The short version
- Your photos are kept with your report until you delete it, which takes one click at any time, or until you haven't used Face Rating Lab for 24 months.
- We keep your measurements and scores as numbers until you delete them, or until you haven't used Face Rating Lab for 24 months.
- We never sell your data and never use it to train AI.
- Only you can see your report.
- You can delete all your scans, photos, measurements and scores with one click in your account. To close your account and remove your email too, just email us.
1. Who we are
QMM LTD ("Face Rating Lab", "we", "us"), a company registered in England and Wales (company number 13466278), with its registered office at 91 Dukes Avenue, London, England, N10 2QD, is the controller of the personal data described in this policy.
This policy explains what we collect when you use the Face Rating Lab website and face analysis service, why we collect it and the choices you have. It applies wherever you live. If local law gives you more rights than this policy describes, you have those rights.
2. What we collect
- Your photos. The front photo and side-profile photo you upload.
- Face data. The face points we find on your photos and the measurements, visual ratings and scores we calculate from them. Some laws treat this as biometric data. Our biometric data notice explains how we handle it.
- Heritage and Male or Female. The heritage option you choose before uploading, or "Prefer not to say", and whether you choose Male or Female. We use them only to pick matching ideal ranges.
- Your confirmations. That the photos are of you, and your consent to us processing your face data, with the time you gave them.
- Contact details. Your email address, if you pay or log in.
- Purchase details. The package, amount, currency and Stripe payment reference. Stripe handles your card details. We never see or store your full card number.
- Technical data. IP address, browser and device information, and server logs we need to run the site securely and prevent abuse.
- Messages. Anything you send us when you contact support.
We don't ask for your name. We never infer your heritage, health or any other sensitive trait from your photos.
3. How we use it and why
Under UK and EU data protection law we need a lawful basis for each use of your data. Here is each use and its basis.
| What we do | Data used | Lawful basis |
|---|---|---|
| Analyze your photos and produce your free preview and report | Photos, face data, heritage, Male or Female choice | Contract; your explicit consent for face data and heritage (Article 9(2)(a)) |
| Take payment, deliver your purchase and keep your scan credits | Email, purchase details | Contract |
| Let you log in and see your reports again | Email, photos, face data | Contract; your explicit consent for face data |
| Send service emails, such as login links and receipts | Contract | |
| Answer your questions and handle refunds | Email, messages, purchase details | Contract; legitimate interests in helping customers |
| Keep tax and accounting records | Purchase details | Legal obligation |
| Keep the service secure and prevent fraud and abuse | Technical data, purchase details | Legitimate interests in running a safe service |
We don't send marketing emails unless you ask for them. We don't use your data for advertising, and we don't sell it or share it for cross-context behavioral advertising.
4. Face data and heritage
Face data can count as biometric data, and your heritage choice can reveal racial or ethnic origin. Both are "special category" data under UK and EU GDPR and "sensitive" data under several US state laws, so we hold ourselves to a higher standard:
- We only process them with your explicit consent, which you give by ticking the consent box before you upload.
- We use them only to produce your report, show it to you again and compare your own scans.
- We never use them to identify you, never sell them and never use them to train AI models.
- You can withdraw your consent at any time by deleting your scans. Withdrawing doesn't affect processing that already happened.
5. How long we keep it
| Data | How long |
|---|---|
| Photos | Kept with your report until you delete it, which you can do with one click at any time. If you don't use Face Rating Lab for 24 months, we delete them automatically. |
| Face points, measurements, ratings and scores | Kept as numbers until you delete them, so your report keeps working. If you don't use Face Rating Lab for 24 months, we delete them automatically. |
| Heritage and Male or Female choice | Stored with your scan and deleted with it |
| Email address and scan credits | Until you ask us to delete your account |
| Purchase and tax records | 6 years after the purchase, as UK tax law requires |
| Record of your confirmations and consent | Up to 6 years after you gave them, or for as long as we keep the scan they relate to if that is longer, without any face data, so we can show we asked properly |
| Server logs | Up to 30 days |
| Support emails | Up to 2 years after your last message |
When you delete a scan or your data in your account, it is removed from our live systems straight away. Copies in encrypted backups are overwritten within 30 days.
7. International transfers
We store your data in the United States: our database and photo storage (Supabase) and our servers (Render) are in the US East region, and some of our other providers also process data in the US. When personal data leaves the UK or the European Economic Area, we protect it with an adequacy decision (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or with standard contractual clauses (the EU clauses with the UK Addendum, or the UK International Data Transfer Agreement), plus extra safeguards where needed. You can ask us for a copy of the relevant safeguards.
9. Your rights
Under UK and EU GDPR you can ask us to:
- give you a copy of your data (access) or send it to you in a portable format;
- correct data that's wrong;
- delete your data;
- restrict or object to how we use it;
- stop processing your face data and heritage by withdrawing your consent.
The quickest way to delete your data is the one-click delete in your account, or the delete button on a report. For anything else, email support@faceratinglab.com. We reply within one month and may ask you to confirm your email address first, so we only act on requests from you.
10. US state privacy rights
If you live in a US state with a consumer privacy law, such as California, Colorado, Connecticut, Virginia, Texas, Oregon or Utah, you have the right to know what we collect, to access, correct and delete it, and to opt out of the sale or sharing of your data and of targeted advertising. We don't sell or share personal data and we don't do targeted advertising, so there is nothing to opt out of. We use sensitive data (face data and heritage) only to provide the service you asked for.
Notice at collection. We collect identifiers (email, IP address), commercial information (purchases), biometric information (face data), sensitive personal information (face data, and heritage, which may reveal racial or ethnic origin) and internet activity (server logs), all directly from you, for the purposes and periods described above.
Appeals. If we decline a request, you can appeal by replying to our answer with "Appeal" in the subject. If you're still unhappy, you can contact your state attorney general. We will never treat you differently for using your rights.
Washington and Nevada. Face data may count as "consumer health data" under Washington's My Health My Data Act and Nevada law. Our biometric data notice is our consumer health data privacy policy.
Illinois. We do not offer Face Rating Lab to residents of Illinois or to anyone located in Illinois.
11. Adults only
Face Rating Lab is only for adults aged 18 and over. We don't knowingly collect data from anyone under 18. If we learn that we have, we delete it. If you think a child has used Face Rating Lab, please email us.
12. Security
We encrypt data in transit, keep photos in private storage, limit who can access data and let you delete your photos and report at any time with one click. No system is perfectly secure. If a breach affects your data, we'll tell you and the regulators as the law requires.
13. Changes to this policy
If we change this policy, we'll post the new version here and update the date at the top. If a change is significant and we have your email address, we'll tell you before it applies.
14. Contact and complaints
Email support@faceratinglab.com, or write to QMM LTD, 91 Dukes Avenue, London, England, N10 2QD.
If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live in the EU. We'd appreciate the chance to put things right first.
Questions about this page? Email support@faceratinglab.com.