Privacy Policy

FaceBaseline is operated by Remert Erasmus, a sole proprietor based in Norway. Contact: remerterasmus.work@gmail.com. We are the data controller for the personal data described below.

• Email address, when you sign in (used only for magic-link sign-in and account-related emails).
• Payment information: handled entirely by Stripe. We never see or store your full card details.
• Photos you upload: see section 3 below — handling depends on which feature you use.
• Saved reports: if you click "Save report," it's stored in your browser's local storage only. We do not store your reports on our servers, and they won't sync across devices or browsers.

• Core analysis: the facial-landmark detection that powers your report runs entirely in your browser using MediaPipe WebAssembly. Your photo is not uploaded to our servers for this step.
• Optional AI visual preview: if you choose to generate an AI visual preview (jaw, skin, or brow before/after illustration) on an unlocked report, a cropped copy of your photo is sent from your browser to our server, which forwards it to an external AI image-generation service (currently Google's Gemini image model, accessed via the Lovable AI Gateway) to generate the preview image. This only happens when you explicitly click to generate a preview. The image is used only to generate that preview and is not stored by us afterward.

• To provide the service you're paying for (contract).
• To prevent abuse and fraud, e.g., rate-limiting checkout attempts (legitimate interest).
• For the optional AI preview feature specifically, on the basis of your explicit action/consent in triggering it.

• Stripe (payment processing).
• Supabase (authentication and account infrastructure).
• Lovable's AI Gateway / Google Gemini (only if you use the optional AI visual preview feature).

We do not sell your personal data, and we do not share it with advertisers.

Some of the providers above (Stripe, Supabase, Google) may process data outside Norway/the EEA, including in the United States. Where this happens, it's covered by those providers' own safeguards (such as EU Standard Contractual Clauses).

• Your account email is kept as long as your account exists.
• We do not retain uploaded photos on our servers.
• Saved reports live only in your browser's local storage until you delete them or clear your browser data.

If you're in the EU/EEA (including Norway), you have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise these rights, contact remerterasmus.work@gmail.com. You also have the right to complain to Datatilsynet (the Norwegian Data Protection Authority) at datatilsynet.no.

This service is not directed at children and is not intended for use by anyone under 18.

We may update this policy from time to time; the "last updated" date at the top will reflect the most recent change.

remerterasmus.work@gmail.com