02Legal

Biometric Data Policy

Effective date: October 28, 2026 · Last updated: October 29, 2026 Version: 2.0

Attractiveness Check (attractivenesscheck.com, "we", "us") operates this website. This policy explains how we collect, use, store, disclose and destroy biometric data.

It is our public written retention schedule and destruction policy under the Illinois Biometric Information Privacy Act (740 ILCS 14) and the Colorado Privacy Act (C.R.S. § 6-1-1314). It also describes how we handle this data under Texas Business and Commerce Code § 503.001 and Washington's My Health My Data Act (RCW 19.373), where those laws apply.

We apply this policy to every user, wherever they live.

1. What this policy covers

In this policy, "Face Data" means:

Facial measurements: proportions, angles and symmetry between points on your face, calculated from your selfie (for example, eye spacing, or face length compared to width). These can be a "scan of face geometry" or "facial geometry" under the laws above.
Your selfie: the one photo you choose. Some laws, such as Washington's, can treat face photos as biometric data.
If you buy a report, also:
- photo readings: a few numbers your browser measures from the photo, such as brightness, sharpness, head angle and how even the light is on your cheeks;
- sampled colours: colour values your browser samples from your skin, hair, eyes and lips in the photo;
- hairstyle previews: three images an AI creates from your photo to show you with a different haircut.

Facial landmark positions, the exact coordinates of points on your face, are calculated by your browser and never leave your device. We never receive or store them.

We treat all Face Data as biometric data under this policy, whether or not a particular law would.

2. Why we use Face Data

We use Face Data for one purpose: to produce the analysis you request. That means:

your free score and free result, calculated in your browser;
if you buy a report: the full report, including your photo shown with measurement lines, its measurement section, a description of how your skin looks in the photo, a colour palette, and your hairstyle previews.

The skin section describes appearance in this photo and light only. We do not identify, diagnose or infer any skin, medical or health condition.

We do not use Face Data to identify you, to recognize you across photos or visits, or to match you against any database. The celebrity look-alikes in a report are an AI's description of general features in your photo, for fun; we do not compare your face with any database of faces. We do not use it to train or improve AI models. We do not use it for advertising.

3. How it is processed

We process Face Data only after you have read our biometric consent notice and given written consent. You give consent by checking an unchecked box and clicking "Agree and continue", which is your electronic signature. We keep a record of each consent: the time, the notice version, and a random session identifier. Before you pay for a report, you also confirm that you are 18 or older and agree to this policy and our Privacy Policy, and we keep a record of that too. The records contain no Face Data.

What happens next:

Free score, on your device. Your browser detects facial landmarks in your selfie, calculates facial measurements and your score. None of this is sent to us. To count how scores are distributed, your browser sends us only the scoring version and the score, with no identifier, cookie or link to you or your photo.
While you pay. When you choose to buy a report, your browser keeps a smaller copy of your photo and your measurements in that browser tab's session storage. It removes them when they are sent, after 30 minutes, or when you close the tab, whichever comes first. They are not sent to us before you pay.
After you pay. You can answer two optional questions, then start your report. Only then does your browser send us the smaller photo, the facial measurements, the photo readings and the sampled colours. We store the photo in private storage and the measurements, readings and colours in our database, with your report.
Creating the report. We send the photo to OpenRouter and the AI companies it routes to (Anthropic and OpenAI) to write your report and to check it before it is sent, and to OpenRouter and the AI companies it routes to (OpenAI and Google) to create your three hairstyle previews. We store the previews in private storage with your report.
Showing the report. Your report page loads your photo through a private, short-lived link and draws the measurement lines in your browser. Facial landmark positions are recalculated there and still never leave your device.

Face shape tool. The free face shape tool runs entirely in your browser. Your photo and facial measurements are not uploaded. We receive only an anonymous count of the resulting face shape label (for example, "oval").

4. Retention schedule

Face Data	Where it is held	When it is destroyed
Facial landmark positions	Your browser only	Never sent to us. Discarded when you close or reload the page.
Photo and measurements, if you don't buy a report	Your browser only	Never sent to us
Photo and measurements kept while you pay	Your browser tab's session storage	When they are sent, after 30 minutes, or when you close the tab, whichever comes first
Photo and hairstyle previews, after you buy a report	Private cloud storage at Cloudflare, with no public link	Together with your report: 12 months after purchase, or sooner if you delete your data. Never saved in our database or backups.
Photo sent to OpenRouter and the AI companies it routes to (Anthropic and OpenAI) to write and check your report	OpenRouter and the AI companies it routes to (Anthropic and OpenAI)	Within 30 days (longer only if a provider's automated safety systems flag a request as violating its usage policy, up to 2 years at Anthropic, or if the law requires it), under its data policy
Photo sent to OpenRouter and the AI companies it routes to (OpenAI and Google), and the previews it creates	OpenRouter and the AI companies it routes to (OpenAI and Google)	Within 30 days at OpenAI and 55 days at Google (longer only if the law requires it or a provider needs it to prevent harm), under its data policy
Facial measurements, photo readings and sampled colours, after you buy a report	Our database, linked to your report	Together with your report: 12 months after purchase, or sooner if you delete your data
These values in database backups	Our database provider	Overwritten within 7 days after deletion from the database

Overriding rule. In every case we destroy Face Data no later than the earliest of:

(a) the date the purpose of collection has been satisfied;
(b) 24 months after your last interaction with us; or
(c) 3 years after your last interaction with us.

