Privacy.

What we process

• Your photo — processed to create the avatar, moderated for safety, kept encrypted only during your review window, then deleted: when you approve the avatar, when you delete it, or after 14 days. Our storage also removes it on its own within 16 days of upload, and deleted copies are purged by our storage provider within a further 7 days. It is never used to train models.
• Your avatar — the stylized portrait and expression assets, stored and served until you delete them.
• Where your avatar is embedded — when a page loads your avatar, we count the load against that site’s hostname (for example shop.example), per day, so you can see where it runs. Never the page address, and nothing about the person viewing it. Deleted with the avatar.
• Account and usage data — your email address (to sign you in, and to tell you when an AI assistant connects to your account, with a link to revoke it), hashed API keys, credit balance, and operational logs (which never contain your images).
• Anonymous statistics — daily counters of product usage (for example, how many avatars were created from a camera capture versus an upload, and which consent declaration was chosen). These contain no names, emails, images or identifiers of any kind.

Why, and on what basis

We process the photo and avatar to provide the service you asked for (contract), with the recorded consent attestation for the person depicted. Safety moderation and abuse prevention are legitimate interests. We don't sell personal data, and we don't use your content for advertising.

Who helps us run it

Google Cloud hosts the service and storage; Google's Gemini models perform generation and safety moderation; Stripe handles payments; an optional voice preview uses OpenAI; RevealWhy provides site analytics, only if you accept it. Each receives only what its role requires.

Site analytics

If you accept the analytics prompt, rosto.ai and the Console use RevealWhy to record how pages are used (pages visited, clicks, scrolling and a masked session replay) so we can find what is confusing. Nothing is loaded or sent until you accept, and declining changes nothing about the service. Every form field is masked, and emails, phone numbers and similar identifiers are scrubbed, before anything leaves your browser. In the Console it runs only on the billing page: never where you take or upload a photo or view your avatar, never where an API key or sign-in code is shown, never inside the avatar runtime embedded on other sites, and it never sees your photos or faces. We record which form or button was used and whether it worked, never what you typed. Your choice is stored in your browser (local storage, mirrored in a first-party cookie). Withdraw or change it any time with the button below, or by clearing this site's data in your browser, which brings the prompt back.

Your rights

Access, correction, deletion and portability: delete your avatar in the Console or API (removal is immediate and total, including cached copies). Download a copy of your data, or delete your whole account, yourself on the Console’s Account page. Deleting the account keeps only the consent records the law requires and, at most, one keyed marker (an HMAC of your account id under a server secret, never your email) so the free tier is not granted twice. EU/EEA residents have the rights in the GDPR; we honor them for everyone. Requests: privacy@rosto.ai.