zpic

Biometric Information Privacy Policy

Last updated

Biometric Information Privacy Policy

LAST UPDATED: OCTOBER 2026

OPERATED BY: zPic LLC

zPic LLC ("zPic", "we", "us", or "our") cares about the privacy and security of your Biometric Information. This Biometric Information Privacy Policy (the "Biometric Policy") describes how we collect, use, retain, disclose, and protect Biometric Information contained in the media you upload or generate, and the controls you have over it. It supplements our Privacy Policy and Terms of Use (together with this Biometric Policy, the "Agreements"). Capitalized terms not defined here have the meaning given in those documents.

By uploading or importing media that depicts a person, you consent to the collection, use, and disclosure of Biometric Information as described in this Biometric Policy, subject to the rights and protections below.

We do not sell, lease, trade, or otherwise profit from Biometric Information. We process Biometric Information solely to provide the generation and editing services you request.

1. Key Definitions

  1. Biometric Information means data that depicts or describes the physical, biological, or behavioral characteristics of an identified or identifiable person, and data derived from it to the extent the person could reasonably be identified from that data. It includes images, video, and audio of a person's face, body, or voice, and any templates, embeddings, measurements, or other representations derived from them. Both a photograph of a face and a numerical representation of that face derived from the photograph are Biometric Information. Definitions vary between laws; we apply this broad definition throughout.
  2. User Content means everything you upload, import, or generate through the Services: uploaded images, video, and audio; media imported from a URL you supply; prompts and settings; and Generated Outputs. User Content may contain Biometric Information whenever it depicts a person.
  3. Services means the zpic website and studio.

2. What We Collect and Why

  1. What we collect. We collect Biometric Information only when you voluntarily upload or import media that depicts a person, or when a Generated Output depicts a person. We store the media itself in your account library. We do not build or maintain a separate database of facial templates, faceprints, voiceprints, or other biometric identifiers, and we do not use Biometric Information to identify, authenticate, or track anyone.
  2. Service delivery. We process Biometric Information to render the generation and editing requests you make, including transmitting your media to the third-party AI model providers that run our models (see Section 3), and to store the results in your library so you can view, download, and manage them.
  3. Safety and compliance. We may process Biometric Information to detect prohibited content, prevent abuse, respond to security incidents, comply with legal obligations, and enforce the Agreements, as described in our Privacy Policy.
  4. What we do not do. We do not sell Biometric Information. We do not use it for marketing or promotion without your separate, express written consent. We do not use your private uploads or outputs to train AI models unless you explicitly opt in. We do not share Biometric Information with third parties except as needed to provide the Services or as required by law.

3. Third-Party AI Model Providers

  1. How processing works. When you generate or edit media, your User Content, including any Biometric Information it contains, is transmitted to third-party AI model providers that run the models behind the Services. They process the content and return the result to us. The providers we use may change as we add models and features.
  2. Contractual protections. We engage providers under data processing terms that require them to use your content only to perform the processing we request and not for their own purposes, including training their own models; to protect it with appropriate security measures; to comply with applicable data protection laws; to keep it confidential; and to delete it when the processing is complete or on our request.
  3. Acknowledgment. We cannot directly control a third party's systems. By using the Services you acknowledge that your User Content will be processed by these providers and consent to that processing as necessary to deliver the Services.

4. Consent

  1. Just-in-time consent. Before your first upload or URL import, the studio presents a disclosure and asks for your agreement. It tells you that your media may contain Biometric Information, how we and our providers process it, how long we keep it, and how to withdraw. Proceeding after that disclosure is your express, informed, written consent to the processing described in this Biometric Policy.
  2. Consent record. We keep a record of your consent consisting of your account identifier, the time of consent, and the version of the consent statement you accepted.
  3. Ongoing consent. Each later upload, import, or generation involving a depicted person is a further instance of that consent for that content. You may withdraw at any time as described in Section 6.
  4. Other people in your media. You are responsible for obtaining the consent of every person depicted in media you upload or import, including their consent to biometric processing, as set out in the Terms of Use. We do not accept media depicting anyone under 18.

5. Retention and Destruction Schedule

This section is our publicly available written policy for the retention and permanent destruction of Biometric Information, including biometric identifiers and biometric information as defined by the Illinois Biometric Information Privacy Act, 740 ILCS 14, and similar laws.

