Face detection & legal basis

Face data is a special category of personal data under GDPR Article 9. To process it lawfully you need an explicit basis — typically Art. 9(2)(a) consent or §23 KUG (the German "freedom of panorama" exception for photojournalism).

SnapFlow doesn't decide your basis for you. It just requires you to confirm one exists. When you first enable face detection on an album, a one-line confirmation modal asks you to acknowledge — clicking confirm stamps face_detection_legal_basis_confirmed_at with the current timestamp.

The audit trail lives in the activity log: the action album_face_detection_enabled is recorded with your user ID + timestamp.

You can toggle face detection off any time. The existing confirmation timestamp persists; re-enabling later doesn't re-prompt.