Privacy Policy

Last updated: February 27, 2026

Kynn LLC d/b/a Modoface ("Modoface," "we," "us," or "our") operates the Modoface AI headshot generation service. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website and services.

Modoface processes biometric data (facial photographs) to provide our AI headshot generation service. We obtain your explicit consent before processing any biometric data, as described below.

1. Information We Collect

Information You Provide

  • Account Information: Email address, name — for account creation and communication
  • Biometric Data: Facial photographs you upload — for AI headshot generation
  • Payment Information: Processed by Stripe — for subscription and credit purchases

Information We Generate

  • Generated Images: AI-created headshots — for service delivery
  • Usage Data: Generation history, credit transactions — for service operation and billing
  • Technical Data: IP address, browser type, device info — for security and analytics

Biometric Data Notice

We process biometric data as defined under GDPR Article 9 and similar laws, including facial photographs you upload, photographs sent to our AI service providers for headshot generation, and generated images containing your likeness.

We do NOT: Use your photos, generated images, or any other content to train AI models, or retain biometric data after you delete your account. We share your photos with AI service providers only to generate your images—never for other purposes.

2. How We Use Your Information

  • Generate AI headshots from your uploaded photos
  • Manage your account and credits
  • Process payments
  • Provide customer support

3. How We Share Your Information

Service Providers

We share data with processors to operate our service: Cloudflare (storage, CDN, AI Gateway), Google Cloud Vertex AI (image generation), Supabase (database hosting), Stripe (payment processing), and Resend (transactional email). All are located in the US with appropriate data transfer mechanisms.

We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4. Data Retention

  • Account information: Duration of account
  • Uploaded photos: Duration of account
  • Generated images: Permanent until account deletion
  • Subscription credits: 30 days from purchase
  • Top-up credits: Never expire

Account Deletion: When you delete your account, we delete all your personal data, including biometric data and generated images, within 48 hours.

5. Your Rights

GDPR Rights (EU/UK Users)

You have the right to: access and obtain a copy of your data, rectify inaccurate data, erase your data, export your data (portability), withdraw consent for biometric processing, object to certain processing, and lodge a complaint with your local data protection authority.

California Rights (CCPA/CPRA)

California residents have additional rights: Right to Know what personal information we collect, Right to Delete your data, Right to Opt-Out (we do not sell personal information), and Non-Discrimination regardless of privacy choices.

How to Exercise Your Rights

Most rights can be exercised in your account settings. You can also contact us at support@modoface.com. We respond within 30 days (GDPR) or 45 days (CCPA).

6. Data Security

We implement appropriate technical and organizational measures including encryption at rest and in transit, row-level access controls and data ownership verification, secure token-based authentication, audit logging for data modifications and sensitive operations, and SOC 2 certified service providers.

Data Breach Notification

In the event of a personal data breach that poses a high risk to your rights and freedoms, we will notify affected users without undue delay and, where required by law, within 72 hours of becoming aware of the breach. We will also notify the relevant supervisory authority as required under GDPR Article 33.

7. Cookies and Tracking Technologies

Modoface does not use advertising cookies or third-party tracking pixels. We use only essential cookies required for authentication and service functionality. Analytics data (IP address, browser type, device info) is collected through Cloudflare for security monitoring and service improvement. No data is shared with advertising networks.

8. International Transfers

Your data may be transferred to the United States. We use the EU-US Data Privacy Framework (Cloudflare, Google Cloud, Stripe, Resend) and Standard Contractual Clauses (Supabase) as transfer mechanisms.

9. Children's Privacy

Modoface is not intended for users under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email, prominent notice on our website, or in-app notification. Continued use after changes constitutes acceptance of the updated policy.

11. Contact Us

Data Controller: Kynn LLC d/b/a Modoface

Privacy Inquiries: support@modoface.com

12. Supervisory Authority

If you are in the EU/UK and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.