Biometric Data Policy

1. What Is Biometric Data?

For the purposes of this policy, "biometric data" and "biometric identifiers" mean data derived from physical or behavioural human characteristics that can be used to identify a specific individual — including facial features derived from photographs and acoustic features derived from voice recordings. Biometric data does not include the photographs or audio recordings themselves.

2. When We Collect Biometric Data

Creofy may collect or derive biometric data when you use the following features:

• AI influencer creation: When you upload photographs to create an AI influencer, biometric characteristics may be derived from those images solely for the purpose of generating consistent AI content for that influencer.
• Voice feature: When you provide voice recordings to create a synthetic voice, acoustic characteristics are derived from those recordings solely for the purpose of generating consistent AI audio for that influencer.

We do not collect biometric data for any purpose other than those described above. We do not use biometric data to build identification databases or to identify individuals outside of the Creofy platform.

3. Consent

Before collecting or deriving biometric data from any individual, Creofy requires consent as follows:

Your Own Biometric Data

When you upload reference images or voice samples of yourself, you provide consent by completing the consent step during the influencer or voice-clone creation flow. This consent is specific to the stated purpose and can be withdrawn at any time by deleting your influencer or voice clone (which triggers deletion of the associated biometric data — see Section 5).

Third-Party Individuals (Agency / Creator Use)

If you upload images or voice recordings of a third party (e.g., a real person talent you represent), you must:

• Obtain that individual's written consent before uploading any content from which their biometric data may be derived.
• Inform them of the purpose (AI image/video/audio generation on Creofy).
• Inform them of the retention period (see Section 4).
• Keep a record of the consent.

By uploading third-party biometric material, you represent and warrant that you have obtained all legally required consents. Uploading third-party biometric data without consent violates our Acceptable Use Policy and applicable law, and may result in immediate account termination.

If you believe someone has uploaded your image or voice to Creofy without your consent, you can report it directly — see the Right of Publicity and Likeness Rights section of our DMCA / IP Policy for how to submit a complaint and request removal.

Illinois Residents — Additional Notice

In compliance with BIPA (740 ILCS 14/10), we provide this notice to Illinois residents: Creofy collects or derives facial geometry and/or voiceprint data as described above. This data is collected for the purpose of AI content generation. It is not sold, leased, or traded. It is retained only for the period described in Section 4 and destroyed as described in Section 5. By using the relevant Creofy features, Illinois residents provide written electronic informed consent as required by 740 ILCS 14/15(b).

4. Retention

We retain biometric data only for as long as necessary to fulfil the stated purpose:

We do not retain biometric data beyond the retention period described above. In no event will we retain biometric data for more than 3 years from the date of last use of the relevant feature, even if the account remains active.

5. Destruction

When a retention trigger occurs (influencer deletion, voice clone deletion, account closure, deletion request, or consent withdrawal), we will securely destroy the associated biometric data from our systems and instruct our third-party processors (ElevenLabs for voiceprints; our AI generation providers for face geometry) to destroy their copies, within 30 days of the triggering event. Destruction means permanent deletion with no capability of recovery.

To request deletion of your biometric data, email support@creofy.io (subject: Biometric Data Deletion Request). We will confirm deletion within 30 days.

6. No Sale or Profit from Biometric Data

Creofy does not sell, lease, trade, or profit from biometric identifiers or biometric information in any form. Biometric data is never disclosed to third parties except to the sub-processors described in Section 7 who act under contractual obligations to process it only for the purposes we specify and to delete it upon instruction.

7. Sub-Processors Who Handle Biometric Data

Certain AI generation providers receive biometric data as part of processing your requests. These providers are listed in our sub-processors list. Each is contractually obligated to process biometric data only on our instructions, maintain appropriate security, and delete data when instructed. We do not authorise any sub-processor to use your biometric data for their own purposes or to train general models.

8. Security

We store biometric reference data (uploaded images and voice samples) with industry-standard encryption at rest and in transit. Access is restricted to authorised systems via signed, time-limited URLs and is logged. We apply a standard of care that is at least as protective as that which we apply to other confidential and sensitive personal information we hold.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of the biometric data we hold about you.
• Delete — request deletion of your biometric data (see Section 5).
• Correct — request correction of inaccurate biometric data.
• Withdraw consent — withdraw your consent for biometric processing; this will require us to delete the data and will prevent continued use of the relevant feature.
• Lodge a complaint — in the UK/EU, with the Information Commissioner's Office (ICO) or your local supervisory authority; in Illinois, under BIPA's private right of action.

To exercise any of these rights, email support@creofy.io.

10. Contact

For questions about this policy or our biometric data practices: support@creofy.io (subject: Biometric Data Policy).

Creofy Ltd, a company registered in England and Wales under company number 17310018, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.