Privacy Policy

In short

• We analyze your selfie with an AI vision model to produce scores. That is the whole product.
• We do not sell your data. We do not pass your photo to third parties for their own purposes. We never use your photo to train or fine-tune any model.
• Free scans: your photo is deleted within 2 hours. A photo attached to a purchased report stays private with that report.
• You can delete your reports, your photos, and your account at any time. Ask us and we will do it for you.

Information we collect

We collect only what the service needs:

1. Account information — your name, email address, and a hashed password, plus the settings you change in your account.
2. The photo you upload — the single selfie you submit for a scan.
3. Analysis results — the score, the face shape label, the per-dimension scores, and, for a purchased report, the region scores and the action plan. These are derived from your photo and stored against your account.
4. Usage data — pages visited, features used, error logs, IP address, browser type, and device type. We use it to keep the service working and to find bugs.
5. Payment data — handled entirely by our payment processor (Stripe, Creem, or PayPal, depending on where you check out). We receive the payment status, the amount, the currency, and the brand and last four digits of your payment method. We never see or store full card numbers.
6. Communications — support messages you send us, and the email address you use to reach us.

How we handle your photo

Your photo is the most sensitive thing this service touches, so here is exactly what happens to it.

• It is sent to our AI vision provider so the model can locate facial landmarks and compute your scores. The image leaves our server for that analysis and comes back as numbers.
• Free scans: the photo is deleted within 2 hours of the scan, together with the raw landmark data behind it. The summary result stays in your account so you can come back and view it — the score, the face shape label, and the per-dimension scores, none of which are an image.
• Paid full reports: the photo is stored privately with the report, so the report can keep showing you your own photo. Deleting the report deletes the photo with it.
• We never sell your photo. It is not listed, licensed, or traded to anyone.
• We never share your photo with a third party for their own purposes. The only transfer is the analysis call described above.
• We never train or fine-tune a model on your photo. Not our models, and not anyone else's. Your face is not added to any dataset.
• Only the people who operate the service can see it. A small number of staff and engineers need access to debug and maintain the analysis. They reach it through access-controlled accounts, and access is logged.

Who processes your data

We use a small number of service providers. Each one receives only the minimum it needs to do its job, and each is bound by contract to use the data only on our instructions and not for its own purposes.

• AI vision API provider — receives your photo and the instructions needed to run the analysis. It processes the image for the duration of the analysis and does not retain it as part of your content.
• Payment processor (Stripe, Creem, or PayPal) — receives your payment details and returns the payment status, amount, and transaction identifiers. It handles the card data; we never have it.
• Email provider — receives your email address and the content of the messages we send you, such as receipts and security notices.
• Hosting provider — stores the application database and the files that back the service.

We do not sell your personal information. We share data outside this list only where the law requires it, or to protect our rights and the rights of our users.

How long we keep your data

• Photos from free scans — deleted within 2 hours of the scan.
• Photos attached to a purchased report — kept for as long as the report exists. Delete the report, or close the account, and the photo goes with it.
• Analysis results — kept for as long as your account exists.
• Account data (name, email, password hash) — kept for as long as your account exists.
• Payment records — we keep the transaction reference, amount, currency, and status for as long as tax and accounting law requires, which is typically several years. We never keep the card details.
• Usage logs — kept for up to 12 months, then deleted or folded into anonymous aggregate counts.
• Backups — data deleted from the live service disappears immediately there, and from encrypted backups within 30 days.

Deleting your data and reports

• Delete a report: open the report in your dashboard and delete it. The report, its region scores, its action plan, and its photo are all removed.
• Delete your free scan results: use the delete option in your account settings.
• Delete your account: use the delete option in your account settings. We then remove your account, your reports, and your photos, and keep only the payment records the law requires.
• Ask us instead: email privacy@facerating.bar with your request. We confirm within 30 days and delete what we are not legally required to keep.

Cookies and analytics

• Essential cookies — keep you signed in, remember your language, and remember your cookie choice. The service does not work correctly without them.
• Analytics — we use a privacy-friendly analytics tool to count visits and see which pages are useful. It does not set advertising cookies, it does not follow you to other websites, and it does not build a profile of you across sites.
• We do not sell advertising data and we do not share it with advertising networks.
• You can clear cookies in your browser at any time. You can also decline the analytics cookies, and the service still works.

Children's privacy

FaceRating is not intended for children under 13, and we do not knowingly collect information from anyone under 13.

• Do not create an account for a child.
• Do not upload a photo of a child.
• If you believe a child has sent us personal information, email privacy@facerating.bar and we will delete it.

Data security

• Encryption in transit. Everything — your browser, our servers, and every API call including the trip to the AI provider — runs over HTTPS.
• Encryption at rest. Provider keys and sensitive settings in the admin area are encrypted before they are stored.
• Hashed credentials. Passwords are stored as hashes, never in plain text. Session cookies are signed and not readable by scripts.
• Rate limiting. The upload and scan endpoints are rate limited, by IP address before sign-in and by account after it, so the service cannot be spammed or scraped.
• Access controls. Only staff who need access to your data have it, and administrative actions are logged.
• Automatic deletion. Free-scan photos are removed by a scheduled job, with no manual step required.
• No system is perfect. If a breach affects your data, we will notify you and the relevant authority as the law requires.

Your rights

• Access, correct, export, or delete your personal information at any time.
• Object to, or withdraw consent to, processing that is not required to deliver the service you asked for.
• If you are in the EEA or the UK: you have the rights set out in the GDPR, including the right to lodge a complaint with your data protection authority.
• If you are in California: you have the rights set out in the CCPA/CPRA, including the right to know and the right to delete. We do not sell or share personal information as those terms define it.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows the current version.

If we make a material change — especially anything about how we handle photos — we will tell you in the service before it takes effect. Earlier versions are available on request.

Contact us

For any privacy question, data request, or complaint:

privacy@facerating.bar