Legal
Privacy Policy
What we collect, why, who we share it with, and your rights.
- Version
- 2026-10-19
- Effective
- 2026-10-19
1. What we collect
| Data | Why | Where it comes from |
|---|---|---|
| Email address | Account identity, sign-in, transactional mail | You, at sign-up (or from Google if you use that) |
| Waitlist signup: name, email and organisation | To tell you when a place opens | You, on the landing page's waitlist form. No account is needed. |
| Contact form: email, name if you give one, what the message is about, and the message | To answer privacy requests, reports and vulnerability reports from people without an account | You, on the contact form on the Support page. No account is needed. |
| Comments and messages to our social media accounts: username, text, time | To reply, for example with a link you asked for | The platform, such as Instagram, when you contact our account |
| Password hash | Sign-in | You. We never store the password itself. |
| Company UEN, if you sign up as a business | To confirm the account belongs to a registered company | You, at sign-up |
| Product photos and brand material you upload | So the product can render your products and your brand | You |
| Photos and videos you attach in the director chats, and stills taken from them | To use as references for your work | You |
| Photos, video and audio of a real person that you upload | To build a character of that person | You |
| Still frames and a short voice clip cut from your video and audio | To build the character and give it a voice | Made by us from your uploads |
| Face analysis results: head angle, sharpness, face size and an estimated age for each face, and how many other people were in the photo | To pick the best photos and to refuse characters that appear to show a minor | Worked out by us from your uploads |
| Voice clip details: its length, where it starts in your file, and how much speech it holds | To pick a usable voice clip | Worked out by us from your uploads |
| Your liability confirmation: the words shown, their version, "This is me" or "Someone else", the time, the network addresses your request came through, and your browser's user agent | Evidence of what you confirmed before uploading | You and your browser |
| Likeness reports: the reporter's email, an optional name, a description, an optional link, and whether the content is intimate and whether the reporter is the person shown | To act on the report | The reporter, on the Support page. No account is needed. |
| Character descriptions and prompts | To generate what you asked for | You |
| Chat transcripts | So the assistant has context, and so you can return to a session | You |
| Generated images, voice clips and video | So the product can show you your own work | Produced by the service |
| Fingerprints of files we deliver, linked to your account | A public check of whether a file came from PersonaFix; misuse checks | Made by us |
| Files sent to our public check | To answer it | Anyone, no account needed |
| Credit ledger and billing status | To meter usage and manage your subscription | The service and Stripe |
| Request metadata (IP, user agent) | Security, abuse prevention, rate limiting | Your browser |
2. Real people
You can build a character from photos, video and audio of a real person. It may be you, or, if you have the right to, someone else. You must tick a box accepting responsibility before you can upload (Terms section 1).
What we collect. The photos, video and audio you upload. From video we take still frames and the sound. From the sound or an audio file we cut a voice clip of 12 to 15 seconds.
What we work out from faces and voices. For each face in every photo we read, and in every still we keep from a video, we work out its head angle, sharpness, size and an estimated age. For a voice clip we note its length and how much speech it holds. We keep these with the file they describe. We use them to choose the best photos and voice, and to refuse any character where someone appears to be under 21. We also refuse a file if we cannot estimate the age of its face.
Files we refuse. If we refuse a file, for example because someone appears to be under 21 or it shows sexual content, we keep a note of why, and the estimated age, with that file. We do not use a refused file to build anything. The file stays in private storage until it is deleted under section 5.
Face measurements are not stored. To tell people apart in your uploads, and to check that each generated photo matches your chosen photos, our servers compute a numerical measurement of each face. It exists only in memory while that step runs, and is then discarded. We never store it for any real person. We do not use it to find out who anyone is, and we do not compare it with any other database. Face analysis runs on our own servers. No outside face-recognition service is used.
Who else receives the files. Photos and video frames go to OpenAI to be checked for sexual and violent content. Your chosen photos go to the image provider you select, only to generate what you ask for. For video, the video provider receives the character's generated photos and the voice clip, not the photos you uploaded. Our chat assistant sees a summary of each file, including its name and the estimated age, and up to four of your chosen photos. See section 4.
Why we may use this data.
- If the person is you: to perform our contract with you, and, for any processing of your face that counts as biometric data, your explicit consent, given by the box you tick.
