1. Introduction

Welcome to CarePhoto (carephoto.art), the AI photo generation service operated by Care Artificial Intelligence Research and Consulting LLC ("we," "us," "our," or the "Company"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy describes the types of information we may collect from you or that you may provide when you use our platform (the "Service") and our practices for collecting, using, maintaining, protecting, and disclosing that information.

This Privacy Policy applies to information we collect through:

Our website or web application providing AI photo generation services.
Any other interactions you may have with us where we refer you to this policy.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please discontinue using the Service.

2. Information We Collect and How We Use It

2.1 Uploaded Images, Face Data, and Persona Inputs

We collect images and other media that you choose to upload to the Service.
Some uploaded media may contain a person's face or other appearance-related information. We do not collect, generate, or store face geometry, faceprints, facial recognition templates, or other biometric identifiers separate from the uploaded image itself.
We use uploaded media to provide the features you request, including image editing, virtual try-on, face transfer, chat-based generation, saved media, and persona training when you choose that feature.
If you upload images to create a persona, we store the training images and related metadata in our Supabase-backed storage and database so the persona can be trained and reused for later generations.
When uploaded media contains a person's face, we treat that content as face-related data and retain it only for the limited periods described in Section 4 below.
By choosing to upload media or start persona training, you instruct us to process that content using the service providers described in this Privacy Policy.

2.2 Generated Images and Saved Media

We may generate images or videos in response to your prompts and uploaded reference media.
If you choose to save or favorite generated media, we store that media in Supabase so you can access it later.
Images attached to chats may also be stored to support the chat session, related features, and user-initiated deletion flows.

2.3 Technical and Usage Data

We may collect non‐personal information such as browser type, operating system, referring URLs, and session data for analytics and troubleshooting. This information helps us improve and optimize the Service.

2.4 Third-Party AI and Model Processing

We use third-party AI service providers to fulfill user requests. Depending on the feature or model selected, providers may include Fal.ai, Atlas Cloud (which runs ByteDance Seedance video models), OpenAI, xAI, and Anthropic.
To generate, edit, analyze, or summarize content, we may send prompts, uploaded images, reference images, and related processing parameters to those providers.
For persona training, we upload a ZIP file containing your selected training images to Fal.ai and submit a training job that returns a user-specific model artifact used to provide the persona feature.
Content safety checks: we automatically check images you upload to the Service and images generated for you, including images saved before these checks began, using an automated content classifier provided by Fal.ai. Only the image itself is sent, without your account information or prompts. The result, whether the image contains sexually explicit content, is stored with the image and used to decide where it can be shown, for example whether it is available in our iOS app.
We do not sell face data, use uploaded images for identity verification, or create biometric profiles for facial recognition.

2.5 Account Information and Google Sign-In

When you create an account, we collect your email address. If you sign in with Google, Google shares your name, email address, profile picture link, and Google account ID with us. These come from the basic permissions (email, profile, and openid) that you approve on Google's consent screen. We do not ask for access to your Gmail, Google Drive, contacts, calendar, or any other Google service, and we never see your Google password.
We use this information to create and secure your account, sign you in, keep track of your purchases and credits, send you emails about your account and the Service, prevent fraud and abuse, and measure how our ads perform (see the next points).
We store this account information in our Supabase authentication database. We do not use Google access tokens to read or change anything in your Google account.
We share your email address only with Stripe, when you make a purchase; with our email delivery provider, to send you account and Service emails; and with Meta, in hashed form, as described in the next point.
When you sign up or make a purchase, we send Meta a one-way SHA-256 hash of your email address and of your account ID through Meta's Conversions API, together with the purchase amount for purchases. Meta matches these hashes against its own users so we can measure how our ads perform. We do not send Meta your name or profile picture.
We do not send your Google account information to the AI providers described in Section 2.4, and we do not sell it.
We keep your account information while your account is active and delete it within 30 days after you ask us to delete your account (see Section 6), except for payment records we must keep for legal, tax, or fraud-prevention reasons. After your account is deleted we also keep a one-way, keyed hash of your email address, which cannot be turned back into the address, only so that a new account with the same email does not receive the free signup credits again. You can also remove CarePhoto's access to your Google account at any time from your Google Account settings, under third-party apps and services.

