Biometric Data Policy

1. The short version

• We locate faces in your photos so we can paint the right people. That is measurement of position, not recognition.
• We compute a face geometry scan — a list of numbers describing the shape of a face — in exactly one situation: when the likeness of your painting is improved. It is used only to work out which painted face belongs to which person, and only within that one request.
• That scan is never written to disk, never stored in a database, and never sent anywhere. It exists in memory for the seconds the improvement takes and is destroyed when the request ends.
• We never sell, lease, trade, or otherwise profit from face data, and we never use it to identify you.
• We never use your photos or any measurement taken from them to train AI models.

2. What we measure, and when

2.1 When you upload photos — finding the people

After you consent and upload, an automated system running on our own servers looks at each photo to find the people and pets in it. It records where each face is (a rectangle and a few landmark points), an estimate of how old each person appears and whether they appear to be a man or a woman, and an outline used to cut each person out as a reference for the painter. These are used to compose your portrait — to decide how many people to paint and how to describe them to the painting model.

This step does not compare you to anyone. It answers “is there a face here, and roughly who is it a picture of — a child, an adult, an older person?”, never “which known person is this?”. No face signature is produced at this stage, and nothing is checked against any database of people.

2.2 When the likeness is improved — the face geometry scan

A painting is made by an AI model working from a written description and a cut-out reference of each person. It usually gets the likeness close, and sometimes it does not. The likeness improvement refines each painted face using the corresponding real face from your photos. It is an optional, free extra step you ask for by pressing “Improve my likeness” under your painting.

To do that we have to know which painted face is which person — in a group portrait the people are not necessarily painted in the order we listed them, and refining the wrong face would put one relative's features on another. So for the duration of that one request we compute a face geometry scan of each person's face in your photos and of each face in the painting, and compare them to each other to find the correct pairing. A face geometry scan here is a list of 128 numbers derived from the shape of a face; on its own it is not a picture and cannot be turned back into one.

This is the only place in the product where anything of that kind is computed, and it happens only with your consent. You give it by ticking the separate box on the button; if you never press it, no face geometry scan is ever produced from your photos.

3. Why we collect it — the specific purpose

Face geometry scans are collected for one purpose only: to match each person in your photos to their own face in the portrait you asked us to make, so that the likeness of that portrait can be improved. They are not used to identify you, to verify who you are, to link you to any other account or photograph, to build a profile, to train a model, for security, or for advertising. They are used for your portrait and for nothing else.

We also record, for our own quality measurement, how closely a painted face resembled the real one before and after the improvement. That record is a similarity score — a single number between −1 and 1 — together with the rectangle the face occupied in the image. A score and a rectangle cannot be used to recognise anyone or to reconstruct a face.

4. Retention schedule — how long it exists

This is our written retention schedule for biometric data, as required by 740 ILCS 14/15(a).

• Face geometry scans: the duration of a single request, and no longer. A scan is created in the server's working memory, used for the comparison, and released when that request finishes. The improvement runs under a hard time budget of 20 seconds, after which it is abandoned. A scan is never written to a file, a database, a log, a backup, or a cache, and never leaves the machine that computed it. There is therefore no stored copy to schedule for later deletion — the destruction is immediate and automatic in every case.
• Face location data (rectangles, landmark points, apparent age and sex estimates, cut-outs): retained with the photo it came from, and deleted with it, under the retention schedule in Section 3.1 of our Privacy Policy.
• Similarity scores and rectangles kept for quality measurement: retained with the generation record they describe, and deleted with it under the same schedule.
• Face crops sent to our processor (see Section 6): held only for the duration of the call. Under our written agreement with that processor, the crops and the returned image are handled transiently for the request and deleted from its active processing environment immediately after the response is returned, are not used for any later request, and are not included in its routine backups. Its request and security logs exclude image content and are kept for up to 90 days.
• Consent records: retained for as long as we may need to evidence that consent was given, and for at least three years after your last interaction with us. A consent record contains the exact text you agreed to, when you agreed, and whether you later withdrew it — it contains no face data.
• Immediate destruction on request: at any time, and in any event no later than the schedule above, whichever comes first.

5. Destruction guidelines

• Face geometry scans are destroyed automatically when the request that created them ends — on success, on failure, and on timeout alike. No human action is required and none is possible: the data is never persisted anywhere a person could reach it.
• Photographs, cut-outs, face location data and quality scores are deleted on the schedule in Section 3.1 of the Privacy Policy, by automated jobs, without needing a request from you.
• If you ask us to delete your data, we delete your photographs, your portraits and everything derived from them within 30 days of verifying your request. Email help@artstories.ai.
• Deletion covers backups on their normal expiry cycle. Where a backup cannot be selectively edited, the data remains only in that backup, is not restored into the live service, and expires with it.
• We keep the consent record itself even after deleting the data it authorised. It is the evidence of what you were told and what you agreed to, and destroying it would remove the only proof that we acted with your permission.

