Privacy Policy

Last updated: September 10, 2026

1. What we collect

• Account information: name, email address, and password (stored hashed, never in plain text) — or your Google account identifier if you sign in with Google.
• Payment information: we do not store your card or bank details. Payments are processed directly by Paystack or Flutterwave, who provide us only a transaction reference and status.
• Studio content: your live camera feed and any reference image or prompt you provide, for the duration needed to generate your transformed output.
• Usage data: credits purchased and consumed, session duration, and basic technical logs (IP address, browser type) for security and billing accuracy.
• Support messages: anything you send via the in-app live chat, which is routed to our WhatsApp Business number to respond to you.

2. How we use it

• To operate the Service: authenticate you, run your transformation sessions, meter and bill credit usage.
• To process payments and prevent fraud.
• To respond to support requests.
• To investigate suspected violations of our Terms of Service or Acceptable Use Policy.
• To comply with legal obligations, including reporting unlawful content (see our Acceptable Use Policy).

3. Retention of camera feed, reference images, and prompts

Your live camera feed and reference images are processed to generate your transformed output and are not intended to be retained longer than necessary to provide that session's output. [Confirm and state your actual retention window here once implemented — e.g. "deleted within 24 hours of the session ending" or "not stored on our servers beyond the active session" — this must match what the code actually does.]

4. Who we share data with

We share the minimum necessary data with these third-party processors to operate the Service:

• Decart AI — receives your camera feed/reference image to generate the transformed video output.
• Paystack / Flutterwave — process your payments; we receive only a transaction status, not your card details.
• Google — if you use Google sign-in, for authentication only.
• Meta / WhatsApp Business API — if you use the in-app live chat, your message is delivered to our WhatsApp number.

We do not sell your personal data to advertisers or data brokers.

5. Your rights

Depending on your location, you may have the right to access, correct, or request deletion of your personal data, and to withdraw consent where processing is based on consent. To exercise these rights, contact us via Support. We will verify your identity before acting on the request.

6. Children

RefaceX is not directed at, and must not be used by, anyone under 18. We do not knowingly collect personal data from minors. If we become aware that we have, we will delete it.

7. Security

We use reasonable technical measures (password hashing, encrypted secrets, HTTPS) to protect your data, but no system is perfectly secure, and we cannot guarantee absolute security.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

9. Contact

Questions about this policy can be sent through Contact Support.