Privacy Policy

This Privacy Policy explains how we collect, use, and protect your personal data when you use facelineage.com and related services (the "Service"). Please read it together with our Terms of Service and Cookie Policy.

1. Who we are (data controller)

The controller of your personal data is Andromeda Entertainment, MB, a small partnership established in Lithuania, company code 308005148, registered office Žygio g. 5, Vilnius, Lithuania ("we", "us", "our"). You can reach us about any privacy matter at support@facelineage.com.

2. Data we collect

• Selfie photos you upload for analysis, plus any additional photos (e.g. parent photos) you submit for optional add-ons.
• Facial-feature data derived from your photo by our AI to produce your heritage analysis.
• Account information: your email address, used for authentication and report delivery.
• Quiz answers about heritage context you choose to share.
• Payment metadata (last 4 digits, card brand, country) provided by our payment processor. We never see or store full card numbers.
• Technical data: IP address, browser, device type, and timezone, collected automatically for security and analytics.

3. Sensitive data and your explicit consent

Analysing the features of a face may involve special categories of personal data under Article 9 of the GDPR. We process your photo and the facial-feature data derived from it only on the basis of your explicit consent, which you give when you upload your selfie to generate a report.

We use your facial data solely to generate the analysis you request. We do not use it to identify you across services, build a biometric profile, sell it, or feed it into AI training. You can withdraw your consent at any time by deleting your photo or your account, or by emailing us — withdrawal does not affect processing that already happened.

4. Why we use your data and our legal bases

• To generate your personalized heritage report and add-ons — explicit consent (Art. 9(2)(a)) for facial data; performance of our contract with you (Art. 6(1)(b)) for the rest.
• To process payments and prevent fraud — contract and our legitimate interests in securing the Service (Art. 6(1)(f)).
• To send transactional emails (sign-in links, receipts, reports) — contract.
• To improve the accuracy and quality of our Service in aggregate — legitimate interests; we do not use your individual photo for this.
• To keep accounting and tax records, and to respond to lawful requests — legal obligation (Art. 6(1)(c)).

5. AI processing

To produce your analysis, your photo and related inputs are sent to third-party AI providers (Anthropic and Google) acting as our processors. They process the data only to return a result to us; we do not authorize them to use it to train their models. This processing is covered by the explicit consent described in Section 3.

6. Sharing and recipients

We do not sell your personal data. We share it only with service providers acting on our instructions:

• Stripe — payment processing.
• Supabase — authentication and database/storage.
• Anthropic and Google — AI inference.
• Vercel — hosting and content delivery.
• Resend — transactional email delivery.
• Public authorities, where we are required to disclose by law.

7. International transfers

Some of our providers process data outside the European Economic Area (e.g. in the United States). Where they do, the transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision. You can request a copy of the relevant safeguards by emailing us.

8. How long we keep your data

• Selfies and photos — deleted automatically within 30 days of upload, and sooner if you delete them from your account.
• Account and reports — kept while your account is active; removed within 30 days of an account-deletion request.
• Payment and accounting records — retained for as long as required by Lithuanian tax and accounting law (generally up to 10 years).

9. Your rights

Under the GDPR you have the right to access, rectify, erase, and restrict processing of your data, the right to data portability, the right to object to processing based on legitimate interests, and the right to withdraw consent at any time. To exercise any of these, email support@facelineage.com from the address on your account. We respond within one month.

You also have the right to lodge a complaint with a supervisory authority — in Lithuania, the State Data Protection Inspectorate (vdai.lrv.lt); in Poland, the President of the Personal Data Protection Office (UODO); in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP); or the authority in your country of residence.

10. Automated decisions

Your report is generated automatically, but it does not produce legal or similarly significant effects about you within the meaning of Article 22 of the GDPR — it is an entertainment impression, not a decision about your rights, finances, or status.

11. Security

We use encryption in transit (HTTPS), encrypted storage at rest, and row-level access controls on user data. No system is perfectly secure, but we apply industry-standard safeguards and will notify you and the relevant authority of a data breach where the law requires.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect their data. If you believe a minor has provided us information, contact us and we will delete it.

13. Changes

We may update this policy from time to time. We will revise the date above and, for material changes, notify you in-app or by email.

14. Contact

Questions about this policy or your data? Email support@facelineage.com.