If you live in the EEA, Switzerland or the UK, see the Europe Privacy Policy.
1. Who Is Responsible
The controller is Matteo Arcesi, sole proprietor trading as FaceReview, at Via Lorenzo Pareto 7R, 16129 Genova (GE), Italy (“FaceReview”, “we”). Contact privacy@facereview.org for privacy questions and rights requests. Telephone: +39 379 2161464; certified email (PEC): facereview@pecprofessionale.com. Further operator details are in the Terms of Use.
This Policy covers the website, FaceReview accounts, available apps, AI features, subscriptions and Partner Program. The country-specific provisions below supplement the common information in this Policy. You retain all privacy rights available under the laws applicable to you, including GDPR rights where applicable, regardless of which regional edition you select.
2. Data and Sources
We collect personal data from you, your sign-in and payment providers, your browser or app, and the results generated when you use FaceReview:
- Account and profile: account identifiers, email, sign-in profile details, display name, age, sex as entered for comparison, onboarding answers and how you found us. We also record age confirmation and your privacy, consent and terms choices.
- Photographs and Analyses: uploaded front and profile images, facial landmarks and measurements, photo quality, appearance scores, comparisons and written interpretations (together, “Analyses”).
- Assistant and plans: messages, replies and conversation summaries; goals, routine, budget, region, language, appearance concerns, previous treatments and preferences; and generated plans and images.
- Billing and usage: customer and subscription references, plan, price, payment status, refunds, feature usage, service costs and errors. Payment providers collect payment, billing-address and tax details directly.
- Security and technical data: device and session identifiers, approximate network information, verification results and service logs used to prevent abuse and diagnose faults. Hosting and security providers may also process IP addresses.
- Referral and creator data: referral codes, link visits and browser identifiers, campaign statistics, commissions, payout details and required verification, tax or support records.
Approximate country information supplied by the delivery network may select regional legal content, billing currency or security checks. We do not collect precise device location for these purposes. You may also give us information when contacting support. Do not include unrelated sensitive information or another person’s photographs.
3. How We Use Data
We use personal data to:
- Provide your account, Analyses, conversations, progress history, plans and images.
- Manage subscriptions, plan limits, referrals, creator commissions and support.
- Protect and improve the service, prevent fraud and abuse, diagnose faults and resolve disputes.
- Meet accounting, tax, refund and other legal obligations.
- Provide optional marketing and browser referral attribution with consent where required.
Where applicable law requires a legal basis, we rely on our contract with you, legal obligations, our interests in security and reliable service where they do not override your rights, or consent, depending on the purpose. The Europe Privacy Policy explains the GDPR and UK GDPR bases.
We do not sell advertising audiences or make unrelated sensitive inferences. You can opt out of marketing without stopping service, security or billing messages.
Account and transaction details are needed to register or buy a subscription. Photographs and feature answers are optional, but without them we cannot provide features that need them. You are not generally required by law to provide this information.
4. Facial and Health-Related Information
We process your facial photographs and facial geometry to measure facial features and provide appearance Analyses and progress history. We do not use this information to identify you against a facial-recognition database or authenticate your identity.
Skin or hair concerns, previous treatments and information inferred in an Analysis, conversation or plan may reveal health data. We process the information needed to provide an Analysis, conversation, plan or image simulation when you request that feature.
Use Privacy settings or contact privacy@facereview.org to request access, correction, a recipient list, cessation of future collection or sharing, or deletion. You may keep your account without uploading a photograph. Our Washington and Nevada Consumer Health Data Privacy Policies explain applicable consumer health-data rights.
Illinois biometric information: If your facial geometry or related biometric identifiers or biometric information are protected by the Illinois Biometric Information Privacy Act (BIPA), we provide written notice of the information collected, its purpose and retention period, and obtain your informed written release before collecting it. We use the information to produce your requested facial measurements and maintain the associated Analysis and progress history. We permanently destroy it when that purpose has been fulfilled or within three years of your last interaction with FaceReview, whichever occurs first, unless a valid court warrant or subpoena requires otherwise. We do not sell, lease, trade or otherwise profit from this information. We obtain any consent required by BIPA before disclosing it, except for disclosures that BIPA permits without consent.
5. Photographs, AI and Generated Images
The Free Preview calculates a limited set of facial proportions on your device; your photographs and those measurements stay on your device and are not uploaded or sent to an AI provider. Other Free Preview results are samples. Uploaded Analysis photographs are stored privately.
