Scope and responsible company
Normal Vector Limited (“Normal Vector,” “we,” “us”) is responsible for the processing described in this policy. It applies to our applications, company support, and related legal pages. The services do not require a Normal Vector product account, and this policy does not treat user material as a public post or public profile.
Photos, face effects, and facial recognition
When you choose a feature that uses a photo, the services may access the image you select or capture and process it to locate or recognize a face, facial landmarks, geometry, or similar derived results. This processing supports requested face effects and related output. Depending on the chosen function, facial recognition may occur locally on your device and on our or a service provider’s server.
Only submit a photo when you have the right and lawful basis to use it, especially where another person appears in the image.
Upload choice and two-week deletion
A photo is uploaded for server-side processing when you select a function that requires remote face effects or recognition. Uploaded photos and the corresponding processing results are deleted no later than two weeks after the relevant processing. Temporary local copies remain under device and application controls.
The two-week limit applies to uploaded photos and their face-processing results; legal, security, transaction, support, and provider records have the separate retention rules described below.
Device and advertising identifiers
Relevant versions may collect identifiers and device signals including IMEI, ICCID, MAC address, and IDFA, together with device model, operating system, language, app version, IP address, network state, time zone, and diagnostic events. IMEI and MAC address may be used for advertising tracking, attribution, frequency control, fraud prevention, and measurement. IDFA use is subject to Apple’s tracking permission where that rule applies.
You can use operating-system privacy and advertising settings where available, although some legacy or device-level identifiers may not offer the same reset controls as an advertising identifier.
Interactions, diagnostics, and support
We may process feature selections, ad impressions and clicks, performance and crash events, reCAPTCHA results, and approximate event time. If you contact support, we process the email address, message, attachments, troubleshooting details, and follow-up correspondence you choose to provide. Please avoid including unnecessary sensitive information.
Named service providers and independent parties
The services may integrate the following parties in relevant releases. Their exact data access depends on the feature you use, platform, region, consent choices, and current configuration:
- Firebase — infrastructure, diagnostics, or app operations
- Google Analytics — usage and performance measurement
- Google Ads — advertising delivery, tracking, and measurement
- reCAPTCHA — abuse and automated-traffic detection
- SupportBox — customer-support communications
- OLYMPIC s.r.o. — application-related technical or operational services
Google services may be provided by the applicable Google entity. App stores also process distribution, review, transaction, and store-account data under their own policies.
Purposes and legal bases
- provide the feature you select, including local or remote face effects and recognition;
- deliver support, secure traffic, detect fraud or abuse, and diagnose failures;
- operate, analyze, improve, and understand service performance;
- serve, attribute, personalize where permitted, and measure advertising; and
- meet legal obligations and establish or defend rights.
Depending on applicable law and context, we rely on performance of a requested service, consent, legitimate interests, or legal obligations. Where consent is required, you may withdraw it prospectively.
Sharing and corporate events
We may disclose information to the named services, hosting and security vendors, professional advisers, authorities where legally required, and a buyer or successor in a merger, financing, reorganization, or sale. Providers acting for us must process information for authorized purposes; independent parties determine their own purposes under their policies. We do not make user-selected photos publicly available through a Normal Vector profile.
Retention by data category
Uploaded photos and their processing results are deleted within two weeks as stated above. Local photos and outputs remain until you delete them or clear application/device storage. Support records are kept for the request and a reasonable follow-up, security, or dispute period. Device, advertising, analytics, and fraud-prevention records are retained according to operational need, consent, legal requirements, and provider schedules. App-store records follow the store’s retention policy.
Your choices and privacy rights
You can choose whether to submit a photo, manage camera, photo-library, and tracking permissions, change applicable ad settings, clear local application data, and use the routes in our Data Deletion Guide. Depending on law, you may request access, correction, deletion, restriction, portability, objection, or withdrawal of consent, and complain to a competent authority. We may verify your request.
Security and international transfers
We apply safeguards appropriate to the type of information, including access limitations and deletion controls, but no storage or transmission is entirely secure. Normal Vector and its providers may process information in countries with different privacy rules. Where required, transfers use recognized contractual, legal, or organizational safeguards.
Age requirements
The services are intended for users aged 17 or older. Do not use the services if you are below the minimum age required to consent to the relevant processing in your location. If we learn that information was provided contrary to applicable age requirements, we will take appropriate steps, including deletion where required.
Changes and contact
We may update this policy when processing, providers, or law changes. We will change the date above and provide additional notice for material changes where required. Contact [email protected] for privacy questions or company-held requests.