FaceLearn.io live
Legal

Privacy Policy

Last updated: October 8, 2026

Short version: We convert your face into an encrypted mathematical template and immediately discard the original image. We never sell your data. You can export or delete your data at any time by emailing privacy@facelearn.io.

Contents

  1. Who we are
  2. What we collect
  3. Biometric data
  4. How we use it
  5. Who we share it with
  6. How long we keep it
  7. Your rights
  8. Security
  9. International transfers
  10. Children
  11. Changes to this policy
  12. Contact

1. Who we are

FaceLearn.io ("we", "us", "our") operates the face recognition platform available at facelearn.io and portal.facelearn.io. We are the data controller for the personal information described in this policy. You can reach our privacy team at privacy@facelearn.io.

2. What we collect

Account information

  • Your name and email address
  • A hashed password (we never store it in plain text)
  • Your organization name and slug
  • Selected preferences (region, use case, team size)

Biometric data

  • An encrypted mathematical template generated from your face
  • We do not store the original image. The raw photo or video frame is discarded the moment a template is created.

Usage and technical data

  • IP address and user-agent string (for security, rate limiting, and audit logs)
  • Login attempt records (success, failure, timestamp)
  • API request metadata (endpoint, timestamp, response status)

Payment information (paid plans only)

  • Processed by our payment provider. We never see or store your card details.

3. Biometric data — the important part

Facial recognition is the most sensitive thing we handle, and we treat it that way.

  • Template-only storage: Your face is converted into a mathematical vector the moment you enroll. The original image is deleted in the same request — it is never written to disk or sent to a third party.
  • Irreversible: Face templates cannot be reverse-engineered back into a photo. Even if our database were compromised, an attacker would gain a meaningless string of numbers.
  • Encrypted in transit and at rest: Templates are transmitted over TLS 1.2+ and stored encrypted at rest.
  • Purpose-limited: Templates are used only for the verification operations you or your organization have enabled (login, attendance, or both).
  • Deletable: You can request deletion of your biometric template at any time by emailing privacy@facelearn.io. Deletion is permanent and irreversible.

4. How we use your information

We use the information we collect to:

  • Provide, operate, and maintain the FaceLearn.io service
  • Verify your identity during login and attendance check-in
  • Detect and prevent fraud, abuse, and unauthorized access
  • Send transactional emails (account confirmations, API keys, security alerts)
  • Respond to your support requests and inquiries
  • Comply with legal obligations
  • Improve the reliability and security of the platform (aggregated, anonymized analytics only)

We do not:

  • Sell your personal or biometric data to anyone
  • Use your face template for advertising or profiling
  • Share your data with law enforcement without a valid legal order
  • Train third-party machine-learning models on your data

5. Who we share it with

We share data only with service providers who help us run the platform, and only to the extent necessary:

  • Cloud hosting providers — where your data physically lives (see International Transfers below)
  • Transactional email providers — to send you account confirmations and API keys
  • Payment processors — for paid subscriptions (they handle card data; we don't)
  • CDN and DDoS protection providers — which may see your IP address

Each provider is contractually bound to process data only on our instructions and to keep it confidential. We do not permit them to use your data for their own purposes.

6. How long we keep it

  • Account data: Retained while your account is active, and for 30 days after deletion to allow for recovery from accidental deletion.
  • Face templates: Retained while your account is active. Deleted permanently within 30 days of a verified deletion request.
  • Security logs (IPs, login attempts): Retained for up to 90 days.
  • Billing records: Retained for as long as legally required (typically 7 years).

7. Your rights

Depending on where you live, you may have the following rights regarding your personal data:

  • Access — request a copy of the data we hold about you
  • Correction — ask us to fix inaccurate information
  • Deletion — request permanent deletion of your account and biometric template
  • Portability — receive your data in a machine-readable format
  • Objection — object to processing based on legitimate interests
  • Restriction — ask us to limit how we use your data
  • Withdraw consent — for any processing based on your consent

To exercise any of these rights, email privacy@facelearn.io. We will respond within 30 days.

8. Security

We protect your data with:

  • TLS 1.2+ encryption in transit
  • Encryption at rest for biometric templates and sensitive fields
  • HMAC-SHA256 hashing of API keys and invite tokens using a server-side secret
  • Rate limiting and login throttling against brute-force attacks
  • Regular security reviews of authentication and data-handling code

No system is 100% secure. If we become aware of a data breach affecting your information, we will notify you and the relevant authorities as required by applicable law.

9. International transfers

FaceLearn.io operates in three regions: US East (Virginia), EU West (Frankfurt), and Asia Pacific (Singapore). Your data is stored in the region you select at signup, or the region nearest to you if you choose "Auto".

If your data must be transferred outside its home region (for example, for backup or disaster recovery), we use standard contractual clauses or equivalent safeguards recognized under GDPR, PDPA, and similar frameworks.

10. Children

FaceLearn.io is not intended for anyone under 16 years of age. We do not knowingly collect personal or biometric data from children under 16. If you believe a child has provided us with their data, please contact privacy@facelearn.io and we will delete it promptly.

Institutional customers (schools, universities) must ensure that any minors enrolled in the platform have appropriate parental or guardian consent.

11. Changes to this policy

We may update this policy occasionally to reflect changes in our practices or legal requirements. When we make material changes, we will notify you by email or by a prominent notice on the platform at least 14 days before the changes take effect. The "Last updated" date at the top of this page always reflects the current version.

12. Contact

Questions about this policy or your data?

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.