Privacy Policy & Biometric Data Notice
Last Updated: October 31, 2026 • Effective Date: October 31, 2026
Core Privacy Guarantees
- Automatic 24-Hour Deletion: All photos uploaded and generated are permanently deleted from our active storage within 24 hours.
- No Model Training: Your family photos are never used to train or fine-tune artificial intelligence models by us or our processors.
- Transient Face Processing: Facial detection and alignment vectors operate strictly in transient memory to apply repairs and face preservation. We never store persistent biometric identifiers or face templates.
1. Scope and Age Restriction (18+)
The Old Photo Studio ("we", "us", or "our") provides web-based photo restoration, scratch repair, colorization, and portrait composition services. This service is strictly for individuals aged 18 and older. If you upload historical family photographs depicting minors, you affirm that you are the parent, legal guardian, or possess lawful authorization to restore the photograph.
2. Biometric and Facial Data Processing
To provide facial restoration, scratch removal, and our "Faces stay theirs" untouched facial preservation feature, our algorithms momentarily scan image coordinates to identify facial areas:
- Illinois BIPA & Texas CUBI Compliance: Facial vector coordinates exist exclusively in volatile memory (RAM) during pipeline execution. No biometric templates, retina scans, or persistent facial geometry records are written to disk or retained. Processing qualifies under transient processing exceptions.
- GDPR (Art. 9) & LGPD (Art. 11): We process sensitive image data solely based on your explicit request and contractual necessity to perform the requested restoration.
- No Surveillance or Identification: We never compare uploaded faces against external identity databases or attempt real-world identity resolution.
3. Third-Party Subprocessors
We engage reputable infrastructure partners bound by strict confidentiality and data protection agreements:
| Provider | Purpose | Retention |
|---|---|---|
| Cloudflare | CDN, bot mitigation (Turnstile), temporary encrypted R2 storage | Max 24 hours (auto-expire) |
| AI Inference Providers (Replicate / Google) | Execution of image restoration and colorization pipelines via zero-retention APIs | Transient / stateless execution |
| Creem.io | Merchant of Record & secure payment processing | Tax & accounting compliance |
4. Your Data Rights
Regardless of location (including under GDPR, UK GDPR, California CCPA/CPRA, Brazil LGPD, and Turkey KVKK), you have the right to request confirmation of data deletion, revoke consent, or lodge inquiries regarding our data handling. Since files are deleted within 24 hours, after 24 hours no record of your uploaded image remains on our servers.
5. Contact Us
If you have questions about this Privacy Policy or need assistance regarding your data, contact our support team at:
Email: [email protected]