  1. Scope. This schedule applies to all Biometric Information held through the Services: uploaded and imported media depicting people, Generated Outputs depicting people, and any derived representations held by us or by a provider on our behalf.
  2. When we delete. We permanently destroy Biometric Information at the earliest of:
    • when the purpose for which it was collected is satisfied (Section 5.3);
    • 90 days after your account was last active, as set out in our Privacy Policy; or
    • in all cases, within three (3) years of your last interaction with zPic.
  3. Purpose satisfied means any of: you delete the media from your library; you delete your account; or we discontinue the feature for which the media was collected. Deletion is completed within thirty (30) days of the triggering event.
  4. Last interaction means the most recent time you signed in, uploaded or imported media, generated content, viewed or downloaded content in your library, or contacted support about your account.
  5. How we destroy. We delete all copies from our production storage and databases, including derived data and metadata, using methods that make the data unrecoverable. Backups are purged within [Placeholder: backup retention window, e.g. 90 days] of the applicable deadline. We instruct each provider that processed the content to delete it under our agreements with them.
  6. Exceptions. We retain Biometric Information beyond this schedule only where the law requires it, where it is reasonably necessary for actual or anticipated legal proceedings, or where it is needed for an active fraud or security investigation. Once the exception ends, we destroy the information within thirty (30) days.
  7. Third-party requirements. Any third party that processes Biometric Information for us must protect it with at least the standard of care we apply to our own confidential information, process it only for our purposes, comply with applicable biometric privacy law, and delete or return it when the purpose is satisfied or on our request.

6. Withdrawing Consent and Deleting Biometric Information

You may withdraw consent and delete Biometric Information at any time:

  1. Delete specific media. Open your Library, select the media, and delete it. The media and any derived data are permanently deleted within thirty (30) days.
  2. Delete your account. Open your profile menu, choose Manage account, then Delete account. Your account, all User Content, and all Biometric Information are permanently deleted within thirty (30) days.
  3. Email us. Write to support@zpic.ai from your account email, stating what you want deleted. We will verify your identity and complete the request within thirty (30) days.

Withdrawal stops further processing and triggers destruction under Section 5. It does not affect processing that took place before withdrawal, information under a legal hold, or information that has been irreversibly anonymized.

7. Security

We protect Biometric Information with the same or a greater standard of care than we apply to other confidential and sensitive personal information. That includes encryption in transit and at rest, access controls that limit staff access to those with a legitimate need, logging of access to systems that hold your content, contractual security obligations on our providers, and documented incident response procedures. If a breach affects Biometric Information, we will notify affected individuals and regulators as applicable law requires.

8. Region-Specific Disclosures

  1. No sale. We will not sell, lease, trade, or otherwise profit from Biometric Information of any user, in any jurisdiction, even with consent.
  2. Illinois residents. This Biometric Policy and our Privacy Policy are the written notice required by BIPA. It states what we collect (Section 2), the specific purposes (Sections 2 and 3), and the retention and destruction schedule (Section 5). We obtain your written consent through the just-in-time flow described in Section 4 before any collection. You may withdraw consent and request destruction under Section 6.
  3. California residents. Biometric Information is sensitive personal information under the CCPA/CPRA. You have the right to know, delete, and correct it, to opt out of its sale or sharing (we do none), and to limit its use to what is necessary to provide the Services (which is our practice). Exercise these rights through Section 6 or the contact details in Section 11.
  4. Other U.S. states. Residents of states with comprehensive privacy laws have rights over Biometric Information as sensitive data under those laws. See Section 6 of our Privacy Policy.
  5. EU and UK residents. Biometric data processed to identify a person is special category data under GDPR Article 9. We rely on your explicit consent, obtained as described in Section 4. You may withdraw consent, and request access, erasure, rectification, portability, restriction, or object to processing, and you may lodge a complaint with your supervisory authority. See Section 6 of our Privacy Policy.

9. Future Uses

  1. Model training. We do not use your private User Content to train AI models unless you explicitly opt in. If we ever propose to, we will update this Biometric Policy and our Privacy Policy, notify you in advance, give you a control to opt out before any such use begins, and obtain any further consent the law requires.
  2. Marketing. We will not use User Content containing Biometric Information in marketing or promotion without contacting you to request a specific license describing the content and the use. You may refuse without any effect on your use of the Services.

10. No Discrimination

We will not deny you the Services, charge different prices, provide a different level of service, or retaliate against you for exercising any right described in this Biometric Policy.

11. Contact

  • Company: zPic LLC
  • Email: support@zpic.ai (for all biometric privacy, BIPA, CCPA, and GDPR inquiries)
  • Mailing address: [Placeholder: registered mailing address.]

12. Changes to This Biometric Policy

We may update this Biometric Policy as the Services, our practices, or the law change. We will revise the "Last updated" date above, post the new version here, and notify you of material changes by email or a prominent notice in the Services. Material changes, such as new purposes, new retention periods, new third-party sharing, model training, or marketing use, may require fresh consent before they apply to you. If you do not agree to an updated Biometric Policy, stop using the Services and request deletion under Section 6.

13. Relationship to Other Policies

This Biometric Policy should be read together with our Privacy Policy and Terms of Use. If this Biometric Policy conflicts with the Privacy Policy, the provision more protective of you applies. If it conflicts with applicable law, the law controls.