6. Who receives face data

Finding the people in your photos, estimating apparent age, cutting each person out, and computing the face geometry scan all run on our own servers. No third party is involved in any of it, and no face measurement of any kind is ever sent to an advertising, analytics, or data-broker service.

One step does involve a third party. When the likeness is improved, we send a close crop of each matched pair of faces — the face from your photo and the corresponding face in the painting — to a specialist face-refinement processor that returns the refined face. That processor is InsightFace AI Technology Limited, a company established in Hong Kong, which operates the service on Amazon Web Services infrastructure; its personnel in Hong Kong may access that infrastructure to operate, secure, support and troubleshoot it. It receives face crops only: never your full photographs, never your name, email, address or order, and never the face geometry scans, which do not leave our servers. It acts on our written instructions, may use the crops only to perform that refinement, and must not retain them once it has returned the result. It is contractually forbidden from using anything it receives to train, fine-tune or improve any model, for advertising or profiling, or to sell or share for any unrelated purpose.

Hong Kong is not covered by a European Commission adequacy decision. The transfer is made under the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two, controller to processor), governed by Lithuanian law, with the State Data Protection Inspectorate of Lithuania as the competent supervisory authority. You may request a copy, with commercial terms redacted, by emailing help@artstories.ai.

The crops reach the processor through a relay we operate, which exists only to give the connection a stable network address. The relay passes the request through and keeps no copy.

This transfer happens only after you have separately consented to it. Declining it does not affect your portrait: you simply receive the painting as the model painted it, and the rest of the service works normally.

7. What we never do

• We do not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information.
• We do not use your photographs or any measurement taken from them to train, fine-tune, or evaluate AI models.
• We do not use face data to identify you, to verify your identity, or to find you in any other photograph or service.
• We do not run face data against any watchlist, law-enforcement system, or third-party identity database.
• We do not use face data for advertising, audience building, or profiling.
• We do not disclose biometric data except as described in Section 6, or where a valid court order or subpoena compels it.

8. Your consent, and withdrawing it

We ask for your permission for two separate things, and record them separately. The first covers storing your photos and finding the people in them. The second covers the face geometry scan and the crop sent to our processor described above. The first is asked before your photos are uploaded; the second is shown on the “Improve my likeness” button. Ticking one never ticks the other, and neither box is ever pre-ticked.

You do not have to give either consent: leaving a box unticked simply means we do not take that step, and the rest of the service works normally. If you have already consented, you can withdraw at any time by emailing help@artstories.ai — withdrawing is as easy as giving consent was, costs nothing, and needs no reason. Withdrawal stops all further processing and, if you ask, we delete what we hold. It cannot undo an improvement already made, but the underlying scans were destroyed when that request finished, and withdrawal does not affect the lawfulness of anything done before it.

You may ask us at any time what you have consented to and when. If you upload a photograph containing someone other than yourself, you are confirming that you have that person's permission — and, for a child, that you are their parent or guardian or have their parent's or guardian's permission. See our Terms.

9. State and regional notes

Illinois (BIPA, 740 ILCS 14). Sections 4 and 5 above are the written retention schedule and destruction guidelines required by §15(a). We obtain a written release before collecting any face geometry scan, and tell you the specific purpose and the length of term at that moment, as required by §15(b). We do not sell or profit from biometric data (§15(c)), and we disclose it only with your consent (§15(d)).

Where the likeness improvement is not offered. We do not offer it to visitors in Illinois, Texas or Washington, or to any visitor in the United States whose state we are unable to determine. If it is not available to you it does not run, we do not ask you to consent to it, no face geometry scan is ever created from your photographs, and nothing is sent to our face-refinement processor. The rest of the service works normally, and your portrait is unaffected.

Texas (CUBI, Bus. & Com. Code §503.001). We inform you and obtain your consent before capturing a biometric identifier, do not sell or disclose it except as described here, and destroy it within the periods stated above.

Washington (MHMDA and RCW 19.375). Where face data is treated as consumer health data, we collect and share it only with your separate, specific, freely given consent, and never sell it.

EU / UK (GDPR Art. 9 and Art. 44–46). Where a face geometry scan is processed for the purpose of uniquely identifying a person within your own portrait, we rely on your explicit consent under Art. 9(2)(a). You may withdraw it at any time without giving a reason, and withdrawal does not affect the lawfulness of processing before it. The face crops described in Section 6 are transferred to Hong Kong, which has no adequacy decision; that transfer is made under the Standard Contractual Clauses as described in that Section, and you may request a copy. Our lead supervisory authority is the State Data Protection Inspectorate of Lithuania (VDAI), L. Sapiegos g. 17, Vilnius, ada@ada.lt.

10. Changes to this policy

If we change what we measure, why, how long it exists, or who receives it, we will update this policy and update the consent notice shown before processing. A change that widens what we do with face data takes effect only for consents given after the change — we do not apply new terms to permission already given under the old ones.

11. Contact

• Company: UAB “Madcom”
• Registered address: Laisvės al. 18-41, LT-44238 Kaunas, Lithuania
• Company code: 307029363
• Email: help@artstories.ai
• Website: artstories.ai