Privacy Policy
Draft — under legal reviewThis document has not been approved by a lawyer. It may change, and changes will need your acceptance again. Status: DRAFT — pending counsel review.
This policy explains what personal data Antonio Kodheli ("Likeness", "we", "us") handles when you use the Likeness pilot, why, who else sees it and how long we keep it. It goes with the Terms of Service.
1. The pilot handles no biometric data
In this pilot Likeness does not compare faces or voices, does not check who a person is, and does not create or store any template or measurement of a face or voice. Creators state who they are by self-attestation; we do not check it. If we ever add anything that handles biometric data, we will publish a new policy and ask for separate, specific consent before any such processing starts. Accepting these documents is not that consent.
2. What we collect
Account. Your email address, a password hash (never the password), your display name if you set one, your second factor (passkey public keys, or an authenticator secret in encrypted form, and recovery-code hashes), and the organisation we create for you.
Sign-in and security history. For each sign-in, sign-out, password or factor change and similar event we record the time, the event type, your IP address, a coarse device label (for example "Chrome on macOS") and keyed fingerprints of your email address (an HMAC; not the address). We use this to protect accounts and to detect abuse.
Creator content. Photos (and audio files where the feature is available) you upload, the protected copies we make with an invisible watermark locator, file names, file fingerprints, previews if you publish an offer, your public handle, display name and short bio if you publish a page, and the offers, prices and rules you set.
Self-attestation and agreement records. The text version and SHA-256 of what you accepted or attested to, your user and the time, for the Terms, Privacy Policy, Creator Agreement, attestation and each photo you confirm shows you, and (for buyers) the Buyer License Terms version for each checkout.
Licensing and payments. License requests, quotes, licenses, buyer and seller organisations, amounts and currencies, payment events from Stripe, refunds and disputes, ledger entries and payout records (amount, currency, reference, note, who recorded it). We do not ask for or store card details; Stripe handles card data. Payouts are arranged outside Likeness: payout details you send to staff are kept only as needed to make the payout, and what we record in the product is listed here.
Checks by partners. When a partner checks a file, we record the decision category, time, the action and territory asked about, and the kind of party that asked (see "Creators see" below). We do not give partners scores or candidate lists, and we do not tell creators which partner asked.
Reports and support. Reports about a page or license, your messages to us, and staff notes. When a page is reported we keep a keyed fingerprint (an HMAC) of the reporter's network address, not the address itself, so that repeated reports can be counted once; the reporter is not asked for a name or contact details.
Waitlist and contact. The email and details you give when you join the pilot or contact us.
Cookies. We use a session cookie and a device cookie that are needed for sign-in and security. We do not use advertising or analytics cookies in the pilot.
3. Why we use it, and our legal bases
| Purpose | Data | Basis (where GDPR-style rules apply) |
|---|---|---|
| Run accounts, sign-in and security | account, sign-in history | contract; legitimate interests (security, fraud prevention) |
| Store, watermark and deliver your files; issue and record licenses | content, license data | contract |
| Take payments, record earnings, make payouts, handle refunds and disputes | payment and ledger data | contract; legal obligation (accounting) |
| Show your public page and offers if you opt in | handle, display name, bio, offers, previews | consent (you can withdraw it) |
| Respond to reports, takedowns and legal requests | reports, records | legitimate interests; legal obligation |
| Prove what you accepted and when | acceptance records | legitimate interests; legal obligation |
| Improve reliability, prevent abuse | logs, counters | legitimate interests |
We do not sell personal data, and we do not use your content to train AI models.
4. Who sees your data
- You, and other members of your organisation where the feature is shared.
- Buyers see the offer, the license, the self-attestation notice ("Self-attested by the creator. Likeness has not verified their identity.") and the protected copy they bought. They do not see your email address or legal name.
- The public sees only what you publish: handle, display name, bio, offers and watermarked previews, and only while you have chosen to list a public page.
- Creators see a summary of checks made on their files: the decision category, time, action, territory and whether the use was commercial, and whether the asker was themselves, their organisation, another creator or a partner. Partners are not named.
- Partners receive categorical results about files they submit, not personal data about you.
- Staff may see account, content, payment and report data needed to run the pilot, review reports and record payouts, under access controls and audit logs.
- Authorities and advisers where the law requires it or to protect rights and safety.
