Legal
Privacy Policy
What personal data Facefluence collects, why, who processes it, how long we keep it, and your rights.
Draft Draft for counsel review — not yet in force.
Checking for the published version…
Effective date: 21 October 2026
1. Who we are
Facefluence (the "Service") is a web service that makes marketing content for businesses with AI. It is run by Interact / Miyabi Agency, Israeli Company No. 201510070, Israel ("we", "us").
This policy explains what personal data we process about people who use the Service for a business, visit our website, or contact us, and about people who appear in the content our clients give us.
Contact: privacy@facefluence.com
2. The laws that apply
We are an Israeli company, so Israel's Privacy Protection Law, 5741-1981, as amended — including by Amendment 13 — applies to our processing. If you are in the European Union or the European Economic Area, the General Data Protection Regulation (GDPR) also applies to your personal data, and §5 sets out our legal bases under it. If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply in the same way. This policy is also our notice to you under the Privacy Protection Law's duty to inform.
3. Our role
- For your account, billing, use of the Service, security and our own compliance records, we decide why and how the data is used — we are responsible for it (the "controller").
- For personal data inside the content a client gives us — for example staff who appear in a photo, a voice in a video, or a customer's name in a review — we process it to make that client's content, on the client's behalf (as a "processor"). The client is responsible for having the right to give it to us. We keep the testimonial records described in §4 for our own compliance.
4. What we collect
| What | For example | Where it comes from |
|---|---|---|
| Account and Members | name, email, role, language, invitations, log-in data (passwords are handled by our authentication provider and stored only in protected form) | you |
| Business details | the business's legal name, registration or VAT number, country, address, billing contact | you |
| Business profile | description, products, audience, tone, colours, logo; the business facts and taste notes the Service keeps ("What we learned about you") | you; the website or public profiles you point us to; the Service |
| Client Content | photos, videos, logos, documents and the text extracted from them, prompts, Producer chat messages | you |
| Product data | from your WordPress or WooCommerce store: product names, descriptions, prices, images and categories, and the store connection key (stored encrypted). Products only — we do not import orders or your shoppers' data. | your store, when you connect it |
| Outputs | videos, images, voice tracks, scripts, captions and their versions | the Service |
| Feedback and usage | likes and dislikes and their reasons, free-retry reasons, edits, downloads, the features you use, Credit movements | the Service |
| Testimonial records | the review text or link, the reviewer's name if you include it, and your declaration: who ticked it, when, and from which IP address or session | you; the Service |
| Payments and invoices | plan, amounts, currency, VAT and invoice details; from our payment provider, a card token, transaction reference and status and, if the provider sends them, the card's last four digits and expiry. We do not receive or store your full card number. | you; Takbull |
| Technical data | IP address, browser and device, log-in times, error and security logs, cookies (§11) | your device; the Service |
| Activity records | what you and your Members do in the Service (for example creating, editing, approving and downloading videos), and every request made to our API for your Workspace, including requests by an app or AI agent you connect: who made it, which app or agent, what it did, when and from which IP address | the Service |
| Legal acceptances | which version of which document you accepted, when, in what context (for example signing up or connecting a store), the text shown, your IP address and browser | the Service |
| Communications | support messages, the service emails, in-app notices and push notifications we send you and whether they were delivered, abuse reports | you; the Service |
| Support assistant | your conversations with our support assistant (an AI), the page you were on, and the tickets it opens for our team — including the email address you give it if you are not signed in. Do not send passwords or card numbers in the chat. | you; the Service |
| Push notifications | if you turn them on, the address your browser gives us to deliver them (an endpoint and keys) and your device type | your browser |
| Launch and newsletter sign-ups | your email, language, whether you agreed to marketing emails, the exact wording you agreed to, when, IP address and browser | you |
People who appear in Client Content. If a client uploads a photo or video that shows a person, or a review that includes a customer's name, we receive that person's image, voice or name. We use it only to make that client's content and for the checks described in §5. We do not use it to identify anyone: no face recognition runs on uploads, and no face templates are made from them.
What you have to give us. You are not under a legal duty to give us personal data. But we need account, business and billing details to provide the Service and to issue the tax invoices the law requires; without them we cannot provide it. Everything else is up to you.
