clips and photos by person, so the videographer who uploaded the footage can find and download clips of specific individuals without manually scrubbing the source recording. Grouping includes merging duplicate folders of the same person within one project, and across projects when a videographer merges them.
A videographer can merge projects they own, and projects another videographer has given them access to. When projects from two accounts are merged, the templates of those projects are compared with each other, the merged project belongs to the owner of the project the others were merged into, and the people who could open any of the merged projects can open the merged one. Templates are never compared with a project the person merging cannot already open, and never with anything outside Tabor8.
We have assessed this purpose as necessary and proportionate under Rule 1 of the NZ Biometric Processing Privacy Code 2025. The assessment considers: the purpose is specific and limited; no reasonably effective lower-risk alternative achieves the same outcome at scale; safeguards include storage limited to the life of the project, deletion of a person's templates on request, access controls, and processing only by authorised infrastructure.
Tabor8 does not use face matching results to infer emotional state, intent, mental health, political views, or any other sensitive characteristics. Outputs are limited to temporal and spatial clustering of footage by detected face.
How long we keep it
Short answer: templates are kept with the project, and deleted with it. Tabor8 stores the face templates for a project alongside that project's clips, so people can be merged within a project, and across projects the videographer owns or has been given access to. They are deleted when the person folder they belong to is deleted, and all of a project's templates are deleted when the project is deleted. Photos are different: no templates are stored for them at all.
| Data type | Retention |
|---|---|
| Face templates made from video | Stored with the project. Deleted when the person folder or the project is deleted |
| Face templates made from photos | Not stored. Held in memory while the photos are sorted, then discarded |
| Clip files (video segments) | Retained until the videographer deletes the project |
| Photo files (the originals, and the smaller copies made for viewing) | Retained until the videographer deletes the project |
| Uploaded video files in a library project (the originals, and the smaller copies made for viewing) | Retained until the videographer deletes them or the project. In a project scanned as a whole, uploaded video is deleted when the scan finishes |
| Processing logs | Retained for 12 months (rolling) for security and audit purposes |
| Error logs | Retained for 12 months (rolling), then deleted automatically |
| Product usage data (beta participants) | Retained for 90 days (rolling), then deleted automatically |
| Account data (email, IP, analytics) | Retained until account deletion |
| Shared-link records for a sorted project (acceptance record, download log, session) | Kept for as long as the project the link belongs to is held in our systems, or until you ask us to delete them. Sessions that never accepted the notice are deleted after 30 days |
| Shared-link records for files as uploaded (visits and downloads, with a scrambled IP address) | 30 days, then deleted automatically |
| Billing records (Stripe) | Retained for 7 years (NZ Inland Revenue requirements) |
Your alternatives to biometric processing
If you are a videographer, you are never required to use face matching. You can organise footage manually in your own editing software, and Tabor8 will provide manual organisation assistance on written request at no extra charge. Contact privacy@tabor8.com.
If you appear in footage someone else uploaded, face matching ran when that footage was scanned. The templates stay stored with the videographer's project and are only compared again if the videographer merges people within that project, or merges it with another project they own or have been given access to. You can have your footage removed, which also removes the templates stored for your person folder. For photos, no templates are stored, so there is nothing to compare again, and you can have the photos you appear in removed.
Removal requests
Email privacy@tabor8.com with:
- The event - name, date, and venue if you know them
- Who filmed it, if you know
- Anything that helps us locate you in the footage (roughly when you appear, what you were wearing)
You do not need to send a photograph of yourself, and we will not ask for one. Requiring a face image to action a removal would mean collecting more biometric data than we started with.
What happens next:
- We acknowledge your request within 5 working days
- We locate the relevant clips or photos and confirm what we have found
- We delete those clips or photos, and the face templates stored for your person folder, and notify the videographer that a removal request was actioned
- We confirm to you in writing once deletion is complete
What we cannot do: we cannot delete the videographer's own original video footage. They hold that, not us, and they are the data controller for it - we will pass your request on to them and tell you who they are so you can contact them directly. We also do not search stored templates to check whether a particular person was processed. That would need a photograph of you, and we will not ask for one. We locate you from the event details you give us.
No account is required, there is no charge, and you do not need to explain why.
If you are not satisfied with how we handle your request, you can complain to the Office of the Privacy Commissioner (New Zealand) or your local data protection authority.
Who has access to processed data
- The videographer who uploaded the footage - can access clip files and photos grouped by person. They cannot view or download face templates.
- Anyone the videographer adds to a project as a collaborator - can work in that project (merge, rename and delete people and clips, add footage, re-scan), can delete the project, and can merge it with projects of their own. They cannot view or download face templates.
- Anyone the videographer gives a shared link to - can view and download what the link covers, after accepting this notice, until the link expires (7 days, unless the videographer extends it) or is switched off: the clip files and photos of a sorted project grouped by person, files as they were uploaded (originals included), or the clips and photos the videographer picked for one person. They cannot view or download face templates, and they cannot change anything in the project.
- Tabor8's processing infrastructure - cloud GPU processing via Modal (United States) creates the templates during a scan and compares them when the videographer merges people. Templates made from video are stored in Cloudflare R2 with the project. Templates made from photos are not stored anywhere.
- Tabor8 personnel - may access processing logs and metadata for security and billing purposes. They do not access stored templates in the ordinary course. The small number of staff who administer storage can technically reach them, and do so only to fix a fault or action a deletion request.
