Privacy Policy

1. Data Controller

The data controller for your personal information is Faceify Labs. For all privacy-related inquiries, please contact us at privacy@faceifylabs.com.

2. What Data We Collect

We collect only the minimum data necessary to operate our platform:

• Account information: Your name, email address, and professional credentials when you sign up for an account or request a demo.
• Session cookies: A secure, httpOnly session cookie (fl-session) used to authenticate your account for up to 7 days. No tracking cookies are set without your consent.
• Analytics: We use PostHog (EU-hosted) and Google Analytics 4 (US-hosted) to collect anonymised usage data such as page views, session duration, and feature interactions. This data does not include any patient images or facial data.
• Contact form submissions: Any messages you send through our contact or demo-request forms, including your name, email, and message content.
• Billing and subscription data: Payment-related records managed through our billing provider (Polar). We store subscription status, plan type, and transaction references. We do not store credit card numbers directly.
• Consultation and lead data: If you request a consultation or express interest in a procedure, we store your contact details and inquiry to connect you with a surgeon.
• Security audit logs: We log authentication events (login attempts, account changes) with IP address and user agent for security and fraud prevention.
• Patient facial images — none collected: All face processing for surgical simulation is performed entirely in your browser using client-side AI models. No patient photographs, facial landmarks, or simulation results are ever transmitted to or stored on our servers.

3. Legal Basis for Processing

Under GDPR Article 6, we rely on the following legal bases:

• Legitimate interest (Art. 6(1)(f)): Analytics data collected to understand how our platform is used and to improve our services.
• Performance of a contract (Art. 6(1)(b)): Account and authentication data processed to provide you with access to our platform and fulfil your subscription.
• Consent (Art. 6(1)(a)): Marketing communications and optional analytics cookies, where you have explicitly opted in via our cookie consent banner.
• Legal obligation (Art. 6(1)(c)): Data we are required to retain to comply with applicable law (e.g. tax and accounting records).

4. Data Retention

• Session data: Authentication sessions expire after 7 days of inactivity.
• Analytics data: Retained for up to 2 years, then automatically deleted or anonymised.
• Contact form inquiries: Retained for up to 1 year from the date of submission.
• Account data: Retained while your account is active. When you delete your account, your data is permanently removed. Security audit logs (with email redacted to user ID only) are retained for compliance purposes.
• Patient simulation data: Not retained — all face processing is on-device and nothing is stored on our servers.

5. Your Rights

Under GDPR and similar applicable laws (including CCPA/CPRA, Thailand PDPA, South Korea PIPA, India DPDP Act 2023, and Brazil LGPD), you have the following rights in relation to your personal data. Jurisdiction-specific rights are detailed in the dedicated sections below.

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Ask us to correct inaccurate or incomplete data.
• Right to erasure: Ask us to delete your personal data where there is no lawful basis for continued processing.
• Right to data portability: Receive your data in a structured, machine-readable format and transfer it to another controller.
• Right to object: Object to processing based on legitimate interests, including direct marketing.
• Right to restrict processing: Ask us to limit how we use your data in certain circumstances.
• Right to lodge a complaint: You have the right to complain to your local data protection supervisory authority. In the EU/EEA, this is the authority in your country of residence. In India, you may contact the Data Protection Board of India once operational under the Digital Personal Data Protection Act 2023. In Brazil, you may contact the ANPD (Autoridade Nacional de Proteção de Dados) at www.gov.br/anpd.

To exercise any of these rights, email privacy@faceifylabs.com. We will respond within 30 days.

6. California Residents — CCPA / CPRA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights with respect to your personal information:

• Right to know / access (Cal. Civ. Code §1798.100): You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to delete (§1798.105): You may request that we delete personal information we have collected from you, subject to certain exceptions permitted by law (e.g., information needed to complete a transaction or comply with a legal obligation).
• Right to correct (§1798.106, CPRA): You may request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing: Faceify Labs does not sell your personal information to third parties, nor do we share it for cross-context behavioural advertising. No opt-out action is required, but you may contact us to confirm this at any time.
• Right to non-discrimination (§1798.125): We will not discriminate against you for exercising any of your CCPA / CPRA rights. You will not receive a different quality of service or be charged a different price as a result of exercising these rights.

To exercise any of these rights, California residents may submit a verifiable consumer request by emailing privacy@faceifylabs.com with the subject line "CCPA Rights Request". We will acknowledge your request within 10 business days and respond substantively within 45 calendar days, as required by California law.

