Privacy & Biometric Data

Version 1.0 · 14 August 2026

Status: working document. This policy describes what the platform actually enforces today and is written to be operationally true rather than decorative. It has not been reviewed by a qualified lawyer. Obtain that review before relying on it with any external customer, and before publishing it as a binding term.

Face embeddings are biometric data. Under UK and EU GDPR, biometric data processed to identify a person is special category data (Article 9) and needs a lawful basis and an Article 9 condition — in this context, explicit consent. This is the single most significant privacy fact about the platform, and it drives most of what follows.

1. What is stored

Data	Why	Sensitivity
Reference images	Define the character's appearance	Personal data; special category if of a real person
Face embeddings	Measure whether output matches the approved character	Special category (Art. 9)
Consent records	Prove the right to use a likeness	Personal data; the evidence of the Art. 9 condition
Source and produced media	The work itself	Personal data; often special category
Activity log	Append-only record of who did what	Personal data; retained for accountability

2. Where it is processed

Processing is performed on infrastructure selected by the operator, in a stated region. Where heavy computation is delegated to a rented machine, that machine receives only the single character and the single job it needs, authenticated by a credential that expires with the lease, and its working data is destroyed when the lease ends. It never receives account credentials or the wider catalogue.

3. Retention

Character data is kept while the character is in use, because it is what makes future output consistent. Retiring a character does not automatically delete it — historic content stays linked to the version that produced it.
Consent records are retained as long as any content produced under them exists, because a record that vanishes cannot evidence the permission it granted.
Intermediate working files are removed after a job completes.
The activity log is append-only and is not edited to remove entries.

4. Subject rights

Any person whose likeness is held may request access, correction, erasure, or restriction, and may withdraw consent at any time. Withdrawal retires the affected character versions immediately. Where erasure is requested, the operator must action it and record the outcome — noting that some records may be retained where there is a legal obligation to keep them.

5. Security

Access requires an API credential; credentials are stored hashed and are scoped by role.
Media is served only through short-lived signed links, not from open paths.
Services bind to the local interface and are reached through a reverse proxy.
Rented compute receives a per-job credential that expires and cannot reach anything else.

Known gap the operator must close. Backups are the operator's responsibility. Character data and consent records are the two things that cannot be reconstructed if lost — losing the consent records would mean holding content you can no longer prove you were entitled to make.