3. How We Share Your Information

3.1 Service Providers

We use third-party service providers to operate the Service, including Supabase for storage and database services, Fal.ai for image, video, and persona-model processing and for automated content-safety checks of images, Atlas Cloud for ByteDance Seedance video generation (your reference photos and prompt are sent to it for that feature), OpenAI, xAI, and Anthropic for certain language or multimodal tasks, Stripe for payment processing, Resend for sending account and Service emails, PostHog for product analytics (usage events linked to your account ID, not your email address), and Meta for ad measurement (hashed email address and account ID, as described in Section 2.5). We share only the information reasonably necessary for those providers to perform the requested service.

3.2 No Sale or Commercial Sharing

We do not sell your uploaded images, generated images, face data, or other personal data, and we do not disclose them for third-party commercial or marketing purposes. The only exception is the hashed sign-up and purchase events we send to Meta to measure our own ads, described in Section 2.5. These never include your uploaded or generated images.

3.3 Legal Compliance

We may disclose information if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency).

4. Data Retention

4.1 Face Data Retention

We may process photos and videos that contain a user's face in order to provide image generation, editing, virtual try-on, face transfer, chat-based generation, saved media, and persona features. We do not use uploaded media for identity verification or facial recognition, and we do not store biometric templates or faceprints derived from uploaded media.

One-Time Uploaded Photos or Videos Containing Faces: Retained for up to 30 days after processing so we can complete the request, support retries, investigate abuse, and respond to customer support issues, then deleted or de-linked from active workflows unless you separately save the content in your account.
Persona Photos and Metadata: Photos you add to a persona, and their metadata, are retained while that persona exists so it can be reused for the generations you request (for example, as reference images). When you delete a persona or remove photos from it, we delete those photos. If you upload photos but never finish creating a persona, we delete them automatically: photos in an unfinished persona after 7 days without a save, and photos you never added to a persona once they are 14 days old and you haven't created or saved a persona in that time.
Derived Persona Model Artifacts: Retained only while the persona feature remains active for your account and deleted within 30 days after you delete the persona or your account so queued cleanup processes and backups can complete.
Saved or Favorited Generated Media, Chat Attachments, or Other Saved Content Containing Your Likeness: Retained while your account remains active so you can access your saved content, and deleted within 30 days after account deletion or earlier if you delete the saved content yourself. If an account is inactive for 24 months, we may delete associated saved media as part of our storage minimization practices.
Provider-Side Processing: When we use third-party AI providers to process face-related content on our behalf, we instruct those providers to process the content only as needed to provide the requested feature. Such providers may temporarily retain submitted content or derived artifacts for limited operational, abuse-prevention, or legal compliance purposes under their own policies.

4.2 Other Data Retention

Other Data: Technical and usage data may be retained in aggregated, non‐identifiable form to help us improve our services.

5. Security Measures

We use a variety of technical, administrative, and physical safeguards to protect your data:

Encryption: Where feasible, data in transit is encrypted using SSL/TLS protocols.
Access Controls: Only authorized employees or contractors have access to systems storing limited amounts of personal data needed to operate the Service.
Third‐Party Standards: Our service providers maintain their own security programs and are responsible for protecting the data they process on our behalf.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee its absolute security.

6. Your Rights and Choices

Depending on your jurisdiction, you may have certain rights regarding your personal data, such as:

Access: Request a copy of any personal data we hold about you.
Deletion: Request the deletion of your personal data, including saved media or persona-related uploads that we store in our systems.
Withdrawal of Consent: If our processing is based on your consent, you have the right to withdraw that consent at any time.

You can delete your account yourself at any time: sign in, open Billing & Credits, and choose "Delete my account". This cancels any subscription you bought on our website, deletes your account and its data as described in Section 4, and sends a confirmation to your email address. Subscriptions bought through the App Store or Google Play must be cancelled there.

To exercise any of these rights, please contact us at the email address below. We will respond within a reasonable timeframe, in compliance with applicable laws.

7. Children's Privacy

Our Service is only for adults aged 18 or older (or the age of majority in your jurisdiction, if higher). We do not knowingly collect personal data from anyone under that age, and our Terms of Service prohibit uploading images of minors. If we learn that we have inadvertently collected such data, we will promptly delete it.

8. International Transfers

Our servers and service providers may be located in different jurisdictions. If you access or use our Service from outside the United States, your information may be transferred across international borders and stored or processed in a country different from yours. We strive to ensure that transfers of personal data comply with applicable data protection laws.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. When we do, we will revise the "Effective Date" at the top of this policy. Your continued use of our Service following the posting of changes constitutes your acceptance of such changes. We encourage you to review this Privacy Policy periodically.

10. Contact Us

If you have any questions or concerns about this Privacy Policy, the data we hold about you, or to exercise your rights, please contact us at: support@carephoto.art