Face Data Policy

This Face Data Policy explains how Viral Apps Labs LLC ("we," "us," or "our") handles facial imagery and selfie photos when you use the Artia mobile application and the website at getartia.app (the "Service"). This policy supplements our Privacy Policy with specific detail about face-related data.

We understand that your face is uniquely personal. We take the handling of photos that contain your likeness seriously and have designed our systems to minimize data collection, limit retention, and give you full control over your images.

1. Scope & Definitions

This policy applies whenever you upload, capture, or otherwise provide a photo containing a human face to the Service. Key terms used in this policy:

• "Face data" means any photograph, image, or visual depiction you provide to the Service that contains human facial features or likeness.
• "Biometric identifier" means data generated by measuring or analyzing biological characteristics that can be used to identify a specific individual — such as a facial geometry scan, faceprint, retina scan, fingerprint, or voiceprint. As explained below, Artia does not extract biometric identifiers.
• "AI processing" means the transformation of your uploaded photo by third-party AI image generation models to produce a new, styled output image.
• "Generated images" means the AI-created photos produced from your selfie and a style prompt.

2. What Face Data We Collect

We collect only the face data you voluntarily provide when using the generation feature:

• Selfie photos: Photos you upload from your device's camera roll or capture in-app. These photos contain your facial imagery and likeness.
• Reference images: If you use Pinterest Reference Mode, the reference image you provide may contain faces. These are processed temporarily and are not stored permanently.
• Generated images: The AI-styled photos produced from your selfie. These contain a stylized representation of your likeness.

We do not access your device's photo library beyond the specific photos you select and upload. We do not run background scans of your camera roll.

3. How We Use Your Face Data

Your face data is used for a single purpose: to generate the AI-styled photos you explicitly request. Specifically:

• Your selfie is sent to our backend server, which forwards it along with a style prompt to a third-party AI image generation service.
• The AI model uses your selfie as a visual reference to produce a new stylized image that preserves your likeness.
• The generated images are stored in your account gallery so you can view, download, and share them.

4. What We Do Not Do

Transparency means being clear about what we do not do with your photos. Artia does not:

• Extract biometric identifiers: We do not generate, compute, or store facial geometry maps, faceprints, facial feature vectors, or any mathematical representation derived from your facial characteristics.
• Perform facial recognition: We do not identify, verify, or authenticate individuals by comparing faces against any database or template.
• Build face databases: We do not aggregate face data across users or build datasets of facial imagery for any purpose.
• Sell or license face data: We never sell, rent, lease, trade, or otherwise make your face data available to third parties for their own purposes.
• Use photos for AI training: Your uploaded selfies and generated images are not used to train, fine-tune, or improve AI models — ours or any third party's.
• Use photos for advertising: Your face data is never used for targeted advertising, behavioral profiling, or marketing purposes.
• Share with law enforcement: We do not voluntarily provide face data to law enforcement agencies. We will only disclose data if compelled by a valid legal process (court order, subpoena).
• Perform emotion analysis: We do not analyze facial expressions, emotions, or sentiment from your photos.

5. AI Processing Pipeline

Understanding exactly how your photo is processed is important. Here is a step-by-step description of what happens when you generate a photo:

1. You upload a selfie: You select a photo from your device and confirm you want to generate. At this point, an AI consent screen is displayed, and you must actively consent before proceeding.
2. Upload to our servers: Your selfie is transmitted over an encrypted (TLS/HTTPS) connection to our backend API server hosted on Hetzner in Germany (EU).
3. Prompt generation: Our system creates a text description of the desired style. This prompt is refined by Google Gemini (a text AI model). Gemini does not receive or process your photo.
4. Image generation: Your selfie and the text prompt are sent to the Wavespeed API, a third-party AI image generation service. The AI model treats your selfie as a visual input (image-to-image generation) and produces a new styled output image. This is not biometric processing — the model does not extract facial geometry or create an identity template.
5. Storage and delivery: The generated images are uploaded to Cloudflare R2 (cloud storage) and delivered to your device. They appear in your account gallery.
6. Original cleanup: Your original selfie upload is purged from our backend servers within 72 hours after generation is complete.

6. Third-Party Processors

The following third-party services process your face data on our behalf. They act as data processors and are contractually prohibited from using your data for any purpose other than providing the service to us:

7. Consent & Control

We believe informed consent is foundational to handling face data responsibly.

