Privacy Policy

Last updated: 13 November 2025

This Privacy Policy explains how insertFace.com (the "Website", "we", "us", or "our") collects, uses, stores, shares, and protects personal information of visitors and users worldwide, including users in the European Union (GDPR), the United Kingdom, California (CCPA/CPRA), and India.

1. Controller / Owner

Owner: Kareti Rama Krishna
Address: Singarayakonda, Prakasam, Andhra Pradesh, India
Email (data & privacy contact): insertface.com@gmail.com

2. Scope and Acceptance

By using or accessing the Website you accept this Privacy Policy. If you do not agree, please do not use the Website. This policy applies to all users and visitors including registered and unregistered users.

3. What information we collect

3.1 Account information (registered users)

• Email address
• Full name
• OAuth provider user ID (Google or Facebook) for social sign-in
• Hashed password (for email registration only)

3.2 Uploaded and generated images

Users may upload images (for face-swap or AI processing) and generate new images. We:

• Strip EXIF/metadata automatically before upload.
• Store uploaded and generated images and related processing history only for 24 hours and then permanently delete them.
• Do not store face embeddings, biometric templates, or training data for long term.

3.3 Payments

Payments are processed by PayPal. We do not store payment card or payment account details on our servers. After PayPal confirms payment, the user is allowed to download the purchased HD image. We may receive and temporarily use the buyer's email or name that PayPal provides to deliver the product, but we do not keep payment details or payment logs on our servers.

3.4 Technical & infrastructure data

We do not store users' real IP addresses in our server logs. We use Cloudflare (free plan) as an orange-cloud proxy: Cloudflare handles traffic routing and DDoS protection and may process request metadata and country-level geolocation. Cloudflare masks the real user IP from our origin server in the current configuration.

3.5 What we do NOT collect

• We do not collect or use analytics/tracking services (no Google Analytics, no Meta Pixel, no advertising tracking).
• We do not sell personal data to third parties.

4. How we use your information

We process personal information only for limited purposes:

• To create and manage user accounts and authentication.
• To allow uploading, AI processing, and downloading of images.
• To deliver purchased images after PayPal payments.
• To send transactional emails (purchase delivery emails, password reset emails).
• To protect the Website, prevent abuse, and enforce Terms of Service (legitimate interests).

5. Legal bases (for EU / GDPR)

When processing personal data of EU/EEA/UK users, our legal bases include:

• Performance of a contract – when you purchase or request a service.
• Consent – for user uploads where explicit consent is required (you confirm consent at upload).
• Legitimate interests – for security, abuse prevention, and essential site functionality.

6. Cookies and sessions

No analytics or advertising cookies. We use essential session cookies:

• Unregistered users: temporary essential session cookies (browser-session lifetime).
• Registered users: long-duration session cookies used to maintain login state (may last up to 1 year).

Registered users are required to accept the Privacy Policy, Terms of Service, and Cookies Policy during registration.

For details on cookies, see our Cookies Policy.

7. Sharing and disclosure

We do not sell personal data. We share personal information only with:

• Cloudflare – for security, CDN, and proxy services. Cloudflare may process traffic in different jurisdictions.
• PayPal – to process payments when you choose PayPal.
• OAuth providers (Google, Facebook) – only when you sign in via those services.
• Law enforcement, regulators, or other parties where required by law or to enforce our Terms of Service.

8. Data retention

• Uploaded images and generated images: retained for 24 hours then permanently deleted.
• Temporary processing history: deleted after 24 hours.
• Account information (email, name, OAuth ID, hashed password): retained until the user requests deletion.
• No payment information or payment logs are stored by us after purchase completion.

9. International transfers

The Website is hosted in the United States. Cloudflare may process or route traffic through servers in various countries. By using the Website, you acknowledge that personal data may be transferred to, processed, or stored in countries outside your own jurisdiction. We take reasonable steps to ensure appropriate safeguards for such transfers.

10. Security

We implement reasonable technical and organizational measures to protect personal information. Measures include:

• Hashing of account passwords
• Automatic removal of user-uploaded content within 24 hours
• HTTPS enforced
• Cloudflare layer for DDoS and basic protection

No system is completely secure—if you believe your account has been compromised contact us immediately at insertface.com@gmail.com.

11. Your rights

Depending on your jurisdiction, you may have rights such as:

• Access to your personal data
• Correction of inaccurate data
• Deletion of your data (including account deletion)
• Restriction or objection to processing
• Data portability
• Withdrawal of consent where applicable

To exercise any right, contact us at insertface.com@gmail.com. We will respond within 30 days or sooner where required by law.

12. Children

The Website is intended for users aged 13 and older. We do not knowingly collect or retain information from children under 13. If you believe we have collected data about a child under 13, please contact us and we will promptly delete the data.

13. India-specific information and grievance officer

We comply with applicable Indian law including the Information Technology Act, 2000 and related rules to the extent applicable. If you are an India resident and have a privacy grievance, please contact our designated grievance officer:

We will acknowledge and respond to grievance requests as required under applicable Indian law and will cooperate with Indian authorities where required by law.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post any changes on this page with an updated "Last updated" date. Continued use of the Website after changes constitutes acceptance of the updated policy.

15. Contact

For privacy questions, data access requests, deletion requests, or other privacy concerns, contact:

Kareti Rama Krishna
Kareti Vari street,
Singarayakonda,
Prakasam District,
Andhra Pradesh,
India, 523101
Email: insertface.com@gmail.com

This Privacy Policy is intended to provide clear information about how insertFace.com handles personal information. This is not legal advice; if you need binding legal guidance for a particular jurisdiction, consult a qualified lawyer.