Privacy Policy

1. Information We Collect

We collect the following types of information:

• Account information: Name, email address, and hashed password when you register. If you sign in with Google, we receive your name and email from Google.
• Uploaded content: Portrait images and reference thumbnails you upload for generation. These are stored securely and used solely to produce your thumbnails.
• Payment information: Billing is handled by Stripe. We do not store credit card numbers. We receive subscription status, plan details, and Stripe customer ID.
• Usage data: Pages visited, features used, generation counts, and error logs to improve the Service. Collected via PostHog (product analytics), Sentry (error monitoring), and Vercel Analytics (page performance).
• Technical data: IP addresses, user agent strings, and timestamps are logged for security and fraud prevention purposes (e.g., login attempts, account activity). IP addresses are automatically anonymized after 90 days.

2. How We Use Your Information

• To provide and operate the thumbnail generation service.
• To process payments and manage subscriptions.
• To send transactional emails (password resets, payment confirmations, account notices).
• To diagnose errors and improve service reliability.
• To respond to your support requests and communicate about your account.

We do not sell your personal information to third parties. We do not use your uploaded images to train AI models.

3. Data Storage & Security

• Account data is stored in a Neon (PostgreSQL) database.
• Uploaded images and generated thumbnails are stored in Cloudflare R2 (S3-compatible object storage).
• The application is hosted on Vercel with encrypted connections (HTTPS) throughout.
• Passwords are hashed using industry-standard algorithms. We support multi-factor authentication (MFA) for additional security.

4. Third-Party Services

We use the following third-party services to operate FacelessLab:

• Stripe — payment processing
• Postmark, Mailgun, Resend — transactional email delivery
• Sentry — error monitoring and session replay (anonymized, consent required)
• PostHog — product analytics and session recording (consent required)
• Vercel — hosting, edge functions, page analytics (Vercel Analytics), and performance monitoring (Speed Insights)
• Cloudflare R2 — image storage
• OpenAI — prompt engineering and text generation (images are not retained by the provider)
• Google Gemini — AI image generation and vision analysis (images are processed but not stored by Google)
• Inngest — background job orchestration (processes events server-side; does not store personal data independently)

Each provider processes data in accordance with their own privacy policy. We only share the minimum data necessary for each service to function.

5. Cookies & Tracking

We use the following categories of cookies:

• Essential cookies (always active) — Authentication sessions (NextAuth), CSRF protection, and cookie consent preferences. These are required for the app to function and cannot be disabled.
• Analytics cookies (consent required) — PostHog and Vercel Analytics use cookies and local storage to understand how people use the app. No advertising or cross-site tracking is performed.
• Session replay cookies (consent required) — Sentry and PostHog may record anonymized session replays to diagnose bugs. Sensitive form inputs (passwords, card numbers) are automatically masked.

When you first visit FacelessLab, a cookie consent banner lets you accept or reject non-essential cookies. You can change or withdraw your consent at any time from the "Cookie Settings" link at the bottom of every page. We do not use advertising cookies or sell data to ad networks.

6. Your Rights (GDPR & CCPA)

Regardless of your location, you have the right to:

• Access — Request a copy of all personal data we hold about you.
• Rectification — Update or correct inaccurate information.
• Deletion — Delete your account and all associated data (portraits, generated thumbnails, usage history) yourself from Email Preferences in your dashboard, or request deletion by contacting support.
• Data portability — Receive your data in a machine-readable format.
• Opt out — Withdraw consent for non-essential processing at any time.

To exercise any of these rights, contact support@facelesslab.ai or use our contact form. We will respond within 30 days.

7. Data Retention

• Active accounts: Data is retained as long as your account is active.
• Deleted accounts: We delete all personal data, uploaded images, and generated thumbnails within 30 days of account deletion.
• Billing records: Transaction records may be retained for up to 7 years as required by tax and financial regulations.

8. Children's Privacy

FacelessLab is not intended for use by anyone under 13 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us to have it removed.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to active users. The "Effective date" at the top reflects the most recent revision.

10. Contact

Questions about your privacy? Contact us at support@facelesslab.ai or use our contact form.

Operating entity: INTERNET MASTERY US LLC
Country: United States