7.1 How We Obtain Consent

• AI consent screen: Before your first photo generation, the app displays a clear consent modal explaining that your selfie will be processed by AI to create styled photos. You must actively tap to consent before any processing begins.
• Per-action upload: Each generation requires you to explicitly select and upload a photo. We never process photos without your direct initiation.
• No pre-checked boxes: Consent is never assumed or inferred from other actions.

7.2 Your Control

• Delete individual photos: You can delete any generated photo from your gallery at any time within the app.
• Delete your account: You can request complete account deletion, which removes all your data including all photos, by emailing [email protected] or using the in-app account deletion feature.
• Withdraw consent: You can stop using the generation feature at any time. Withdrawal of consent does not affect the lawfulness of processing performed before withdrawal.
• Data access: You may request a copy of all face data we hold about you by emailing [email protected].

8. Retention & Deletion

We follow a principle of minimal retention — face data is kept only as long as necessary to serve you.

When face data is deleted, it is permanently removed from our servers and cloud storage. We do not retain copies, backups, or derivatives of deleted face data beyond the timeframes stated above.

9. Illinois Biometric Information Privacy Act (BIPA) Disclosure

The Illinois Biometric Information Privacy Act (740 ILCS 14) regulates the collection, use, and storage of biometric identifiers and biometric information. We provide this disclosure out of an abundance of transparency for Illinois residents.

9.1 Key Distinction: Photos vs. Biometric Identifiers

BIPA defines "biometric identifier" as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. BIPA explicitly excludes "photographs" from the definition of biometric identifiers (740 ILCS 14/10).

Artia processes photographs — not scans of face geometry. Our AI pipeline takes a pixel-level photo as input and produces a pixel-level photo as output. At no point do we extract, compute, or store facial geometry, facial feature measurements, faceprints, or any mathematical representation of facial characteristics.

Because Artia does not capture, collect, or otherwise obtain biometric identifiers as defined by BIPA, we believe BIPA's written consent and retention requirements do not apply to our processing. However, we voluntarily adopt the spirit of BIPA's protections:

9.2 Voluntary BIPA-Aligned Practices

• Written disclosure: This policy serves as our written disclosure of our face data practices, published and publicly accessible.
• Consent: We obtain your affirmative consent before processing your photos through AI, via an in-app consent modal.
• Retention schedule: Original selfie uploads are purged within 72 hours. Generated images are kept until you delete them or your account.
• No sale or profit: We do not sell, lease, trade, or otherwise profit from your face data beyond providing the image generation service you requested.
• Deletion mechanism: You can request complete deletion of all face data at any time by emailing [email protected] or using in-app account deletion.

10. Texas, Washington & Other State Biometric Laws

10.1 Texas Capture or Use of Biometric Identifier Act (CUBI)

Texas CUBI (Tex. Bus. & Com. Code Ann. Chapter 503) regulates the capture of biometric identifiers (retina/iris scan, fingerprint, voiceprint, or record of hand or face geometry) for commercial purposes. Because Artia does not capture face geometry or any biometric identifier as defined by CUBI, and our processing consists of image-to-image AI generation rather than biometric identification, we believe CUBI's restrictions do not apply to our processing. Regardless, we provide notice and obtain consent before processing.

10.2 Washington Biometric Identifier Law

Washington's law (RCW 19.375) applies to entities that "enroll" biometric identifiers in a database for the purpose of identifying a specific individual. Artia does not enroll biometric identifiers, does not match biometric data to individuals, and does not maintain a biometric database.

10.3 Other State Laws

Several additional states have enacted or are considering biometric privacy legislation (including Colorado, Connecticut, Virginia, and others with comprehensive privacy laws covering biometric data). Regardless of which state you reside in, we apply the same high standard of transparency, consent, and data minimization described in this policy to all users.

11. EU/UK GDPR (Article 9 — Special Categories)

Under the EU General Data Protection Regulation, "biometric data" processed for the purpose of uniquely identifying a natural person constitutes a "special category" of personal data under Article 9, which is subject to heightened protections.

Artia processes your photos for the purpose of image generation, not for the purpose of uniquely identifying you. We do not use facial recognition or biometric identification technology. Therefore, while your photos are personal data under GDPR, we do not believe they constitute "biometric data" within the meaning of Article 9 as processed by our Service.

