1. Notice
This document is the written notice required by biometric privacy laws, including the Illinois Biometric Information Privacy Act and comparable statutes, and forms part of our Article 9 GDPR explicit-consent record.
To provide face swap, avatar, photo swap, character swap, lip-sync and voice features, Deepacal and its processors extract and process biometric identifiers and biometric information — facial geometry derived from images and video frames, and voiceprints derived from audio.
2. Purpose and limitation
Biometric data is processed for the sole purpose of generating the media you request. It is never used to identify you, to build or query an identity or surveillance database, for advertising, for profiling, or for sale, lease, trade or other commercial disclosure.
3. Your consent and your warranties
By uploading a face or voice you give explicit, informed consent to this processing, and you warrant that the subject is you, or that you hold equivalent written, informed consent from every identifiable individual, including where required their consent to biometric processing, storage and destruction terms.
You must retain evidence of third-party consent and provide it to us on request. You are the controller of any third-party likeness you upload and are responsible for meeting your own notice and consent obligations.
4. Storage and safeguards
Facial images, saved faces and generated outputs are stored in private buckets accessible only through short-lived signed URLs bound to your authenticated session. Data is encrypted in transit and at rest, access is restricted and privileged access is logged. Real-time webcam frames are streamed for inference and are not persistently stored by Deepacal unless you choose to record.
5. Retention and destruction
Biometric identifiers are destroyed when the purpose is satisfied — when you delete the face, recording or account — and in any event no later than three (3) years after your last interaction with Deepacal, whichever occurs first.
6. Withdrawal of consent
You may withdraw consent at any time by deleting the relevant faces and media or by emailing privacy@deepacal.com. Withdrawal stops future processing, does not affect prior lawful processing, and will disable features that require biometric input.
7. Prohibited biometric uses
You must not use Deepacal for biometric surveillance, emotion inference in employment or education, biometric categorisation of protected characteristics, or defeating identity, age or liveness verification. These uses are prohibited outright and may be unlawful under the EU AI Act and other regimes.