Privacy Policy

1. Data controller

The controller of your personal data is the owner of the FaceMorph application (hereinafter: "Administrator"). Data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).

2. Data we collect

• • Account data: email address, first and last name — for authentication and personalization.
• • Face photos: uploaded by you to apply AI effects. Processed only for the given session and stored only with your explicit consent.
• • Transformation history: AI effect results linked to your account.
• • Subscription data: selected plan, activation/expiry dates.
• • Security logs: login attempt information to protect the account.

3. Purpose and legal basis of processing

• • Performance of a contract (Art. 6(1)(b) GDPR): providing app services, processing photos, handling subscriptions.
• • Legitimate interest (Art. 6(1)(f) GDPR): account security, abuse prevention.
• • Consent (Art. 6(1)(a) GDPR): processing of facial image — you may withdraw consent at any time.

4. Server location and data transfer

User data is stored on servers located within the European Union (EU). Processing of facial images by AI models complies with EU data protection standards. We do not transfer data to third countries except in the cases expressly specified in this Policy.

5. Data recipients

Data may be shared only with:

• • Technical infrastructure providers (hosting, cloud) within the EU
• • AI service providers (image processing) — only technical session data
• • Public authorities, where required by law

6. Your rights (GDPR)

• • Right of access to your data (Art. 15 GDPR)
• • Right to rectification of data (Art. 16 GDPR)
• • Right to erasure ("right to be forgotten", Art. 17 GDPR) — available directly in the app at Profile → Delete account
• • Right to restriction of processing (Art. 18 GDPR)
• • Right to data portability (Art. 20 GDPR)
• • Right to object (Art. 21 GDPR)
• • Right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa

7. Data retention period

• • Account data: for the duration of the account + 30 days after deletion
• • Photos uploaded for transformation: deleted after 90 days
• • Security logs: 12 months

8. Cookies and device identifiers

The mobile application does not use cookies. We use session identifiers solely to maintain the user's logged-in state. We do not apply cross-app tracking or advertising profiling.

9. Biometric data

Face photos uploaded to the application may constitute biometric data within the meaning of Art. 9 GDPR. We process them only with your explicit consent, solely to apply the selected visual effects. You can delete your transformation history at any time from the Profile.