Third-party service providers (processors): Tabor8 uses the following processors who may handle data as part of service delivery:
- Vercel (United States) - hosting and serverless compute. Processes request logs and aggregated analytics.
- Supabase (United States) - database. Stores account data, project metadata, and processing records.
- Cloudflare R2 (United States) - object storage. Stores uploaded video files until their scan finishes (in a library project, for as long as the files are kept), the clip outputs and face templates. Stores uploaded photos, and the smaller copies made for viewing of photos and video, for as long as the project is kept.
- Modal (United States) - GPU compute. Receives footage and photos for biometric processing and reads stored templates when people are merged; nothing is kept on Modal after a job completes.
- Stripe (United States) - payment processing. Stores billing information for subscribed accounts.
Tabor8 does not sell or license biometric data, and does not disclose it to anyone other than the service providers listed above.
Your rights
Under the NZ Privacy Act 2020 and the Biometric Processing Privacy Code 2025, you have the right to:
| Right | Detail |
|---|---|
| Access | Request a description of any personal or biometric data Tabor8 holds about you. While the videographer's project exists, this will usually be: clip files and photos you appear in, and the face templates stored for your person folder (video only). |
| Deletion | Request deletion of any data Tabor8 holds. We delete the clips and photos you appear in, and the face templates in your person folder. The videographer's own original video footage is theirs to delete, as they are the data controller, and we pass your request on to them. |
| Correction | Request correction of any inaccurate personal data Tabor8 holds about you. |
| Complaint | Lodge a complaint with Tabor8 directly, or escalate to the relevant regulator (see below). |
How to make a request or complaint
Step 1 - Contact Tabor8: Email privacy@tabor8.com with a description of your request. We aim to respond within 5 working days. For deletion requests, please include a description of the event or footage you appeared in so we can identify the relevant project.
Step 2 - Escalate to a regulator: If we do not resolve your complaint to your satisfaction, you can contact:
- New Zealand: Office of the Privacy Commissioner - privacy.org.nz | 0800 803 909
- Australia: Office of the Australian Information Commissioner - oaic.gov.au | 1300 363 992
- Other jurisdictions: Contact your local data protection authority.
Regional applicability
Tabor8 accounts are currently available in New Zealand only, for the duration of the beta. Outside New Zealand, the product itself (the dashboard, uploading and scanning footage) shows a region restriction page, so footage cannot be uploaded from there - this is a beta-scope limitation, not a claim about whether Tabor8 would be compliant elsewhere. The public website and these legal pages can be read from anywhere.
Shared links are the exception. A link a videographer sends can be opened from any country, with no account. No new face matching is run for the person opening a link: they view and download clips and photos that were already sorted when the videographer's files were scanned. "Not currently served" in the table below means accounts and uploads are not available there. It does not mean a shared link cannot be opened there.
The rows below describe the specific jurisdictions we researched in preparing for future expansion, kept here so the assessment doesn't need to be redone from scratch when that happens.
| Jurisdiction | Position |
|---|---|
| New Zealand | This notice is designed to meet the notification requirements of Rule 3 of the NZ Biometric Processing Privacy Code 2025. |
| Australia (not currently served) | This notice would provide a baseline disclosure under the Privacy Act 1988 (Cth). Additional consent obligations may apply depending on the context of processing. |
| European Union / UK (not currently served) | GDPR Article 9 requires explicit consent from biometric data subjects before processing. Our current service does not meet that requirement, so this jurisdiction is not served during the New Zealand-only beta regardless. |
| Illinois / Texas / Washington (US) (not currently served) | State biometric privacy laws (Illinois BIPA, Texas CUBI, Washington My Health My Data Act) require prior written or electronic consent from biometric data subjects before collection. Not served during the New Zealand-only beta regardless. |
| California (US) (not currently served) | California residents have rights under the California Consumer Privacy Act (CPRA / CCPA). Biometric data is Sensitive Personal Information (SPI) under CPRA §1798.121: (a) know what personal data is collected about you; (b) request correction of inaccurate data; (c) request deletion of your data; (d) limit our use and disclosure of your SPI to purposes reasonably necessary to provide the service; and (e) non-discrimination for exercising your rights. Not served during the New Zealand-only beta regardless. |
| Rest of world (not currently served) | This notice provides a general disclosure baseline for if and when Tabor8 expands beyond New Zealand. Specific rights may vary by jurisdiction. |
Children
Tabor8 is not directed at anyone under 16, and account holders must be at least 16. Account holders aged 16 or 17 need the consent of a parent or legal guardian (see the Terms of Service, section 3.6). If we learn that an account belongs to someone under 16, we will close it and delete the account data. If you believe a child under 16 has an account, contact privacy@tabor8.com.
The same age rule applies to opening a shared link without an account: the person ticking the box confirms they are 18 or older, or 16 or 17 with a parent or legal guardian's agreement. We have no way to check this, because opening a link involves no sign-in.
This section is about people who hold accounts or open shared links. Footage that includes minors is covered separately in the Terms of Service, section 3.3.
Changes to this notice
We will update this notice if our processing practices change materially. The date at the top of this page reflects the most recent revision. Continued use of Tabor8 after an updated notice is published constitutes acceptance of the changes.
Related documents
- Terms of Service - includes the full data handling schedule and prohibited use restrictions.
- NZ Office of the Privacy Commissioner - Biometric Processing Privacy Code 2025: privacy.org.nz