This Privacy Notice explains how Gustavo Alejandro Romero Ore (“TrueFace”, “we”, “us”), the operator of the TrueFace application, collects, uses, shares and protects your personal data when you use our website and services.

1. Data Controller

The data controller responsible for your personal data is Gustavo Alejandro Romero Ore, trading as TrueFace. You can contact our Privacy Officer through the in-app live chat (select the “Privacy issue” topic) and your message will be routed directly to our Privacy team.

2. Categories of Personal Data We Collect

Biometric data (facial images): photos you upload or capture so we can analyse them for filters, retouching and AI-generated manipulation.
Account data: email address and basic profile information provided at sign-up.
Payment data: handled exclusively by Stripe (see Section 5). We do not store credit-card details.
Usage and device data: IP address, device type, browser, language and technical logs used for security and stability.
Support data: messages you send to our live-chat support.

3. Purposes and Legal Basis

Service delivery (contract performance): running scans, returning results, managing your account.
Security and fraud prevention (legitimate interests): protecting against abuse, deepfake-driven fraud and unauthorised access.
Payments, tax and invoicing (contract / legal obligation): processed by Stripe as Merchant of Record.
Service improvement and AI training (consent, opt-in only): see Section 4.
Customer support (legitimate interests): responding to your messages.

4. AI Training (Opt-In Only)

By default, raw images are processed in real time and removed from our cache immediately after analysis. We do not use your photos to train our models unless you explicitly tick the “Contribute to Research” box. You may withdraw this consent at any time in the app settings; future scans will not be used for training.

5. Data Sharing and Sub-processors

Lovable — cloud infrastructure and application hosting.
Stripe Payments Europe, Ltd — Merchant of Record for sale of the product, subscription management, payments, tax compliance and invoicing.
Professional advisers (legal, accounting) where strictly necessary.
Authorities where required by law.

Where data is transferred outside the UK / EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Data Retention

Uploaded images are deleted from our cache immediately after analysis. Account and usage data is retained for as long as your account is active and for a limited period thereafter to meet legal, accounting and security obligations, then deleted or anonymised.

7. Your Rights

Depending on your location, you have the right to:

Access the personal data we hold about you.
Rectify inaccurate or incomplete data.
Erase your account and associated data.
Restrict or object to certain processing.
Withdraw consent for biometric processing or AI training at any time.
Data portability where applicable.
Lodge a complaint with your local data protection supervisory authority.

We aim to respond to requests within one month.

8. Security

We use appropriate technical and organisational measures including encryption in transit and at rest, strict access controls and audit logging. No system is 100% secure, but we take your data seriously and continuously improve our defences.

9. Cookies

We use only essential cookies and equivalent local-storage entries needed to keep you signed in and to remember language preferences. We do not run advertising trackers or third-party analytics that profile you.

10. Deepfake Detection Disclosure

TrueFace provides a probability-based forensic analysis. No AI can guarantee 100% certainty. Results are a supplemental verification tool and should not be used as the sole basis for critical personal, financial or safety decisions.

11. Changes to This Notice

We may update this Notice from time to time. Material changes will be communicated in-app or by email. The “Last updated” date at the top reflects the latest revision.

12. Contact

Questions? Reach our Privacy Officer via the in-app live chat (topic: “Privacy issue”) or email Gustavo Alejandro Romero Ore, the data controller, at gromero.advisor@gmail.com.