Biometric Consent Policy
Last updated: June 2025 · Draft version
What is biometric data?
Biometric data includes facial images and any data derived from them that can be used to identify an individual. On CastFace, photos you upload of your face constitute biometric information under applicable law including GDPR (Art. 9) and the Illinois Biometric Information Privacy Act (BIPA).
What you consent to
By uploading photos to CastFace and checking the biometric consent box, you explicitly consent to:
- → Storage of your facial images on secure servers
- → Display of your images to verified brand/studio accounts browsing the catalog
- → Use of your images for the purpose of licensing as described in your listing
[TODO: Full BIPA-compliant consent language, retention schedule, destruction policy]
How we protect your data
Your photos are stored in private, encrypted cloud storage with row-level security. They are never sold or shared without your explicit per-use consent.
[TODO: Technical measures, third-party processors list, DPA references]
Withdrawing consent
You may withdraw your biometric consent at any time by deleting your listing or contacting us at [TODO: privacy@castface.net]. Upon withdrawal, your photos will be permanently deleted within [TODO: X business days].