Privacy Policy

FaceSentry is operated by MeltingPixels LLC ("FaceSentry," "we," "us"). This policy explains what personal data we collect, why we collect it, how we use it, how long we keep it, and the rights you have over it. If you do not agree with this policy, please do not use the Service.

1. Information We Collect

• Account information: email address, display name, password hash, and account timestamps.
• Reference photos: images you upload to identify a protected person. Stored in encrypted cloud storage with private access only.
• Biometric identifiers (special-category / sensitive personal data): 512-dimensional face embeddings derived from your reference photos. These are numerical vectors, not images, and cannot be reverse-engineered into a photo.
• Scan results: URLs, thumbnails, platform metadata, AI model verdicts, and similarity scores for matches found during scans.
• AI photo check (one-off): if you use the AI photo check, the photo you upload is checked on our own servers and deleted when the check finishes; we do not keep it. We keep a SHA-256 fingerprint of the file, its size in pixels and the check's result, and, if you pay, the Stripe payment reference and amount. We do not create a face template from the photo or compare it with anyone. The result is shown at a private link: anyone you share that link with can see it.
• Consent records: the timestamp, IP address, and method of the consent you provided when creating your account and when adding each protected person.
• Takedown records: notices generated in your account, evidence packages, delivery status, and platform responses.
• Payment information: handled entirely by Stripe. We receive only a customer or payment reference, the plan or item purchased, the amount, and billing status. We do not store or process credit card numbers.
• Technical logs: IP address, user agent, request timestamps, and error events, used solely for security, abuse prevention, and debugging.

2. How We Use Your Information

• To detect and monitor unauthorized use of your likeness across the internet.
• To screen scan results for explicit content, to add an advisory label to a matched image that may be AI-generated, and to run liveness verification on photos you upload. Deepfake (face-swap) analysis is paused while we re-test it.
• To run an AI photo check you request: we detect whether the photo shows a face large enough for the check (face detection only; it does not recognize or compare faces) and score the whole image with the AI-generated-image classifier.
• To generate DMCA takedown notices and TAKE IT DOWN Act removal requests for you to review and send.
• To send you email alerts about matches, takedowns, and account activity.
• To process subscription payments and deliver billing receipts.
• To enforce our Terms of Service, prevent abuse, and comply with law.

We do not use your photos, face embeddings, or identifiable scan results to train AI models, for advertising, or for profiling unrelated to your own protection. To improve detection quality, we compute aggregate, de-identified accuracy statistics (counts of how our model confidence compared with what users confirmed, dismissed, or agreed or disagreed with) that contain no photos, embeddings, or information identifying you or any individual result.

3. Lawful Basis for Processing (GDPR / UK GDPR)

• Explicit consent (Article 9(2)(a)): for all biometric data. You provide this at registration and again each time you add a person who is not yourself. You may withdraw consent at any time by deleting the protected person, or your entire account, from your Settings page.
• Contract (Article 6(1)(b)): to provide the Service you have subscribed to.
• Legitimate interests (Article 6(1)(f)): security, fraud prevention, and service integrity.
• Legal obligation (Article 6(1)(c)): tax, accounting, and law-enforcement requests.

4. AI Processing

Our AI models run on our own infrastructure. Your face embeddings, and the models that analyze them, are never sent to OpenAI, Google, Anthropic, or any third-party AI service, and we never use your data to train AI models. We run the following open models on our own infrastructure:

• SCRFD face detection model (from the InsightFace project)
• AdaFace face recognition model
• MiniFASNet liveness verification model
• Marqo nsfw-image-detection-384 explicit-content screening model
• SwinV2 AI-generated-image classifier (haywoodsloan/ai-image-detector-deploy), for the advisory "May be AI-generated" label on matched images and for the one-off AI photo check
• YuNet face detection model (OpenCV Zoo), used only by the AI photo check to confirm that a photo shows a large enough face

Our deepfake (face-swap) analysis is paused while we re-test it; while it is paused, scan results carry no deepfake verdict. The advisory AI-image label is not a deepfake verdict: it cannot detect edited photos or face swaps, and a result without it may still be AI-generated or edited.

Reverse-image search. To find where your likeness appears online, we send a temporary link to your scan image (it expires after one hour) to SerpAPI (see Section 7), which runs the search on Google Lens and, on paid plans, Yandex (a search engine based in Russia). Those search engines retrieve your image from the link to run the search and return possible matches; our on-infrastructure models above then score and filter the results. This reverse-image search is how detection works.

Name search (paid plans). Paid plans also search for the protected person's name together with the terms "deepfake", "nude", "leaked", "onlyfans leak" and "nsfw". On the Personal plan this is a Google Images search through SerpAPI. On Personal Plus and above it also runs on Google, Google News, Bing, Bing Images and Reddit (through SerpAPI), on Brave Search and on YouTube, and on the Family plan and above on Naver (through SerpAPI). These searches send the name and the terms, never a photo.

5. Data Security

• All data encrypted at rest and in transit (TLS) by our infrastructure providers.
• Biometric embeddings stored in our PostgreSQL database with row-level security policies scoped to the owning user.
• Reference photos stored in private cloud storage buckets with per-user access controls.
• Database hosted on Supabase (SOC 2 Type II certified by its provider).
• Production systems hardened with rate limiting, SSRF protection, CSRF tokens, content security policy, and webhook idempotency.

