Privacy Notice

SEC.01 // OVERVIEW

FaceTell ("we," "us") processes your photo to generate your report. Your photo, your report, and any derived images are stored privately for 30 days, then automatically deleted. This notice explains what data we collect and how. We do not sell your personal data.

SEC.02 // WHAT WE COLLECT

We collect only what we need to deliver the Service:

• Face image
  The photo you submit for analysis. Stored in a private, access-controlled storage bucket. Accessible only via a time-limited signed URL issued per request. Automatically deleted 30 days after creation.
• IP hash (rate limiting)
  A one-way cryptographic hash of your IP address, used solely to enforce our rate limit (5 scans per 15 minutes). The original IP address is never stored.
• Technical data
  Standard server logs (browser type, device type, referring URL). Used for stability and security monitoring only.
• Payment data
  Handled entirely by Polar, our payment processor. FaceTell never receives, stores, or processes your payment card details.

SEC.03 // HOW WE USE YOUR DATA

• Report generation
  Your photo is sent to our AI processing pipeline for feature extraction and text generation. The image is used solely for this purpose. We do not use your likeness for advertising, model training, or profiling.
• Report delivery
  Your report is stored in our database linked to a UUID. You access it via a unique URL. We do not create accounts or link reports to identity beyond the UUID.
• Rate limiting & security
  IP hashes are used to prevent abuse and protect service availability.

SEC.04 // THIRD-PARTY PROCESSORS

We use the following sub-processors to deliver the Service:

• Supabase
  Database and file storage. Stores reports and images in an access-controlled environment. Data may be stored in the US and EU.
• AI processing services
  Your image and derived analysis data are processed by AI services for feature extraction and text generation. These services process your data on our behalf only and are contractually prohibited from retaining or using it beyond the scope of our API requests.
• Polar Software, Inc.
  Payment processing and merchant-of-record. Polar collects and processes payment data independently under their own Privacy Policy. See polar.sh/legal/privacy.
• Vercel
  Hosting and edge infrastructure. Standard server logs are processed by Vercel. See Vercel's privacy policy for details.

SEC.05 // DATA RETENTION

Your photo, your report, and any derived images (halftone, archetype portrait) are retained for 30 days from the date of creation, then automatically deleted from our database and storage. IP hashes are retained in accordance with our rate-limiting window (15 minutes).

You may request earlier deletion of your report at any time by emailing hello@facetell.app with your report reference number (the first 8 characters of your report URL). We will delete your image and report within 5 business days.

SEC.05B // WHAT WE DO NOT DO

We do not build a profile of you across sessions. We do not score you. We do not categorize you by ethnicity, race, gender identity, or any protected characteristic. We do not train models on your photo or report. We do not sell, rent, or share your photo, report, or any derived signals with advertisers, data brokers, employers, insurers, or law enforcement (except where compelled by valid legal process).

The observational reading you receive is not a personality test, psychological assessment, intelligence measurement, criminality predictor, or innate-trait classifier. It describes patterns the system recognized in your photo at this moment.

SEC.06 // YOUR RIGHTS

Depending on your jurisdiction, you may have the right to: access your personal data, request correction or deletion, request a copy in a portable format, and object to certain processing. To exercise any of these rights, contact us at hello@facetell.app.

EU and UK residents have additional rights under GDPR and UK GDPR, including the right to lodge a complaint with a supervisory authority.

SEC.07 // COOKIES

FaceTell uses only technically necessary cookies for session management and rate limiting. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. If we add analytics in the future, this notice will be updated and consent obtained where required.

SEC.08 // CHILDREN

FaceTell is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If we become aware that we have inadvertently collected such data, we will delete it promptly.

SEC.09 // CHANGES TO THIS NOTICE

We may update this Privacy Notice periodically. The effective date at the top of this page reflects the most recent revision. Material changes will be announced on the Service.

SEC.10 // CONTACT

For privacy-related enquiries, to request data deletion, or to exercise your rights: hello@facetell.app