Biometric Data Retention & Destruction Policy
Version 1.0.0 · Draft — not yet effective, pending counsel review
Looksmith works by putting makeup on a photograph of your face, which means we hold photographs of your face and a scan of its geometry. This policy says how long we keep them, what makes us destroy them, and how we prove destruction happened. It is the written retention schedule Illinois BIPA §15(a) requires.
This document is a draft and is not yet in force. It has not been reviewed by counsel, and two things it depends on are still outstanding: the processor list in our Privacy Policy does not yet name the storage provider, and the app does not yet link here from its settings. It is published in draft rather than late because the schedule has to exist before the data does.
- What this covers
- Why we hold it
- Retention schedule
- How we destroy it
- The one exception
- Where it is stored
- Who else receives it
- Exercising your rights
- Security incidents
- How to contact us
What this covers
- Selfies
- The photographs you capture in Looksmith — the front view, and the optional left and right identity views.
- The scan of your face geometry
- The measurements derived from those photographs so that makeup can be placed on your features. This is what the law in several states calls biometric information.
- Rendered Looks
- The images produced from them.
Together these are your Likeness.
Why we hold it
To render the Looks you ask for. That is the only purpose. We do not use your Likeness to identify you, to verify your identity, or to search for you in any database. We do not sell it, use it for advertising, or use it — or permit any provider to use it — to train, fine-tune, evaluate, benchmark, or otherwise improve any model.
Retention schedule
Each trigger below starts the clock. Whichever comes first governs.
| Trigger | Your Likeness stops being used | Stored copies erased |
|---|---|---|
| You delete it (Settings → My Likeness → Delete) | Immediately | Within 7 days |
| You delete your account | Immediately | Within 7 days of the cascade |
| You replace it with a new capture | When the new one becomes active | Within 7 days of the prior version’s 24-hour hold |
| You stop using Looksmith | 24 months after your last interaction | Within 7 days of that |
| Our at-least-annual review finds we no longer need it | 45 days after that review | Within 7 days of that |
| An upload never completes, expires, or fails validation | Immediately | Within 7 days of the 24-hour sweep |
Building to the shortest of these satisfies the longer statutory ceilings elsewhere.
How we destroy it
Two steps, and we separate them because only one of them is instant.
Stops being used is immediate and unconditional. From that moment nothing in Looksmith will read your Likeness — not to render a Look, not to show you a preview, not for anything.
Erased is the deletion of the stored bytes. It normally completes in seconds. We state seven days because that is a ceiling we can hold even through an outage or a retry, and we would rather publish a deadline we always meet than a word like “instantly” that we cannot prove. Deletion covers the stored image, the derived scan, cached and staged copies, and copies held by our providers.
Every destruction is performed by a scheduled job that deletes the object, then independently confirms it can no longer be retrieved, and only then writes an audit record — so the record is evidence, not an assertion. Each record contains only the trigger, opaque identifiers, and the completion time; never any biometric content. We comply with this schedule absent a valid warrant or subpoena.
The one exception
If content is preserved under 18 U.S.C. §2258A in connection with a report to the National Center for Missing & Exploited Children, that preserved content survives ordinary deletion for one year in segregated, access-limited storage. This is the only exception to the schedule above.
Where it is stored
In private cloud storage, encrypted, reachable only by an authorization tied to your account. Your original selfies are never placed on a public content network and are never publicly readable.
Who else receives it
Our current processors are listed in the Privacy Policy. We will not add a new recipient of your facial images without notifying you and obtaining fresh consent — adding one is a material change, not a routine update.
Exercising your rights
Delete your Likeness at any time in Settings → My Likeness → Delete. This is an immediate hard delete; your account stays active and your existing Looks are untouched. To delete your whole account, use Settings → Account → Delete account.
Security incidents
We maintain a written security-incident and breach-response protocol covering biometric data, and will notify affected users and regulators as required.
How to contact us
Mirable Labs, Inc.
support@mirablelabs.com
Write to us with any question about this policy, or to ask us to delete your photographs and face data. We read everything sent to that address.