5. Why we use it, and our legal bases
| Purpose | Data used | Legal basis under the GDPR |
|---|---|---|
| Providing the Service: accounts, making and delivering Outputs, the Producer and Autopilot, learning your preferences inside your Workspace, support | account, business, business profile, Client Content, product data, Outputs, feedback | performance of a contract (Art. 6(1)(b)) where you are the contracting party, for example a sole trader; otherwise our legitimate interest, and your business's, in providing the Service the business signed up for (Art. 6(1)(f)) |
| Payments, tax invoices and accounting | business details, payments and invoices | legal obligation (Art. 6(1)(c)); contract |
| Safety and content checks, enforcing our Terms and Acceptable Use Policy, keeping testimonial records, preventing fraud and abuse, securing the Service, and defending legal claims | Client Content, Outputs, testimonial records, technical data | our legitimate interests in keeping the Service lawful and safe (Art. 6(1)(f)); legal obligation where one applies |
| Improving the Service with aggregated, de-identified statistics (for example which formats are liked in which kinds of business) | feedback and usage | legitimate interests (Art. 6(1)(f)) |
| Service emails — for example "your videos are ready", low Credits, receipts, failed payments, security notices | account | contract; legitimate interests |
| Telling you about changes to our terms and policies, asking for your acceptance, and keeping the record of notices and acceptances as evidence | account, legal acceptances, communications | contract; legal obligation; our legitimate interest in being able to prove the agreement (Art. 6(1)(f)) |
| Answering support questions with an AI assistant, and handing them to a person | support conversations, account and Workspace data the assistant looks up for you | contract; legitimate interests (Art. 6(1)(f)) |
| Marketing emails about our products | name, email | your consent, or as the law otherwise allows; you can unsubscribe at any time |
| Complying with the law and responding to lawful requests from authorities | as needed | legal obligation |
We do not sell personal data. We may use Client Content to train and improve our own AI models unless the client asks us not to (privacy@facefluence.com); personal data of people shown in Client Content is never used for that.
Automated checks. The Service runs automated checks that can hold or block content (see our Acceptable Use Policy §4). A decision to suspend or close an account is taken by a person, and you can ask a person to review any decision.
6. Who we share it with
- Our providers (sub-processors), who run parts of the Service for us under contract and receive only what their task needs (§7).
- Our payment provider (Takbull), which processes payments and issues our tax invoices and receipts.
- The Israel Tax Authority, where an invoice needs an allocation number: the invoicing system reports the invoice's details to it, as the law requires.
- Other Members of your Workspace, who can see the Workspace's content according to their role.
- Your connected store: when you connect WordPress or WooCommerce, the Service connects to your site using the key you give it.
- Professional advisers — lawyers, accountants and auditors — who are bound by confidentiality.
- Authorities, where the law requires it or to protect people (Acceptable Use Policy §4.5).
- A buyer or successor, if the Service or our business is sold or reorganised; this policy will continue to apply to your data.
7. Our providers (sub-processors)
| Provider | What it does for the Service | Data it receives | Where |
|---|---|---|---|
| Hetzner | servers that run the website, the app, the API and background jobs | the data the Service processes passes through these servers | Germany (EU) |
| Cloudflare | domain name service, content delivery and protection against attacks (firewall, rate limits, bot checks) | IP address, browser and request data; the pages and files it delivers | worldwide network (a United States company) |
| Supabase | database, log-in and file storage | account and Member data, business data, Client Content, Outputs, records | United Kingdom (London) |
| Vast.ai | rented GPU servers that render videos and images in batches | for each render: the script, voice tracks, the Character's reference images, and the photos, footage or other Client Content the render uses | worldwide: the servers are run by hosts in different countries through the Vast.ai marketplace |
| Civitai | instant image generation — previews, candidate presenter portraits, images on demand | text prompts and reference images, such as product photos | United States |
| ElevenLabs | voice generation | the text to be spoken and voice settings | United States |
| OpenRouter | the gateway through which we reach the language models below: it passes each request to the model's provider and returns the answer | the same data as the model it is sent to (below) | United States |
| OpenAI (GPT), through OpenRouter | scripts, the Producer chat, content planning, automated checks, and publishing kits (titles, captions, hashtags and alt text) | your Producer messages and prompts, business profile, product data and scripts and images sent for automated checks; for publishing kits, the project's brief, title and business name | United States; under its commercial terms the provider does not train on API data |
| Anthropic (Claude), through OpenRouter | the support assistant | your support messages and what the assistant looks up for you (plan, Credits, recent renders) | United States; under its commercial terms the provider does not train on API data |
| Takbull | payments, saved-card tokens, tax invoices and receipts | business and billing details, the card details you enter on its payment page, transaction data | Israel |
| Maileroo | account and service emails, including notices of changes to our terms; it also receives email sent to our addresses (support@, legal@ …) and forwards it to us | name, email address, the content of the emails | European Union (servers in Germany); the company is in Australia |
| Browser push services (Google, Apple, Mozilla, Microsoft) | delivering push notifications, only if you turn them on | the notification's title and text, sent encrypted to your browser's push address | worldwide |
A rented GPU server is used for one batch of jobs and is destroyed when the batch ends; the Outputs go straight to our storage. We will update this list before we add or replace a provider, and tell Workspace owners about material changes by email at least 30 days in advance.
