Privacy Policy

What we collect

When you register, we collect your name, email address, date of birth, and at least three reference photos you upload. From those photos, we generate facial embeddings via AWS Rekognition in order to compare them against other images. We also store records of the specific consents you give (identity confirmation, biometric consent, right-to-delete acknowledgement, enforcement approval) and the cases our detection scans produce.

Registration also requires a one-time identity verification: a government ID and a selfie, checked by Stripe Identity to confirm you are who you say you are. Stripe handles the document and selfie image directly — we never receive or store the image itself, only the pass/fail result and, if verification fails, the reason.

Legal basis

Your reference photos and the biometric data derived from them are "special category data" under UK/EU GDPR (Article 9) and are covered by US state biometric laws such as Illinois BIPA and Texas CUBI. We process this data only on the basis of your explicit, itemized consent, captured separately from any other agreement — not as part of a single blanket checkbox.

How we use it

Your reference photos are compared against a defined set of images to find potential unauthorized commercial or AI-generated use of your likeness. Matches are shown to you as cases in your dashboard — we do not take any action (takedown, licensing outreach, or legal referral) without your individual, per-case approval.

Who we share it with

We use the following processors to operate the service: AWS Rekognition (facial comparison), Supabase (database, authentication, and file storage), Stripe (payment processing and, separately, identity verification), and Vercel (application hosting). We do not sell your data, and we do not share your reference photos or biometric data with any other third party. If you link a social account, that linking alone does not grant us access to any photo — you separately choose and upload the photos you want used as your reference.

Retention and deletion

You can request full deletion of your account at any time. Deletion removes your reference photos, any derived biometric data, and your case history — it is a real deletion, not just deactivation of your account. Identity verification results are retained only as a pass/fail record; we never held the underlying document or selfie image ourselves to begin with.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your data, and to withdraw consent at any time (including consent for specific processing, without needing to delete your whole account). To exercise any of these rights, contact us at privacy@aiwarden.online.

Cookies

We use a single authentication cookie to keep you signed in. We do not use advertising or tracking cookies.