1. Who we are
Deepacal is the controller of personal data processed through deepacal.com and the Deepacal applications. Privacy questions, requests and complaints: privacy@deepacal.com.
This Policy explains what we collect, why, on what legal basis, who we share it with, how long we keep it, and the rights available to you.
2. Personal data we collect
- Account data — email address, password hash, display name, country, WhatsApp number, profile photo (administrators), account status, roles and activation status.
- Authentication and security data — two-factor secrets and verified-session records, one-time codes, login and heartbeat timestamps, IP address, user agent, device and platform (web, PWA, Windows desktop).
- Biometric and likeness data — facial images you upload, saved faces, source and target photos, webcam frames processed for live face swap, generated avatars, and voice recordings used for cloning or voiceover. See the Face Upload & Biometric Consent Policy.
- Content data — scripts, prompts, uploaded videos and audio, generated videos and images, subtitles and translations, recordings saved to your Library, and Studio jobs, templates and schedules.
- Transaction data — credit balances and ledger entries, credit pack purchases, activation payments, payment provider references and transaction status. We do not store full card numbers.
- Telecom data — where you use Numbers: the service selected, virtual number allocated, area code, rental duration, verification status and the contents of verification messages received by that number.
- Support and communications data — messages you send us, email delivery, bounce and suppression records, broadcast and notification history.
- Technical and usage data — feature usage, error and diagnostic logs, performance and stream statistics, and administrative audit records including impersonation events.
3. Why we process personal data and our legal bases
- To provide the Services you request, including generating, transcoding, storing and delivering media — performance of a contract.
- To process biometric and voice data for face swap, avatar, lip-sync and cloning features — your explicit consent, which you may withdraw at any time.
- To take payment, prevent chargebacks and maintain accounting records — contract and legal obligation.
- To secure the platform, detect fraud, impersonation, abuse and multi-accounting, and to enforce our policies — legitimate interests and legal obligation.
- To communicate service, security, billing and support messages — contract and legitimate interests.
- To send optional marketing and product updates — consent, withdrawable via the unsubscribe link in every message.
- To comply with law, respond to lawful requests and defend legal claims — legal obligation and legitimate interests.
4. Special category and biometric data
Facial geometry and voiceprints may constitute biometric data or special category data under the EU/UK GDPR, the Nigeria Data Protection Act, BIPA-style US state laws and similar regimes. We process them only where you have given explicit, informed, revocable consent, only to deliver the feature you requested, and never to identify you, to build an identity database, to sell, or to train third-party models where a provider offers an opt-out.
Uploaded faces and generated media are stored in private storage and served only through short-lived signed links tied to your account.
6. International transfers
Our providers operate globally, so your data may be transferred outside your country, including to the United States and the European Union. Where required, transfers rely on adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent safeguards, together with encryption in transit and at rest.
7. Retention
We keep personal data only as long as necessary. Live session records, billing history, transaction logs and impersonation records are automatically purged after seven (7) days. Pending payment attempts older than twenty-four (24) hours are cleared. Library recordings, saved faces and generated media are kept until you delete them or close your account. Accounting records are retained for the period required by tax law. Full detail is in the Data Retention & Deletion Policy.
8. Your rights
Submit requests to privacy@deepacal.com or delete your account directly from Account settings. We respond within thirty (30) days and may need to verify your identity before acting.
- Access, rectification and erasure of your personal data.
- Withdrawal of biometric or marketing consent at any time, without affecting prior lawful processing.
- Restriction of and objection to processing, including to processing based on legitimate interests.
- Data portability in a structured, commonly used, machine-readable format.
- The right not to be subject to solely automated decisions producing legal or similarly significant effects; automated abuse and fraud checks are subject to human review on request.
- For California residents: the rights to know, delete, correct, and to opt out of sale or sharing — we do not sell or share personal information as those terms are defined — and the right to non-discrimination.
- The right to lodge a complaint with your supervisory authority, including the Nigeria Data Protection Commission or your EU/UK regulator.
9. Security
We apply row-level access control, encryption in transit and at rest, private storage buckets with signed URLs, hashed credentials, two-factor authentication, rate limiting, webhook signature verification and privileged-action audit logging. No system is perfectly secure; see the Security Policy and the Vulnerability Disclosure Policy.
10. Children
The Services are for adults. We do not knowingly collect data from anyone under 18. If we learn that a minor has registered or that a minor's likeness has been uploaded without lawful basis, we will delete the data and terminate the account.
11. Changes
We will post any update here and, where the change is material, notify you by email or in-app notice before it takes effect.