Nonetheless, out of respect for the sensitivity of facial imagery, we apply the following Article 9-aligned safeguards:

• Explicit consent (Art. 9(2)(a)): We obtain your explicit, informed consent before any AI processing of your photos. You provide this consent through an active, affirmative action (tapping the consent button in the AI consent modal).
• Purpose limitation: Face data is processed solely for the purpose you consented to — generating styled AI photos.
• Data minimization: We collect only the photo(s) necessary for each generation request and purge originals promptly.
• Enhanced security: Photos are transmitted over encrypted connections (TLS) and stored on EU-based servers with restricted access.
• Right to erasure: You may request deletion of all face data at any time, and we will comply within 30 days.

Our backend servers are located in the EU (Hetzner, Germany). Where your data is transferred to third-party processors outside the EEA (e.g., Wavespeed API for image generation), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs).

12. California Privacy Rights (CCPA/CPRA)

Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), photographs and facial imagery may be considered "sensitive personal information." California residents have the following rights with respect to their face data:

• Right to know: You may request the specific pieces of face data we hold, the purposes for which it is used, and the categories of third parties with whom it is shared.
• Right to delete: You may request deletion of all face data we hold about you.
• Right to limit use of sensitive data: We use your face data only for the purpose of providing the image generation service you requested. We do not use it for any secondary purpose.
• No sale or sharing: We do not sell your face data. We do not share it for cross-context behavioral advertising.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, email [email protected] with the subject line "CCPA Face Data Request."

13. Apple App Store Compliance

Artia complies with Apple's App Store Review Guidelines regarding user data and privacy, including:

• Guideline 5.1.1 (Data Collection and Storage): We collect only the data necessary to provide the Service and have implemented appropriate security measures to protect it.
• Guideline 5.1.2 (Data Use and Sharing): We clearly disclose that user photos are processed by third-party AI services (Wavespeed API, Google Gemini) and obtain explicit user consent before any photo data leaves the device. The specific AI providers are identified by name in the in-app consent flow and in this policy.
• Guideline 5.1.2(i) (Third-Party AI): In compliance with Apple's November 2025 update, we explicitly disclose that personal data (photos) is shared with named third-party AI services and obtain clear permission before transmission.
• Face data restrictions: Data gathered from facial imagery is not used for marketing, advertising, or use-based data mining by us or by any third party.
• App Tracking Transparency: Artia does not use advertising identifiers or track users across apps and websites.

14. Security Measures

Given the sensitive nature of facial imagery, we implement heightened security measures for face data:

• Encryption in transit: All photo uploads and downloads are encrypted using TLS 1.2 or higher (HTTPS).
• EU-based servers: Backend API servers are hosted in Germany (EU) by Hetzner, subject to EU data protection standards.
• Access controls: Access to stored photos is restricted and authenticated. Generated images are stored with unique, non-guessable URLs on Cloudflare R2.
• Minimal retention: Original selfie uploads are purged within 72 hours.
• Authentication: Account access is protected by industry-standard OAuth 2.0 / OpenID Connect (Apple Sign In, Google Sign In).
• No persistent caching: Face data is not cached on edge servers or CDN nodes beyond the necessary delivery period.

While we employ strong protections, no system is completely immune to security risks. If we become aware of a data breach affecting your face data, we will notify you in accordance with applicable data breach notification laws.

15. Children & Minors

Artia is rated 17+ on the Apple App Store and is not intended for children under 13. We do not knowingly collect face data from children under the age of 13. If we become aware that we have processed photos from a child under 13, we will delete all associated face data as quickly as possible.

For users between 13 and 17, we recommend parental or guardian involvement, as the Service involves uploading personal photos containing facial imagery. Parents or guardians may contact us at [email protected] to request deletion of a minor's face data.

This is consistent with updated COPPA rules (2025) which include biometric data in the definition of protected children's information. Although our processing does not involve biometric identifiers, we apply COPPA-aligned protections to all photos uploaded by minors.

16. Changes to This Policy

We may update this Face Data Policy to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Provide notice through the app or via email for significant changes (e.g., new third-party processors, changes to retention periods, or new uses of face data).
• Where required by law, obtain fresh consent before applying material changes to already-collected face data.

17. Contact & Data Requests

For questions about this policy, to exercise your rights, or to submit a face data request, contact us:

For GDPR-related inquiries, you may also contact your local data protection authority. For BIPA-related inquiries, you may contact the Illinois Attorney General's office. For CCPA-related inquiries, you may contact the California Attorney General's office.

This Face Data Policy is effective as of May 6, 2026 and applies to all face data collected from that date forward.