Biometric Data Consent Policy

Biometric data is personal data derived from specific technical processing relating to the physical, physiological, or behavioural characteristics of a natural person, which allows or confirms the unique identification of that person.

Facial photographs and imagery constitute biometric data or biometric information under a number of laws, including:

• EU / UK General Data Protection Regulation (GDPR / UK GDPR) — Article 9 defines biometric data processed for the purpose of uniquely identifying a natural person as a “special category” of personal data requiring explicit consent.
• Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/ — covers “biometric identifiers” including scans of face geometry.
• Texas Capture or Use of Biometric Identifier Act (CUBI), Tex. Bus. & Com. Code § 503.001 — covers “biometric identifier” defined to include retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.
• Washington My Health MY Data Act (HB 1155) and other US state laws that may classify facial images as regulated biometric or health data.
• Other national and regional laws in jurisdictions where our users reside may impose additional obligations.

CastFace treats all facial photographs uploaded by users as biometric data regardless of whether a specific law requires it in your jurisdiction, applying the most protective standard consistently across the Platform.

This Policy applies to you if you are a Person who registers on CastFace and uploads photographs of your face in connection with creating a face listing. It does not apply to Company users who browse the catalog.

This Policy does not apply to photographs you upload that do not include a human face, or to non-biometric personal data, which is covered by our Privacy Policy.

When you create a face listing on CastFace, we collect the following biometric data:

We do not use your facial photographs to:

• Train, fine-tune, or improve any AI or machine learning model.
• Derive or extract biometric templates, facial geometry data, or other derivative biometric identifiers beyond what is intrinsic to storing the original photograph.
• Build a database of facial recognition data.
• Sell, lease, trade, or profit from your biometric data.
• Share your photographs with any Company user until a separate license agreement has been executed (the catalog shows your photos solely to facilitate license requests).

Under GDPR Article 9(2)(a) and equivalent laws, we process your biometric data solely on the basis of your explicit, informed, freely given, and specific consent, obtained through the biometric consent checkbox you complete when submitting your face listing.

That consent checkbox constitutes your acknowledgement that:

• You have read and understood this Biometric Data Consent Policy.
• You freely agree to the collection, storage, and display of your facial photographs as described in this Policy.
• You understand the nature of biometric data and the specific purposes for which it will be processed.
• You understand that you may withdraw this consent at any time (see Section 9).

Consent is not a condition of using CastFace generally — only of submitting a face listing. If you choose not to consent, you may still use the Platform as a Company user.

If you are a resident of Illinois, the Biometric Information Privacy Act (BIPA) requires us to make the following specific disclosures before collecting your biometric information:

CastFace applies the following technical and organisational measures to protect your biometric data:

• Private storage buckets: All facial photographs are stored in private cloud storage buckets hosted by Supabase. They are not publicly accessible via any URL.
• Time-limited signed URLs: When an authenticated Company user views the catalog, access to photographs is granted only via cryptographically signed, time-limited URLs (valid for 1 hour). These URLs cannot be shared to grant access to unauthenticated users.
• Row-Level Security (RLS): Database-level access control policies ensure that no user can access another user's data without authorisation.
• Encryption in transit: All data is transmitted over TLS 1.2 or higher.
• Encryption at rest: Data stored in Supabase infrastructure is encrypted at rest using AES-256.
• Access controls: Administrative access to biometric data is restricted to CastFace personnel with a legitimate operational need.
• Sub-processor standards: Supabase is SOC 2 Type II certified. Vercel is SOC 2 Type II certified.

We share your biometric data only with the following parties:

• Supabase, Inc. (USA) — cloud database and storage infrastructure. Processes data as a data processor under a Data Processing Agreement. Data is stored in the region selected at project creation (currently Tokyo, Japan).
• Vercel, Inc. (USA) — application hosting. Vercel does not have access to storage contents; it serves the application layer only.
• Company users of the Platform — your photographs are displayed to registered and verified Company accounts for the purpose of facilitating license requests. They view images through the Platform interface only; they do not receive raw file downloads.
• Law enforcement or regulatory authorities — only where required by applicable law, court order, or binding regulatory demand.

We do not share your biometric data with any advertising networks, data brokers, analytics companies, or social media platforms.

We retain biometric data for the minimum period necessary for the purposes described in this Policy. Our retention and destruction schedule is as follows:

“Permanently deleted” means that biometric data is deleted from our active database, from cloud storage, and from any backup systems within the timeframe specified. Consent records (the timestamp and confirmation of consent, without the biometric data itself) are retained for 5 years for legal compliance purposes.

You may withdraw your consent to biometric data processing at any time, without penalty and without affecting the lawfulness of processing that occurred before withdrawal.

To withdraw consent, contact us at privacy@castface.netwith the subject line “Biometric Consent Withdrawal” and your registered email address. We will:

• Acknowledge your request within 5 business days.
• Remove your listing from the public catalog immediately.
• Permanently delete your facial photographs from all systems within 30 days.
• Confirm deletion in writing (by email).

Please note that withdrawal of biometric consent means your face listing will no longer be available in the catalog. It does not affect any license agreements that were concluded prior to withdrawal.

In addition to the rights described in our Privacy Policy, you have the following specific rights with respect to your biometric data:

• Right to access: You may request confirmation of whether we hold biometric data about you and receive a copy.
• Right to deletion: You may request permanent deletion of your biometric data at any time (see Section 9 above).
• Right to withdraw consent: As described in Section 9.
• Illinois BIPA rights: Illinois residents have the right to bring a private right of action against entities that violate BIPA (740 ILCS 14/20). CastFace is committed to full BIPA compliance.
• GDPR rights: EU/EEA residents have all rights under GDPR Articles 15–22 as described in our Privacy Policy.

For any questions about this Biometric Data Consent Policy, to exercise your rights, or to withdraw consent, please contact:

We will respond to all biometric-related requests within 30 days, and to Illinois BIPA-related requests within the timeframes required by applicable law.