Processors we use
| Processor | Purpose | Notes |
|---|---|---|
| Stripe | card payments, refunds, disputes | Stripe is also an independent controller for its own compliance |
| Fly.io | application hosting, database and workers | [REGION — TBD] |
| Object storage provider | files and protected copies | [PROVIDER AND REGION — TBD] |
| Email provider | sign-in links, notices | [PROVIDER — TBD] |
| Redis hosting | short-lived rate-limit counters and locks (including keyed fingerprints of email addresses and networks) | [PROVIDER AND REGION — TBD] |
| Have I Been Pwned (range check) | when you choose a password, we check it against known breaches | only the first five characters of a SHA-1 hash of the password are sent (k-anonymity); the password itself is never sent; the check can be switched off |
5. Where data is processed
Data is processed where our hosts operate. [HOSTING REGIONS — TBD]
6. How long we keep it
| Data | Kept |
|---|---|
| Account, content, public page | while your account is open; removed or anonymised as described in section 7 |
| Sign-in and security history | [RETENTION PERIOD — TBD]; it is append-only, so it is kept after account deletion (section 7) |
| Rate-limit counters | short-lived (hours to days) |
| Licenses, buyer copies, ledger, payouts, refunds and disputes | for the life of the license and for the period accounting and tax rules require: [PERIOD — TBD] |
| Decision records, consent and acceptance records, audit events | [PERIOD — TBD]; append-only |
| Reports and takedown records | [PERIOD — TBD] |
| Data exports | deleted when they expire, or when you delete them or your account |
7. Deleting your account, and what stays
You can ask us to delete your account in your account settings. We apply a 7-day grace window, during which you can cancel.
Deletion is refused, and you are told why, in these cases. When your organization would close with you (you are its only member), it is refused while you have earnings from live payments that were not paid out (unless you choose to give them up), a payment problem on one of your sales (an open refund case) is still open, a license that involves your organization is on hold, or a payment is in progress for your organization. In a shared organization only one refusal applies: you are the only owner of an organization that has other members.
When deletion runs we: end all sessions and remove passkeys, authenticator secrets and recovery codes; unlist your public page and retire your offers (the handle stays reserved for 30 days); withdraw your consents; remove your waitlist entries; delete the photos and audio you uploaded, with their file names (the originals, and protected copies that no license or decision refers to), and your data exports; and replace your email address and name with a random placeholder and clear your password. An original is kept while an active, suspended or held license names it as its source, or while a buyer's copy of it is still being made, and is removed afterwards. A single-person organization is closed with you once your earnings and any payment in progress are settled; in a shared organization only your membership is removed.
What stays, and why:
- Frozen licenses and the copies buyers paid for — buyers are entitled to what they bought.
- The ledger, payouts, refunds and dispute records — accounting and tax law.
- Decision records, consent and acceptance records and audit events — they are append-only and are our proof of what happened. They refer to an internal id, not your name or email.
- Sign-in security history, including the IP addresses of sign-ins, and keyed fingerprints (HMACs) of your old email address in that history and in short-lived rate-limit counters — pseudonymous identifiers kept for security and abuse prevention. The fingerprints cannot be turned back into the address without our secret key.
- Released protected copies that a license or decision record refers to.
8. Your rights and how to use them
Depending on where you live you may have the right to access, correct, delete, export and restrict or object to the use of your personal data, to withdraw consent, and to complain to a regulator. You can export your data (the export includes your acceptance records) and delete your account yourself in your account settings; for anything else write to antonio_kodheli@icloud.com. We will answer within the time the law requires. We may need to confirm it is you. We do not discriminate against you for using these rights.
9. Security
We use encryption in transit, access controls, hashed credentials, two-step sign-in, audit logs and separation between the systems that process files and the systems that hold keys. No system is perfectly secure. Tell us at the contact below if you find a problem.
10. Children
The Service is for adults only. We do not knowingly collect data from anyone under 18 and will delete it if we learn we have.
11. Changes
We will publish a new version identifier for any material change. You are asked to accept the new Terms and Privacy Policy before you next sign up, attest as a creator, sell a license or check out.
12. Contact
Antonio Kodheli, 16 Hobart St, Braintree, MA 02184, United States, antonio_kodheli@icloud.com.