- If the person is someone else: you confirm that you have their consent or another lawful right, and we rely on that confirmation.
- Refusing apparent minors, moderation and acting on reports: our legitimate interests in keeping the service safe and lawful, and our legal obligations.
How long we keep it. Until the first of: you delete the files; you delete the character or your account; 3 years after the character was last used; or we remove them after a valid report. See section 5 and our Biometric Privacy Notice.
If this is you. If someone made a character of you without your permission, use the "Report an AI replica of you" form on Support. No account is needed. See the Likeness Takedown Policy.
Product photos, advertisements and files you attach in the director chats may also show people. We process those uploads only to deliver your work, as explained in Terms section 5, and do not analyse the faces in them.
2A. Automated decisions
Automated moderation checks prompts, uploads and generated media, and refuses a request that breaks the Acceptable Use Policy. A refused request is refunded. A person, not the system, decides whether to suspend or close an account. We make no other decisions about you by automated means that have legal or similarly significant effects.
3. Legal basis
- Contract: account access, generation, billing and service delivery.
- Legitimate interests: security, abuse prevention, operating the service (including PostHog error reports), answering enquiries, reports and social media comments, and keeping AI content identifiable.
- Legal obligation: responding to requests to exercise data-protection rights.
- Explicit consent: processing of your own face and voice in a character you build from your own photos, video or audio (section 2).
- Consent: the waitlist, which you can leave at any time, and optional analytics, provided by PostHog and running only after you accept it in the cookie banner; see the Cookie Notice for what it stores and sends.
4. Who receives your data
We use these providers to operate the service and process your requests:
| Provider | Purpose | Location | Data |
|---|---|---|---|
| Supabase | Database, authentication, and file storage | Singapore | Account email and company UEN, waitlist signups, contact messages, uploaded product photos and brand material, photos, video and audio of real people you upload, the stills and voice clips cut from them, face analysis results (angle, sharpness, estimated age), liability confirmations, likeness reports, files attached in director chats, generated images and video, chat transcripts, credit ledger |
| Railway | Application and background-worker hosting, including face analysis and audio processing on our own servers | Singapore | All request data in transit, including real-person uploads while they are processed; application logs |
| Vercel | Web frontend hosting and delivery | United States | Request metadata (IP, user agent) for delivery and abuse prevention |
| PostHog | Error reports; product analytics only after you accept analytics in the cookie banner | United States | Errors: what broke, where, and your account id. Analytics: an account identifier, your email's domain, pages visited without their query strings, and the product actions listed in the Cookie Notice |
| Stripe | Subscription billing and payment processing | United States / Ireland | Account email, billing details. Card numbers never reach our servers. |
| OpenAI | Chat assistant, prompt generation, image generation, and content moderation | United States | Chat messages and generation prompts; for a character built from a real person, a summary of each file (its name, status and estimated age) and up to four of your chosen photos per chat turn; photos and video stills you attach in director chats; reference images for image generation, including product photos, brand material and your chosen photos of a real person when a render uses them; images submitted to the moderation endpoint, including product photos, brand images, photos of a real person and stills taken from uploaded video |
| Runware | Video generation and image generation (ByteDance, Kling, MiniMax, Alibaba and Google models) | United States / European Union | Generation prompts, generated reference images, product photos and brand material you upload when a render uses them, your chosen photos of a real person when an image render uses them, the voice clip of a real person when a video render uses it, videos you upload when a scene copies, edits or extends them, and generated media |
| PiAPI | Video generation (alternate route, not offered in the picker) | United States | Scene prompts, generated reference images, generated video |
We do not use any outside face-recognition, identity-check or public-figure service. PiAPI never receives photos, video or voice of a real person.
What they do with it. Supabase, Railway and Vercel host the service and are bound to process data on our instructions only. Stripe processes payments on our instructions and also acts as a controller in its own right to prevent fraud, meet its legal duties and improve its services. OpenAI states that data sent to its API is not used to train its models and is kept for up to 30 days for abuse monitoring, which can include human review. Runware states that it will not use your training data or trained models to develop models, and does not store outputs long term. PiAPI gives no training commitment; it is not offered in the model picker and serves only storyboards saved before 2026-08-30 that name its model.