(b) is the Colorado limit and (c) is the Illinois limit. The schedule above is much shorter than either, so in practice the schedule always applies first.

Where Face Data never goes. We never write measurement values into report text, emails or logs. Your report's measurement section reads the values from the database while they exist. When you save your report as a PDF, your browser creates it; it is not stored on our servers. A PDF you save stays on your device.

What we keep after Face Data is destroyed. None of the following contains facial measurement values or photos:

the record of your order;
your consent records.

Your report itself (scores and written advice) is deleted at the same time as your Face Data.

5. How we destroy Face Data

Photos and hairstyle previews: a scheduled job deletes them from private storage together with your report. If a photo was uploaded but no report was created, it is deleted within 24 hours, and the storage itself is set to remove such uploads after one day as a final safeguard. Photos and previews are never saved to our database, so they are never in database backups.
Facial measurements, photo readings and sampled colours: a scheduled job deletes them from the database together with your report. Database backups are kept for no more than 7 days, so any copy in a backup is overwritten within 7 days of deletion.
When you delete early: when you click Delete my data or email us, access to your report stops immediately. We then delete your Face Data from our active systems, together with your report, and send deletion instructions to our processors. Backup copies are overwritten within 7 days.
Annual review: at least once a year, we check that the deletion jobs are working and that we hold no Face Data we no longer need. Anything found unnecessary is deleted within 45 days.

6. Disclosure

We disclose Face Data only if you buy a report, and only:

to the processors listed below, to produce the report you asked for, under terms that limit their use to providing their service to us; or
when a law, a valid warrant, or a subpoena issued by a court of competent jurisdiction requires it.

Processor	What it receives	Why
OpenRouter and the AI companies it routes to (Anthropic and OpenAI)	Your photo; broad bands derived from your measurements, photo readings and sampled colours (for example "typical" or "warm"), not the values	Reviewing your photo, writing your report and checking it before it is sent
OpenRouter and the AI companies it routes to (OpenAI and Google)	Your photo and a written description of each hairstyle	Creating your hairstyle previews
Cloudflare	Your photo and Face Data, while they pass through; your photo and hairstyle previews in private storage until deletion	Running the website
Neon	Facial measurements, photo readings and sampled colours	Storing them with your report until deletion

Our payment provider, Stripe, never receives Face Data. Our email provider receives your email address and a link to your report. We do not put photos, scores or facial measurement values in emails.

7. No sale of Face Data

We charge users for the analysis reports they request. We do not sell, lease or trade photos or facial measurements to anyone, and we do not purchase biometric data.

8. Security

We store, transmit and protect Face Data using the standard of care in our industry, and at least as carefully as we protect any other confidential or sensitive information. In practice:

encryption in transit (HTTPS/TLS) and at rest;
private storage that is not publicly accessible: uploaded photos have no public link;
report links with long random keys, kept out of logs; no third-party analytics or other third-party code runs on the pages that open your report, confirm your payment or add a photo to your report. Google Analytics runs on the free test and the face shape tool (see our Privacy Policy), but we never send it Face Data, your photo or your score;
administrative access limited to the operator, and to service-provider staff who need it to perform their contracted duties;
secret keys kept on the server, never in the browser.

9. Security incident response

If we learn of an incident that may have exposed Face Data, we will:

Contain it: revoke credentials, close the access path and preserve logs.
Work out which data and which people were affected.
Notify affected people by email where we have an address, and post a notice on our website. We do this without unreasonable delay, and no later than 30 days after we determine that a breach occurred, or sooner where a law requires it.
Notify regulators where the law requires it.
Fix the cause, and record what happened and what we changed.

10. Your rights

You can ask us, free of charge:

whether we hold Face Data about you, which categories, where we got it, why we use it, and which processors received what;
to delete it; or
to withdraw your consent.

To do this, use Delete my data on your report page, or email support@attractivenesscheck.com. Send the email from the address you used at checkout, or include your report link. We reply within 45 days. If the GDPR applies to you, we reply within one month.

We never charge you more, or give you a worse service, because you used these rights.

11. Changes

If we change this policy, we post the new version here with a new effective date. If a change affects how we use Face Data, we ask for your consent again before we collect any new Face Data.

12. Contact

Attractiveness Check · support@attractivenesscheck.com