6. Data Retention

We retain personal data only for as long as needed to provide the Service or meet legal obligations:

• Reference photos and face embeddings: retained until you delete the protected person or your account.
• Guest scans (run before creating an account): if you run a free scan without an account, the uploaded photo and the face embedding derived from it are automatically and permanently deleted within 7 days unless you create an account to claim the scan.
• AI photo checks: the photo is deleted when the check finishes. Its fingerprint and result expire 24 hours after the upload if unpaid, or 90 days after payment, and are deleted by our daily cleanup after they expire.
• Scan results (free tier): automatically purged after 90 days.
• Scan results (paid tiers): retained for the duration of your subscription, then purged 30 days after cancellation.
• Takedown records: retained for 2 years as a record of the takedown notices generated in your account.
• Billing records: retained for 7 years for tax and accounting compliance.
• Security logs: retained for up to 90 days.
• Consent records: retained for as long as the underlying data is retained, plus 2 years for audit purposes.

You may trigger deletion at any time by deleting your account from Settings. Account deletion is permanent and irreversible. Some records may be retained in anonymized form where required by law.

7. Data Sharing

We do not sell, rent, or share your personal data. We disclose data only to the following processors and only for the purposes listed:

• Stripe (payments, tax).
• Supabase (database, storage, authentication).
• Resend (transactional email delivery).
• Upstash (rate-limit, idempotency, and short-lived source-result cache).
• SerpAPI (search API), which receives a temporary link to your scan image to run the photo search on Google Lens and, on paid plans, Yandex, and, on paid plans, the protected person's name with the search terms listed in Section 4 for the name searches on Google, Bing, Reddit and Naver. It is used only to perform your scan.
• Brave Search API (Brave Software) and the YouTube Data API (Google), which, on Personal Plus and above, receive the protected person's name with the search terms listed in Section 4 to find web pages and videos. No photo is sent to them. They are used only to perform your scan.
• Hetzner Online (hosting): our application servers, including the face models, scan processing and server logs, run on Hetzner Cloud servers in Ashburn, Virginia (United States).
• PostHog (product analytics): page-view events from your browser only if you grant analytics consent in the cookie banner, and, from our server, checkout and purchase events identified by your account ID (no photos, embeddings or scan results).
• Third-party platforms receiving DMCA or TAKE IT DOWN Act notices you authorize us to send.
• Law-enforcement or court orders where we are legally compelled to disclose.

Of the processors above, Stripe, Supabase, Resend and Upstash process personal data for us under data processing agreements that form part of their terms of service, and we have signed data processing agreements with Hetzner and PostHog. SerpAPI, Brave Search and the YouTube Data API process our searches under their own terms and privacy policies: SerpAPI offers a data processing agreement on request, Brave's data processing addendum does not cover search queries, and Google's YouTube API terms do not include one. Under their own policies, SerpAPI keeps search data for 31 days and Brave keeps search query logs for up to 90 days. Advertising and analytics in your browser are covered in Section 12. Most of these processors are located in the United States. Where a processor's data processing agreement applies, transfers outside the EEA/UK follow it.

FaceSentry uses YouTube API Services. Google's use of the data it receives is described in the Google Privacy Policy; you can review and revoke app access to your Google account on Google's security settings page. FaceSentry does not connect to your Google account.

8. Your Rights

Depending on where you live, you may have the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to fix inaccurate data.
• Deletion ("right to be forgotten") — delete your account and associated data from Settings, or email us.
• Portability — export your data in a machine-readable format from Settings.
• Restriction / objection — ask us to stop or limit certain processing.
• Withdraw consent — at any time, with no effect on processing already carried out.
• Lodge a complaint with a supervisory authority (EU/UK) or your state Attorney General (US).

9. California Residents (CCPA / CPRA)

California residents have the right to know, delete, correct, and limit use of sensitive personal information. We classify biometric identifiers as "sensitive personal information" under CPRA. We do notsell or share your personal information for cross-context behavioral advertising. To exercise your rights see Your Privacy Choices or email support@facesentry.com. We will not discriminate against you for exercising any of these rights.

10. Illinois, Texas, Washington Biometric Laws

FaceSentry creates and stores biometric identifiers (face embeddings). We comply with the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and the Washington My Health My Data Act. Specifically:

• We inform you in writing that biometric data is being collected and stored.
• We inform you of the specific purpose (monitoring the web for unauthorized use of the likeness) and of the retention period (see Section 6).
• We obtain your written release (a checkbox acknowledgement at registration, at each person creation, and before a guest scan).
• We do not sell, lease, trade, or profit from your biometric data.
• We permanently destroy biometric data when you delete the associated protected person, account, or three years after your last interaction with the Service, whichever comes first. Guest-scan biometric data is destroyed within 7 days if the scan is not claimed onto an account.

11. Children's Privacy

The Service is not directed to children under 13. Family-plan account holders may enroll their own minor children as protected people; in that case parental consent is required under the Children's Online Privacy Protection Act (COPPA), results are delivered only to the parent account, and we do not create user accounts for minors. If you believe we have inadvertently collected data from a child under 13 without parental consent, contact us and we will delete it.

12. Cookies and Tracking

We use strictly-necessary first-party cookies for authentication, session management, CSRF protection, guest scan sessions, and security. Analytics and advertising pixels are off by default and load only if you grant the matching consent category in the cookie banner. If you grant advertising consent, Meta, TikTok, and Google may receive page-view or conversion events so we can measure ad effectiveness. We do not sell biometric data or use biometric data for advertising.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be announced by email and posted on this page with a new "last updated" date. Continued use of the Service after an update constitutes acceptance of the revised policy.

14. Contact

Data controller: MeltingPixels LLC, Greenwood, Indiana, USA. For privacy questions, data subject requests, or to withdraw consent, contact support@facesentry.com.