To provide the AI feature you request, we send OpenAI the relevant photographs, messages, profile details, Analysis results and conversation context, including saved summaries. These inputs may reveal your identity or health-related information. OpenAI uses them to produce Analyses, replies, plans or image simulations.
Data sent through OpenAI’s API is not used to train its general-purpose models by default. OpenAI may retain data temporarily to provide the service for up to 24 hours, and inputs and outputs in abuse-monitoring logs for up to 30 days. Longer retention may apply for legal obligations or safety review, including images flagged by safety checks. See OpenAI’s data controls.
Saved Analyses, conversations and plans remain in your account as described in Section 9. DNA Lab images are delivered to your browser and are not added to your saved Analysis photographs. Temporary copies of generated images and other results let you recover interrupted requests for 30 minutes, after which they are scheduled for deletion. Copies you download or keep on your device remain under your control.
6. Automated Processing and Review
Analyses and plans estimate appearance characteristics using photographs, profile information and reference data. They are intended for your own information and do not determine employment, credit, insurance or other legal entitlements.
Automated security checks may delay or refuse a request, promotional credit or referral attribution. You may contest an outcome, explain your circumstances and request review by a person through privacy@facereview.org. Any additional right concerning decisions with legal or similarly significant effects remains available under applicable law.
7. Who Receives Data
- Supabase: sign-in and storage of accounts, uploaded photographs, conversations, results and subscription information, in Paris, France.
- OpenAI: the data described in Section 5 and account-linked abuse-prevention data needed to operate AI features safely.
- Google and, where offered, Apple: sign-in and their own account services. They disclose the profile information authorized during sign-in.
- Resend, when enabled: contact and transaction details needed to send account messages and withdrawal acknowledgements. We do not include Analysis photos, health information or conversations in those messages.
- Stripe: website checkout, subscriptions, refunds and creator payouts. Stripe collects payment and creator identity/bank details directly; FaceReview receives transaction, account and verification-status information. For store purchases, Apple or Google and RevenueCat process purchase identifiers and entitlement data.
- Cloudflare: Turnstile verification and associated network and interaction data for abuse prevention.
- Vercel: application hosting, delivery and technical request logs. Application server functions are configured in Paris, France; website delivery uses Vercel’s global network, and related processing may also occur in the United States and other countries.
Our providers process data to provide their services to us. Google, Apple and payment providers may also use data for their own account services, legal duties or fraud prevention under their privacy notices.
Creators receive referral references, campaign and commission information, not your uploaded photographs, Analyses, health details or conversations. We may disclose limited necessary information to advisers, authorities or parties to a legal claim when justified by law. A business transfer may involve a successor subject to applicable privacy safeguards and notice requirements. We do not sell personal data, share it for cross-context behavioural advertising or provide private content to creators for promotion.
8. International Processing
Providers may process data outside your country, including in the United States; local laws and access by public authorities can differ. Storing our database in France does not mean all provider processing stays in Europe.
For transfers protected by EEA, UK or Swiss data-protection law, the applicable provider terms provide these safeguards:
- Supabase, Vercel and Resend: EU Standard Contractual Clauses, with the relevant UK addendum and Swiss adaptations.
- OpenAI: EEA and Swiss data is processed under its agreement with OpenAI Ireland; onward transfers use Standard Contractual Clauses or an applicable adequacy decision. UK transfers use the clauses with the UK addendum.
- Stripe and Cloudflare: the EU–US Data Privacy Framework and its UK extension and Swiss–US counterpart for covered transfers; Standard Contractual Clauses with regional adaptations where that framework does not apply.
- Where app purchases use RevenueCat, its terms provide Standard Contractual Clauses with UK and Swiss adaptations. Google and Apple explain safeguards for their own sign-in and store services in their privacy notices.
These terms also describe the providers’ security measures. You may request a copy of the applicable safeguards from privacy@facereview.org. Your data remains subject to applicable transfer protections.
9. How Long Data Is Kept
Account content: we keep your profile, photographs, Analyses, conversations, saved summaries and plans until you request their deletion or delete your account. Section 5 describes temporary results and OpenAI’s separate retention periods.
Deletion and exceptions: account deletion removes your content and uploaded files. We keep only the records needed for refunds, creator payouts, payments, tax or accounting duties, or a specific dispute, until the relevant obligation or claim period ends. The stricter biometric and health-data deletion rules in Section 4 and our Washington and Nevada notices still apply.