Transfers. The database, application and queue run in Singapore. Vercel, Stripe, OpenAI, Runware and PiAPI process data in the United States or elsewhere. Each of these agreements carries the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum; Railway's and Stripe's also allow the EU-US Data Privacy Framework where the recipient is certified. Ask Support for a copy of what is relied on for a named provider.
Social media. Comments and messages to our accounts stay on that platform, under its privacy policy. Automatic replies say so; comment "stop" to end them.
Others. We may disclose data to authorities or courts when the law requires it, or when we believe in good faith it is needed to prevent harm, fraud or abuse. We may share it with our professional advisers, such as lawyers and accountants, under a duty of confidence. If PersonaFix is sold, merged or reorganised, your data may pass to the new owner, who must keep to this policy. We do not sell your data.
5. How long we keep it
| Data | Retention |
|---|---|
| Account record and email | Until account deletion |
| Waitlist signup | While open, then up to 90 days after the waitlist closes; sooner on request |
| Contact form messages | 12 months after handling; longer if needed as evidence in an abuse case or dispute; sooner on request where applicable |
| Ids of social media comments we answered | 12 months after the reply |
| Product photos and brand material | Until the product, brand or account is deleted |
| Files attached in the director chats | Until the board, campaign or account is deleted |
| Photos, video and audio of a real person, and the stills and voice clip cut from them, including files we refused | Until the first of: you delete them; you delete the character or your account (removed within a day); 3 years after the character was last used; or removal after a valid likeness report. "Used" means any generation with the character, or any new upload to it. |
| Face and voice analysis results | Deleted with the file they describe |
| Face measurements | Not stored. Computed in memory and discarded. |
| The fact that a character was refused because someone appeared under 21 | Stays on the character until your account is deleted, so the refusal cannot be undone by deleting files. No age is kept with it. |
| Photos and video generated from a real person's character | Until you delete them, the character or your account, or removal after a valid likeness report |
| Liability confirmations | Kept when a character is deleted; deleted with your account |
| Likeness reports | While the report is open, then up to six years after it closes, or longer while a related claim is open, then deleted |
| Generated media and chat transcripts | Until the media, session or account is deleted |
| Fingerprints of delivered files | Permanently; your account is removed from them on deletion |
| Files sent to the public check | Not stored |
| Credit ledger | For billing, tax and claims: six years from the end of the transaction's financial year, then deleted |
| Consent records | Evidence of accepted document versions: six years after account closure, then deleted |
| Moderation records | Evidence of refusals: six years after account closure, or longer while a related regulatory or law-enforcement matter remains open, then deleted |
| Labelling decisions | Evidence of disclosure decisions: six years after account closure, then deleted |
| Support tickets and replies | Deleted with your account; replies you made as an operator remain with the ticket owner's account, without your name |
| Operator audit log | Accountability for operator actions: six years after the action, then deleted |
| Application logs | Our hosting providers' plan retention window, for troubleshooting; we keep no archive of our own |
Kept after account deletion: the financial, consent, moderation, labelling, fingerprint and operator records above. Financial, fingerprint and operator records lose their account identifiers; consent, moderation and labelling records retain an account identifier and are not treated as anonymous. Access is restricted to authorised operators. Retention periods are reviewed once a year.
6. Your rights
You may request access, correction, deletion or restriction of your data, object to processing based on legitimate interests, and withdraw consent. Data export and account deletion are self-service in settings, subject to the retention exceptions above.
For other requests, including waitlist removal, contact Support. If you have no account, use its public contact form. We respond within one month. You may complain to a supervisory authority: the Personal Data Protection Commission in Singapore, the Information Commissioner's Office in the UK, or your country's authority in the EU.
6A. Children and sensitive data
PersonaFix is not for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us data, contact Support and we will delete it.
Please do not upload or type sensitive data, such as health information, government identity numbers or details of anyone's religion, ethnicity or sexuality. The service does not need it.
7. Security
See the Security page.
8. Who we are, and changes
PersonaFix Pte Ltd, 60 Paya Lebar Road, #06-28 Paya Lebar Square, Singapore 409051, decides how and why your data is used and is responsible for it. Our data protection officer can be reached through Support, which needs no account, or by post at that address. Revisions receive a new version date.