7. Data Security

We implement industry-standard security measures to protect your information, including TLS 1.3 encryption in transit, httpOnly and secure cookies, and access controls on all server-side data. Facial simulation processing is performed entirely on-device. Account, billing, and consultation data is stored server-side with appropriate security controls.

8. Third-Party Services & International Data Transfers

We use the following third-party processors. Where data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR Chapter V:

• PostHog — Product analytics. Data stored on EU-hosted infrastructure (Frankfurt). No patient data.
• Google Analytics 4 — Web analytics. Data transferred to the US under Standard Contractual Clauses. IP addresses are anonymised. No patient data.
• Vercel — Hosting and edge delivery. Data may be processed in the US under Standard Contractual Clauses.
• Resend — Transactional email delivery (authentication codes, account notifications). Processes your email address only.
• Cerebras — AI inference API used for the in-platform clinical chatbot. No patient images or simulation data are sent to this service.
• Neon (PostgreSQL) — Database hosting for account and subscription data.
• Cal.com— Self-serve consultation / demo scheduling. When you click a “Book a Demo” or “Book a Consultation” button, Cal.com receives your name, email address, and selected time slot. Data is stored on Cal.com's EU infrastructure; their privacy policy is at cal.com/privacy.
• Polar.sh — Merchant of record for all subscription billing and one-time Patient Pass purchases. Polar handles payment processing, invoicing, tax collection (VAT / GST where applicable), refunds, and chargeback handling on our behalf. Their terms and privacy policy govern the transaction itself; ours governs access rights. See polar.sh/legal/privacy.

Each processor operates under its own privacy policy and a data processing agreement with Faceify Labs. Links to their privacy policies are available on request at privacy@faceifylabs.com.

9. No Patient Image Uploads — On-Device Processing

Patient photos never leave the device.All facial image processing for surgical simulation — including MediaPipe face mesh detection, landmark computation, and simulation rendering — is performed entirely in the user's browser using client-side WebAssembly and WebGL. No patient photographs, biometric data, facial landmark coordinates, or simulation results are transmitted to or stored on Faceify Labs servers or any third-party server.

This architecture means that for simulation use, no Protected Health Information (PHI) as defined under HIPAA, and no biometric personal data as defined under GDPR Article 9, is processed by Faceify Labs.

10. Cookies

We use strictly necessary cookies (session authentication) which do not require consent. We use analytics cookies (PostHog, Google Analytics) only with your explicit consent, managed through our cookie consent banner. You can withdraw consent at any time by clearing cookies in your browser or adjusting your preferences in the consent banner.

11. Data Protection Officer

Faceify Labs has designated a Data Protection Officer (DPO) responsible for overseeing our data protection strategy and ensuring compliance with applicable privacy laws, including the GDPR, Thailand PDPA, South Korea PIPA, India DPDP Act 2023, and Brazil LGPD.

DPO Contact: privacy@faceifylabs.com

You may contact the DPO directly for any data protection concern, to exercise your data subject rights, or to raise a complaint about how your personal data is handled. We will acknowledge your contact within 5 business days and provide a substantive response within 30 days.

12. Thailand — Personal Data Protection Act (PDPA)

If you are located in Thailand, the Personal Data Protection Act B.E. 2562 (2019) ("PDPA") applies to the processing of your personal data. This section supplements the general provisions of this Privacy Policy.

Lawful Basis for Processing

We process your personal data under the following lawful bases recognised by the PDPA:

• Consent (Section 19): Where you have explicitly agreed to the processing, such as when opting into analytics cookies, marketing communications, or creating an account. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legitimate interest (Section 24(5)): For purposes such as platform security, fraud prevention, and product analytics, where our legitimate interests are not overridden by your rights and freedoms.
• Performance of a contract (Section 24(3)): To provide you with access to your account, subscription, and simulation services as agreed.
• Legal obligation (Section 24(2)): Where processing is required to comply with Thai law or other applicable legal obligations.

Your Rights Under the PDPA

As a data subject under the PDPA, you have the following rights:

• Right to be informed (Section 23): To be told how your data is processed before or at the time of collection.
• Right of access (Section 30): To obtain a copy of your personal data and information about how it is used.
• Right to data portability (Section 31): To receive your personal data in a machine-readable format where technically feasible.
• Right to object (Section 32): To object to processing based on legitimate interest at any time.
• Right to erasure (Section 33): To request deletion of your personal data when it is no longer necessary or when you withdraw consent, subject to legal exceptions.
• Right to restrict processing (Section 34): To request suspension of processing in certain circumstances.
• Right to rectification (Section 35): To request correction of inaccurate or incomplete personal data.
• Right to withdraw consent (Section 19): To withdraw previously given consent at any time.