Security and usage: account-linked records are removed with your account. Sign-up security records are kept for 90 days. Other security or payment records are kept only as long as needed to investigate abuse or resolve a transaction or claim, then deleted or irreversibly anonymized.
Privacy requests: a limited record of your request and our response is kept for six months after closure, without photographs or Analysis content.
Backups and residual copies: our current database service does not include scheduled backups or point-in-time recovery available to FaceReview. Uploaded photographs are stored separately and are not included in database backups. Providers may retain residual copies for recovery, security or legal obligations under their contractual retention and deletion rules; this does not mean deleted content remains available in your account. Any recovery copies are restricted from ordinary use, and deletion requests are reapplied if restored. Section 5 describes OpenAI’s retention periods; browser-storage durations are below.
10. Your Controls and Privacy Rights
Account settings let you update your profile, export your data and saved photographs, or delete your account. You can also delete conversations. To change or delete saved summaries, plans or other information without an in-product control, contact privacy@facereview.org.
Depending on applicable law, you may confirm whether we hold your data, access or correct it, request deletion or restricted use, receive a portable copy, object to certain processing, withdraw consent and challenge qualifying automated decisions. You can always opt out of direct marketing. You may exercise these rights without deleting your account. If a lawful exception limits our response, we explain it.
We verify identity proportionately, normally through your account or its email address, and request only what is necessary. An authorized representative may act with appropriate authority. Exercising a privacy right does not lead to unlawful discrimination; a feature may nevertheless need data you have chosen not to provide.
We respond within the period required by the applicable law. We normally aim to respond within 30 days; where a law permits 45 days or an extension, we explain any extension and its reason within the initial deadline. If a request is refused, we explain the reason and available appeal or complaint route. You may complain to your competent privacy or consumer authority.
12. Security and Children
We use access controls and other safeguards to protect your account and private content. No service can eliminate all security risk. We notify affected people and authorities of breaches as required by applicable law.
FaceReview is for adults aged 18 or over, and we ask you to confirm your age when registering. If we learn a minor has provided personal data, we take steps to remove it and close the account. Report concerns to privacy@facereview.org.
13. Changes to This Policy
This is version 2026-10-10-privacy-rest-of-world. We record the notice version acknowledged with your account. We give at least 30 days’ advance notice by email or in-product notice of a material adverse change, unless an earlier change is required by law or to address an urgent security issue. We explain such exceptions promptly. Before using your data for a new purpose that requires consent, we explain that purpose and ask for your fresh consent.
14. United States Privacy Rights
Where a state privacy law applies to you and FaceReview, its additional rights apply. The categories, sources, purposes, recipients and retention criteria in Sections 2–9 describe our collection and disclosures, including identifiers, commercial records, internet activity, inferences and sensitive information. We do not sell personal information, share it for cross-context behavioural advertising or use it for targeted advertising.
You may exercise applicable rights to know, access, correct, delete, obtain a portable copy, and limit or opt out of qualifying processing of sensitive information or significant-decision profiling. An authorized agent may submit a request; we may verify authority and identity. Where an opt-out preference signal such as Global Privacy Control applies, we honor its legally required scope. Our current no-sale and no-targeted-advertising practices apply whether or not you send a signal.
California requests under the CCPA/CPRA are generally answered within 45 days, with a permitted extension notified during that period. In states providing an appeal, reply to our decision or contact privacy@facereview.org asking for an appeal; we respond within the applicable deadline and provide the competent attorney-general or regulator complaint route. The separate Washington and Nevada Consumer Health Data Privacy Policies cover applicable consumer health-data rights.
15. Other Regional Rights
Canada: applicable federal and provincial laws govern meaningful consent, access, correction, withdrawal and complaints to the relevant commissioner, including the Office of the Privacy Commissioner of Canada. We ask for the consent required by those laws before processing sensitive information.
Australia: where the Privacy Act applies, you may request access and correction and raise a complaint with us or the OAIC. Overseas disclosure is described in Section 8.
Brazil: where the LGPD applies, rights include confirmation, access, correction, portability, anonymization, blocking or deletion where appropriate, information about sharing, revocation of consent and review of qualifying automated decisions. You may also petition the ANPD.
Other applicable local rights and mandatory notice, consent, transfer and complaint requirements prevail. Use privacy@facereview.org to exercise them; you do not need to give up a local right to use this Policy’s request route.