Privacy Policy

1. Who we are

FaceMe is the "data controller" for the information described here. For any privacy question or request, email hello@zaraface.com.

2. What we collect

• Account details: your name, email address, password (stored scrambled, never in readable form), and your Google account ID if you sign in with Google.
• Agreement records: when you confirmed you are 18 or older and accepted our terms, and which version.
• Payments: the amount, credits bought, payment reference, status, payment method type, and a scrambled fingerprint of your card used only to help spot fraud. We never see or store your full card number; Paystack handles card details.
• Wallet: a record of every credit added, reserved, used or refunded.
• Studio sessions: when each session started, connected and ended, how many seconds were reserved and used, and a session ID from our AI partner. Not the video or photos themselves.
• Abuse reports: the reporter's email, what they tell us, any link, the reported account, and the internet address (IP) the report came from.
• Technical information: your IP address and browser type (in short-lived server logs), and the cookies described in section 11.
• Your time zone (for example "Europe/London"), which your browser tells us when you're logged in, so we can show dates and times, and date your emails, in your local time. We don't use it to find out where you are.
• Usage statistics: which of our pages are visited and key steps such as signing up, starting a payment, opening the Studio and starting a session. These are stored in our own database, without your IP address, and deleted after 180 days. See section 11.

4. Why we use your information (and our legal basis)

• To provide the service you signed up for (your account, credits, payments, live sessions, emails like verification and receipts). Basis: performing our contract with you.
• To keep records required by law (for example tax and accounting records of payments). Basis: legal obligation.
• To keep the service safe: preventing fraud and misuse, handling abuse reports, and securing our systems. Basis: our legitimate interests, and protecting others.
• With your consent where we ask for it, for example signing in with Google, or emailing you news and offers. You can withdraw consent at any time.

5. Who we share it with

We only share what each company needs to do its job for us:

• Decart (Decart.ai Inc., USA): live face transformation. Receives your camera video and reference photo directly from your browser (see section 3).
• Paystack (Paystack Payments Ltd, Nigeria): processes payments. Receives your email and payment details.
• Google (Google LLC, USA): only if you choose "Continue with Google", to confirm who you are.
• Brevo (Sendinblue SAS, France/EU): sends our emails, such as verification links, password resets and receipts, and, only if you said yes, our news and offers. Receives your email address and the email content. Brevo also runs our live chat (see below).
• Our hosting provider: the company whose servers run our website and database.
• TikTok (TikTok Pte. Ltd. and its affiliates): only if you click "Accept all", the TikTok Pixel tells TikTok which of our pages you visited, so we can measure our TikTok ads. See section 11.
• Authorities, where the law requires it or to protect people from serious harm.

We don't sell your personal information.

Marketing emails. We only send you news, new features and offers by email if you said yes (when you signed up, on your Home page or on your Profile page). You can unsubscribe any time: switch it off on your Profile page or use the "unsubscribe" link in any of these emails. They are sent through our email provider, Brevo, which receives your name, email address and a few facts about your account so we can send relevant emails (for example when you joined, whether you've bought credits and how much time you have left). Emails about your account, such as codes, receipts and credit reminders, are always sent, whatever you choose.

Live chat. If you use the chat button on our website or app, your chat messages and basic account information (your name, email address, account number, balance, whether you've bought credits and when you joined) are processed by our chat provider, Brevo, so we can see who you are and answer you. If you aren't logged in, the chat is anonymous unless you give us your email address. The chat only loads if you choose "Accept all" cookies.

6. Sending data to other countries

We are based in Nigeria, Paystack is in Nigeria, Decart and Google are in the USA, and Brevo is in the European Union. So your information may be handled in countries other than the one you live in, including Nigeria. We do this only as the NDPA allows (Part VIII), relying on the protections those companies provide, such as contractual safeguards and recognised data-protection frameworks, and we expect the same of them for every user.

7. How long we keep it

• Account details: while your account is open. When it's closed, we remove your name, email address, Google link and password.
• Payment and wallet records: kept for 6 years after the payment, in anonymous form after your account is closed, because tax and accounting laws require it.
• Studio session records (times and seconds only): kept with your wallet records.
• Abuse reports: 2 years after the report is closed, or longer if needed for a legal matter.
• Server logs: about 14 days.
• Usage statistics: 180 days, then deleted automatically.
• Camera video and photos: never stored by us (see section 3 for Decart).

8. Your rights

Under the NDPA, and similar laws in many other countries, you have the right to:

• know what information we hold about you and get a copy (access);
• have wrong information corrected (correction);
• have your information deleted (erasure), except what the law requires us to keep;
• ask us to limit or stop using your information (restriction and objection);
• receive your information in a common format (portability);
• withdraw consent you've given; and
• complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or, if you live in another country, to the data-protection authority there.

How to ask: email us at hello@zaraface.com from the email address on your account. To close and delete your account, use "Request account deletion" on your profile page. We'll reply within 30 days, and may need to confirm your identity first. When we close your account, we remove your personal details but keep anonymous payment and wallet records as explained above. To ask Decart about data it holds, you can also contact Decart directly.

9. Security

Our website uses encrypted connections (https). Passwords are stored scrambled. Our partners' secret keys are kept only on our servers, and only a few authorised staff can see customer records. If a breach puts your information at risk, we will tell the Nigeria Data Protection Commission within 72 hours as the NDPA requires, and tell you where the risk to you is high.

10. Children

FaceMe is only for people aged 18 or older. If we learn that an account belongs to someone younger, we will close it and delete their information.

11. Cookies and analytics

When you first visit, we ask you to choose "Necessary only" or "Accept all". You can change your choice any time with "Cookie settings" at the bottom of every page.

• Necessary cookies (always on): keep you logged in, protect our forms from forgery, and remember your cookie choice.
• Our own usage statistics (always on, no tracking cookie): we count page visits and key steps in our own database, without your IP address, to see what works and fix what doesn't. With "Necessary only", these are anonymous counts, not linked to a visitor. If you're logged in, steps such as starting a session are linked to your account, because they're part of using the service.
• With "Accept all" only: an analytics cookie (a random ID, kept for 6 months) that lets us connect one visitor's steps, for example from visiting the home page to signing up. If we run TikTok ads, also the TikTok Pixel, which tells TikTok which pages you visited. Our live chat (Brevo Conversations), which stores its own cookies and browser storage to keep your conversation going between pages. Nothing in this list loads unless you click "Accept all". With "Necessary only", the chat doesn't load and you'll see a "Contact us" link instead.

12. Changes

We'll update this page if our practices change, and tell you about important changes by email or on the site.