If you live outside the EEA, Switzerland or the UK, this Privacy Policy applies to you.
1. Who Is Responsible
The controller is Matteo Arcesi, sole proprietor trading as FaceReview, at Via Lorenzo Pareto 7R, 16129 Genova (GE), Italy (“FaceReview”, “we”). Contact privacy@facereview.org for privacy questions and rights requests. Telephone: +39 379 2161464; certified email (PEC): facereview@pecprofessionale.com. Further operator details are in the Terms of Use.
This Policy covers the website, FaceReview accounts, available apps, AI features, subscriptions and Partner Program. Your rights under the GDPR, UK GDPR, Swiss Federal Act on Data Protection and other applicable laws remain available regardless of which regional edition you select.
2. Data and Sources
We collect personal data from you, your sign-in and payment providers, your browser or app, and the results generated when you use FaceReview:
- Account and profile: account identifiers, email, sign-in profile details, display name, age, sex as entered for comparison, onboarding answers and how you found us. We also record age confirmation and your privacy, consent and terms choices.
- Photographs and Analyses: uploaded front and profile images, facial landmarks and measurements, photo quality, appearance scores, comparisons and written interpretations (together, “Analyses”).
- Assistant and plans: messages, replies and conversation summaries; goals, routine, budget, region, language, appearance concerns, previous treatments and preferences; and generated plans and images.
- Billing and usage: customer and subscription references, plan, price, payment status, refunds, feature usage, service costs and errors. Payment providers collect payment, billing-address and tax details directly.
- Security and technical data: device and session identifiers, approximate network information, verification results and service logs used to prevent abuse and diagnose faults. Hosting and security providers may also process IP addresses.
- Referral and creator data: referral codes, link visits and browser identifiers, campaign statistics, commissions, payout details and required verification, tax or support records.
Approximate country information supplied by the delivery network may select regional legal content, billing currency or security checks. We do not collect precise device location for these purposes. You may also give us information when contacting support. Do not include unrelated sensitive information or another person’s photographs.
3. Purposes and Legal Grounds
We use personal data for the following purposes and legal bases under the GDPR and UK GDPR:
- Our contract with you: providing your account, requested Analyses, conversations, progress history, plans and images; maintaining conversation context; managing subscriptions, plan limits, referrals and creator commissions; and answering service requests.
- Legal obligations: accounting, tax, statutory refunds, regulatory requests and required compliance records.
- Legitimate interests: preventing fraud and abuse, protecting the service, diagnosing faults, controlling costs, reconciling referrals and resolving disputes. Our interests in a secure, reliable service must not override your rights. You may object as described in Section 10.
- Consent: optional marketing and browser referral attribution where consent is required.
We do not sell advertising audiences or make unrelated sensitive inferences. Marketing emails include an opt-out; opting out does not stop service, security or billing messages.
Account and transaction details are needed to register or buy a subscription. Photographs and feature answers are optional, but without them we cannot provide features that need them. You are not generally required by law to provide this information.
4. Facial and Health-Related Information
We process your facial photographs and facial geometry to measure facial features and provide appearance Analyses and progress history. We do not use this information to identify you against a facial-recognition database or authenticate your identity.
Skin or hair concerns, previous treatments and information inferred in an Analysis, conversation or plan may reveal health data. We process the information needed to provide an Analysis, conversation, plan or image simulation when you request that feature.
Use Privacy settings or contact privacy@facereview.org to request access, correction, a recipient list, cessation of future collection or sharing, or deletion. You may keep your account without uploading a photograph. Our Washington and Nevada Consumer Health Data Privacy Policies explain applicable consumer health-data rights.
5. Photographs, AI and Generated Images
The Free Preview calculates a limited set of facial proportions on your device; your photographs and those measurements stay on your device and are not uploaded or sent to an AI provider. Other Free Preview results are samples. Uploaded Analysis photographs are stored privately.
To provide the AI feature you request, we send OpenAI the relevant photographs, messages, profile details, Analysis results and conversation context, including saved summaries. These inputs may reveal your identity or health-related information. OpenAI uses them to produce Analyses, replies, plans or image simulations.
Data sent through OpenAI’s API is not used to train its general-purpose models by default. OpenAI may retain data temporarily to provide the service for up to 24 hours, and inputs and outputs in abuse-monitoring logs for up to 30 days. Longer retention may apply for legal obligations or safety review, including images flagged by safety checks. See OpenAI’s data controls.
Saved Analyses, conversations and plans remain in your account as described in Section 9. DNA Lab images are delivered to your browser and are not added to your saved Analysis photographs. Temporary copies of generated images and other results let you recover interrupted requests for 30 minutes, after which they are scheduled for deletion. Copies you download or keep on your device remain under your control.
6. Automated Processing and Review
Analyses and plans estimate appearance characteristics using photographs, profile information and reference data. They are intended for your own information and do not determine employment, credit, insurance or other legal entitlements.
Automated security checks assess device, network, verification and usage information to detect abuse. They may delay or refuse requests, promotional credit or referral attribution, or ask for further verification. You may contest an outcome and request review by a person through privacy@facereview.org. Your rights concerning decisions with legal or similarly significant effects remain available under applicable law.
7. Who Receives Data
- Supabase: sign-in and storage of accounts, uploaded photographs, conversations, results and subscription information, in Paris, France.
- OpenAI: the data described in Section 5 and account-linked abuse-prevention data needed to operate AI features safely.
- Google and, where offered, Apple: sign-in and their own account services. They disclose the profile information authorized during sign-in.