8. Transfers abroad
Our application servers are in the European Union, and our database and file storage are in the United Kingdom (London). Some providers process data in other countries (mainly the United States), and renders run on GPU servers in whichever country their host is located. When personal data is transferred out of Israel, or out of the EU/EEA, we rely on the safeguards the law allows: adequacy decisions (the European Commission recognises Israel and the United Kingdom), the Commission's standard contractual clauses, or the EU–US Data Privacy Framework where the provider is certified.
9. How long we keep it
| Data | How long |
|---|---|
| Account and Member data | while the account is open, and then we delete or anonymise it within 30 days, except what the rows below keep longer |
| Business profile, Client Content and product data | until you delete it, or 30 days after the account closes |
| Outputs | until you delete them, or 30 days after the account closes (see Terms of Service §17.5) |
| Producer chat, scripts, feedback and taste profile | while the account is open, and 30 days after it closes |
| Testimonial records | 7 years after the ad that used it last ran (see the Testimonial Declaration §5) |
| Payment and invoice records | 7 years, as Israeli tax and accounting law requires |
| Technical and security logs | 90 days |
| Activity records | detailed API request records for 90 days, then totals; the activity log for 7 years |
| Legal acceptances, and the notices we sent about each version | for as long as the accepted version can matter to a claim, also after the account closes: 7 years after it closes |
| Support conversations and tickets | 12 months after the last message |
| Launch and newsletter sign-ups | until you unsubscribe or ask us to delete them; the consent record itself for 7 years after you unsubscribe |
| Push addresses | until you turn push off, or your browser tells us the address is no longer valid |
| Abuse reports and enforcement records | 7 years |
| Backups | deleted data leaves our backups within 30 days |
We may keep data for longer where the law requires it or where we need it for a legal claim. Our providers keep the data they receive for the time their terms with us allow.
10. Security
We protect personal data with technical and organisational measures, including: keeping each Workspace's data separate and checking every request against it; keeping files in private storage that is reached only through short-lived links; encrypting store connection keys; limiting staff access to those who need it; and keeping a log of key actions, such as who approved, retried, downloaded or paid for what. Data is encrypted in transit and at rest. No system is completely secure. If a security incident affects your personal data, we will notify you and the authorities as the law requires.
11. Cookies
We use cookies and similar technologies that are needed to log you in and to keep the Service secure: a session token that keeps you logged in, kept in your browser's storage, and your language and theme settings. If we add analytics or marketing cookies, we will ask for your consent first where the law requires it.
Our forms use Cloudflare Turnstile, a check that tells people from bots; it runs in your browser when you use a form (sign-up, log-in, password reset, email sign-ups) and sends Cloudflare technical signals about your browser, not your form entries. The emails we send carry no tracking pixels and no rewritten links: we do not record whether you opened an email or clicked in it.
12. Your rights
Under Israeli law you may ask to see the personal data about you that we hold, and ask us to correct or delete it if it is not correct, complete, clear or up to date. You may also ask us at any time to stop sending you marketing.
If the GDPR applies to you, you may also ask: for a copy of your data, and to receive it in a portable format; for it to be erased; for its use to be restricted; and you may object to any use based on our legitimate interests. Where we rely on your consent, you may withdraw it at any time; this does not affect what was done before.
How to use your rights. You can do much of this yourself in the app: edit your profile and business details, remove Members, download a copy of your data, and close your account. For anything else, write to privacy@facefluence.com. We may need to confirm your identity first. We will reply within the time the law requires.
If you appear in a client's content — for example in a business's video, or because your review was used — please contact that business first. We will help it respond, or pass your request on to it.
Complaints. You can complain to Israel's Privacy Protection Authority or, in the EU/EEA, to your data protection authority. We would welcome the chance to put things right first.
13. Children
The Service is for businesses and their staff aged 18 or over. We do not knowingly collect personal data about children. Content that shows minors is not allowed on the Service (Acceptable Use Policy §1.2).
14. Changes to this policy
When we change this policy we publish the new version here with its date; earlier versions stay readable. Before a material change takes effect we tell every user by email and in the Service (and by push where you turned it on), and, where the change needs your agreement, we ask you to accept it in the Service before you continue (Terms of Service §22).
15. Contact
privacy@facefluence.com · Interact / Miyabi Agency, Israel
Questions about this document: legal@facefluence.com