Cross-Border Data Transfers

Where your personal data is transferred to countries outside Thailand, we ensure adequate protection through one or more of the following mechanisms as required by PDPA Section 28:

• Transfer to countries with an adequate level of personal data protection as recognised by the Thai Personal Data Protection Committee;
• Standard contractual clauses or binding corporate rules providing equivalent protections;
• Your explicit consent for the specific transfer, where required.

To exercise any PDPA rights, contact our DPO at privacy@faceifylabs.com with the subject line "PDPA Rights Request".

13. South Korea — Personal Information Protection Act (PIPA)

If you are located in South Korea, the Personal Information Protection Act ("PIPA", 개인정보 보호법) applies. This section supplements the general provisions of this Privacy Policy.

Retention Periods

Under PIPA Article 21, personal information must be destroyed without delay once the purpose of collection is fulfilled. Our specific retention periods are:

• Account data: Retained while your account is active. Deleted within 30 days of account closure, except where retention is required by law.
• Session and authentication data: Expires after 7 days of inactivity.
• Transaction and billing records: Retained for 5 years as required under the Act on Consumer Protection in Electronic Commerce.
• Security audit logs: Retained for up to 1 year for fraud prevention and security incident response.
• Contact form inquiries: Retained for up to 1 year from submission.
• Analytics data: Retained for up to 2 years in pseudonymised or anonymised form.

Third-Party Disclosure

Under PIPA Article 17, we disclose personal information to third parties only where one of the following applies:

• You have given separate, specific consent for the disclosure;
• Disclosure is required by law;
• Disclosure is necessary to perform a contract to which you are a party.

Third-party processors we use include Vercel (hosting), Resend (email), Neon (database), PostHog (analytics), Google Analytics, Cal.com (consultation scheduling), and Polar.sh (payment processing / merchant of record). Each operates under a data processing agreement. We do not sell personal information.

Your Rights Under PIPA

As a data subject under PIPA, you have the following rights:

• Right of access (Article 35): To request disclosure of your personal information held by us.
• Right to correction (Article 36): To request correction of inaccurate personal information.
• Right to deletion (Article 36): To request deletion of personal information where there is no lawful basis for continued processing.
• Right to suspension of processing (Article 37): To request that we stop processing your personal information in certain circumstances.
• Right to data portability (Article 35-2, amended PIPA 2023): To receive your personal information in a structured, commonly used format.

To exercise any PIPA rights or to lodge a complaint, contact our DPO at privacy@faceifylabs.com with the subject line "PIPA Rights Request". You may also contact the Personal Information Protection Commission (PIPC) at www.pipc.go.kr or call 182.

14. India — Digital Personal Data Protection Act 2023 (DPDP Act)

If you are located in India, the Digital Personal Data Protection Act 2023 ("DPDP Act") applies to the processing of your personal data. Faceify Labs is incorporated as an India Pvt Ltd entity registered in Maharashtra, and as a Data Fiduciary we are subject to the obligations set out in this Act. This section supplements the general provisions of this Privacy Policy.

Consent and Legitimate Purpose

Under the DPDP Act, we process your personal data only for lawful purposes with your free, specific, informed, and unambiguous consent (Section 6), or on other grounds specified in the Act such as performance of a contract, compliance with a legal obligation, or a legitimate use notified by the Central Government. Where consent is the basis, we provide a clear and plain-language consent notice before or at the point of collection. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Data Fiduciary Obligations

As a Data Fiduciary, Faceify Labs is obligated to:

• Process personal data only for the specific, clear, and lawful purpose for which consent was given;
• Implement reasonable security safeguards to prevent personal data breaches;
• Notify the Data Protection Board of India and affected Data Principals in the event of a personal data breach, as required under Section 8(6);
• Erase personal data (and direct Data Processors to do likewise) once the purpose of processing is fulfilled or consent is withdrawn, unless retention is required by applicable law;
• Ensure the accuracy and completeness of personal data that may be used to make decisions affecting Data Principals.