- Resend, when enabled: contact and transaction details needed to send account messages and withdrawal acknowledgements. We do not include Analysis photos, health information or conversations in those messages.
- Stripe: website checkout, subscriptions, refunds and creator payouts. Stripe collects payment and creator identity/bank details directly; FaceReview receives transaction, account and verification-status information. For store purchases, Apple or Google and RevenueCat process purchase identifiers and entitlement data.
- Cloudflare: Turnstile verification and associated network and interaction data for abuse prevention.
- Vercel: application hosting, delivery and technical request logs. Application server functions are configured in Paris, France; website delivery uses Vercel’s global network, and related processing may also occur in the United States and other countries.
Service providers process data on our behalf. Google, Apple and payment providers also use some data independently for their own account services, legal duties and fraud prevention under their privacy notices.
Creators receive referral references, campaign and commission information, not your uploaded photographs, Analyses, health details or conversations. We may disclose limited necessary information to advisers, authorities or parties to a legal claim when justified by law. A business transfer may involve a successor subject to applicable privacy safeguards and notice requirements. We do not sell personal data, share it for cross-context behavioural advertising or provide private content to creators for promotion.
8. International Processing
Providers may process data outside your country, including in the United States, where privacy laws and access by public authorities can differ. Storing account content in France does not mean all provider processing stays in Europe.
For transfers protected by EEA, UK or Swiss data-protection law, the applicable provider terms provide these safeguards:
- Supabase, Vercel and Resend: EU Standard Contractual Clauses, with the relevant UK addendum and Swiss adaptations.
- OpenAI: EEA and Swiss data is processed under its agreement with OpenAI Ireland; onward transfers use Standard Contractual Clauses or an applicable adequacy decision. UK transfers use the clauses with the UK addendum.
- Stripe and Cloudflare: the EU–US Data Privacy Framework and its UK extension and Swiss–US counterpart for covered transfers; Standard Contractual Clauses with regional adaptations where that framework does not apply.
- Where app purchases use RevenueCat, its terms provide Standard Contractual Clauses with UK and Swiss adaptations. Google and Apple explain safeguards for their own sign-in and store services in their privacy notices.
These terms also describe the providers’ security measures. You may request a copy of the applicable safeguards from privacy@facereview.org. Your data remains subject to applicable transfer protections.
9. How Long Data Is Kept
Account content: we keep your profile, photographs, Analyses, conversations, saved summaries and plans until you request their deletion or delete your account. Section 5 describes temporary results and OpenAI’s separate retention periods.
Deletion and exceptions: account deletion removes your content and uploaded files. We keep only the records needed for refunds, creator payouts, payments, tax or accounting duties, or a specific dispute, until the relevant obligation or claim period ends. Their use is restricted to those purposes. Stricter health-data deletion rules in our Washington and Nevada notices still apply where applicable.
Security and usage: account-linked records are removed with your account. Sign-up security records are kept for 90 days. Other security or payment records are kept only as long as needed to investigate abuse or resolve a transaction or claim, then deleted or irreversibly anonymized.
Privacy requests: a limited record of your request and our response is kept for six months after closure, without photographs or Analysis content.
Backups and residual copies: our current database service does not include scheduled backups or point-in-time recovery available to FaceReview. Uploaded photographs are stored separately and are not included in database backups. Providers may retain residual copies for recovery, security or legal obligations under their contractual retention and deletion rules; this does not mean deleted content remains available in your account. Any recovery copies are restricted from ordinary use, and deletion requests are reapplied if restored. Section 5 describes OpenAI’s retention periods; browser-storage durations are below.
10. Your Controls and Privacy Rights
Account settings let you update your profile, export your data and saved photographs, or delete your account. You can also delete conversations. To change or delete saved summaries, plans or other information without an in-product control, contact privacy@facereview.org.
Depending on applicable law, you may obtain confirmation and access, correct inaccurate data, request erasure or restriction, receive a portable copy, object to processing based on legitimate interests, withdraw consent and challenge qualifying automated decisions. Objection to direct marketing is unconditional. You may exercise these rights without deleting your account. If a lawful exception limits our response, we explain it.
We verify identity proportionately, normally through your account or its email address, and request only what is necessary. An authorized representative may act with appropriate authority. Exercising a privacy right does not lead to unlawful discrimination; a feature may nevertheless need data you have chosen not to provide.
For GDPR and UK GDPR requests, we respond within one month. If complexity or the number of requests requires up to two additional months, we explain the extension within the first month. Requests are normally free; lawful restrictions for manifestly unfounded or excessive requests apply. Swiss requests are generally answered within 30 days, with any justified delay explained.
You may complain to a competent supervisory authority, including the authority of your habitual residence, place of work or the alleged infringement. EEA contacts appear in the EDPB authority directory; UK complaints go to the Information Commissioner’s Office, and Swiss complaints to the FDPIC. Contacting us first is not a condition for complaining.
12. Security and Children
We use access controls and other safeguards to protect your account and private content. No service can eliminate all security risk. We notify affected people and authorities of breaches as required by applicable law.
FaceReview is for adults aged 18 or over, and we ask you to confirm your age when registering. If we learn a minor has provided personal data, we take steps to remove it and close the account. Report concerns to privacy@facereview.org.
13. Changes to This Policy
This is version 2026-10-10-privacy-europe. We record the notice version acknowledged with your account. We give at least 30 days’ advance notice by email or in-product notice of a material adverse change, unless an earlier change is required by law or to address an urgent security issue. We explain such exceptions promptly. Before using your data for a new purpose that requires consent, we explain that purpose and ask for your fresh consent.