Your Rights as a Data Principal

As a Data Principal under the DPDP Act, you have the following rights:

• Right of access (Section 11): To obtain a summary of your personal data being processed by us, the processing activities undertaken, and the identities of all Data Processors and third parties with whom your personal data has been shared.
• Right to correction and erasure (Section 12): To request correction of inaccurate or misleading personal data, completion of incomplete data, and erasure of personal data no longer required for the purpose for which it was collected, subject to any legal retention obligations.
• Right to grievance redressal (Section 13): To have your grievances redressed by us in a timely manner. You may contact our DPO at privacy@faceifylabs.com with the subject line "DPDP Grievance". We will acknowledge your request within 48 hours and respond substantively within 30 days.
• Right to nominate (Section 14): To nominate another individual to exercise your rights in the event of your death or incapacity.

Data Protection Board of India

If your grievance is not resolved to your satisfaction by Faceify Labs, you have the right to file a complaint with the Data Protection Board of India (Section 27 of the DPDP Act). The Board is the statutory adjudicatory body established under the Act with authority to investigate complaints, issue directions, and impose financial penalties on Data Fiduciaries. Information on filing a complaint will be available on the Board's official portal once operationally established by the Central Government.

Cross-Border Data Transfers

The DPDP Act permits transfer of personal data outside India except to countries or territories restricted by the Central Government by notification. Where we transfer your personal data to our third-party processors (such as Vercel, Neon, Resend, PostHog, Google, Cal.com, and Polar.sh) operating outside India, we ensure that such transfers are to jurisdictions not on any restricted-country list notified under Section 16 of the DPDP Act. Each processor operates under a data processing agreement with Faceify Labs.

15. Brazil — Lei Geral de Proteção de Dados (LGPD)

If you are located in Brazil, the Lei Geral de Proteção de Dados Pessoais (Law No. 13,709/2018, "LGPD") applies to the processing of your personal data. This section supplements the general provisions of this Privacy Policy.

Legal Bases for Processing

Under the LGPD (Article 7), we process your personal data on one or more of the following legal bases:

• Consent (Art. 7(I)): Where you have freely, informedly, and unambiguously agreed to the processing, such as when opting into analytics cookies, marketing communications, or creating an account. Consent may be withdrawn at any time.
• Performance of a contract (Art. 7(V)): To provide you with access to your account, subscription, and simulation services as agreed.
• Legitimate interest (Art. 7(IX)): For purposes such as platform security, fraud prevention, and improving product quality, where our legitimate interests do not override your fundamental rights and freedoms.
• Compliance with a legal obligation (Art. 7(II)): Where processing is required to fulfil a legal or regulatory obligation imposed by Brazilian law.

Your Rights Under the LGPD

Under LGPD Article 18, you have the following rights with respect to your personal data:

• Confirmation of existence of processing (Art. 18(I)): To obtain confirmation that we process your personal data.
• Right of access (Art. 18(II)): To receive a copy of your personal data that we hold.
• Right to correction (Art. 18(III)): To request correction of incomplete, inaccurate, or out-of-date data.
• Anonymization, blocking, or deletion (Art. 18(IV)): To request anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data.
• Data portability (Art. 18(V)): To receive your personal data in a structured, interoperable format for transfer to another service or product provider.
• Deletion of consent-based data (Art. 18(VI)): To request deletion of personal data processed on the basis of your consent.
• Information about third-party sharing (Art. 18(VII)): To receive information about public and private entities with which we have shared your personal data.
• Right to consent revocation (Art. 18(IX)): To revoke consent at any time by a free and simplified procedure; revocation does not affect the lawfulness of processing carried out prior to revocation.

Supervisory Authority — ANPD

The Autoridade Nacional de Proteção de Dados (ANPD) is the Brazilian national supervisory authority responsible for overseeing and enforcing the LGPD. If you believe your rights under the LGPD have been violated and your complaint has not been resolved by Faceify Labs, you may file a complaint with the ANPD at www.gov.br/anpd.

International Data Transfers

Where your personal data is transferred to countries outside Brazil, we ensure adequate protection through one or more of the following safeguards as required by LGPD Article 33:

• Transfer to countries or international organisations that provide a degree of personal data protection deemed adequate by the ANPD;
• Standard contractual clauses or binding corporate rules that provide equivalent protections to those guaranteed by the LGPD;
• Your specific and highlighted consent for the transfer, where required.

To exercise any LGPD rights, contact our privacy team at privacy@faceifylabs.com with the subject line "LGPD Rights Request". We will respond within 15 days, as required by Brazilian law.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. Continued use of the platform after the effective date of the updated policy constitutes acceptance of the changes.

17. Contact

For all privacy-related inquiries, data subject requests, or questions about this policy, contact our privacy team at privacy@faceifylabs.com.