Privacy Policy

FacePing

Last updated: 30 July 2026 Effective: 30 July 2026

1. About this policy

FacePing Ltd ("FacePing", "we", "us", "our") is the data controller for personal data we process in connection with the FacePing platform — the website at faceping.dev, our iOS and Android applications, our APIs, our embeddable players, and all related services (together, the "Service").

This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, how long we keep it, and the rights you have over it. It is written to satisfy the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), the ICO's Age Appropriate Design Code, and applicable EU and international data protection laws.

We are committed to handling your personal data lawfully, fairly and transparently.

Our details

• Company: FacePing Ltd
• Registered in: England and Wales
• Company number: 17204155
• Registered office: 66 Paul Street, London, England, EC2A 4NA
• Email for data protection enquiries: info@faceping.dev
• Data protection contact: info@faceping.dev

2. Summary at a glance

• FacePing is a video-first communication and commerce platform. We collect what's needed to let you create videos, send video messages, run channels, discover and transact through marketplace verticals, participate in Brand Campaigns, and use AI features.
• We collect the personal data you give us when you sign up and use the Service (including your date of birth), plus data generated automatically as you use the Service, plus data from third parties (payment processor, login providers, voice telephony).
• We share data with the service providers needed to run FacePing (listed in Section 8), with other users where the Service is inherently public (e.g. profile, posts, channels), and with authorities where required by law. We do not sell your personal data.
• AI processing happens in the Service (transcription, summarisation, voice handling for Call AI, matching, AI Studio). See Section 7.
• You have rights under UK GDPR including access, rectification, erasure, portability and objection. See Section 11.
• The Service is for users aged 13 and over. Users under 18 receive additional default protections in line with the ICO's Age Appropriate Design Code. See Section 12.

3. Who this policy applies to

This policy applies to everyone who interacts with the Service, in any role. The most common roles are:

• Creators — Users who record and publish videos, video messages and other Content
• Viewers — Users (and visitors) who consume Content, including by visiting public video pages or embedded players
• Channel Operators — Users or businesses operating a Channel
• Subscribers — Users who follow a Channel
• Buyers — Users who book, purchase or request through the marketplace verticals
• Providers / Sellers — Users who offer services through the marketplace verticals
• Advertisers — Users or businesses commissioning Content through Brand Campaigns
• Callers — anyone who calls or is called by a number connected to a Call AI agent
• Visitors — anyone visiting our marketing pages or public Content without an account

This policy also applies to Minors (Users aged 13–17). Where we know a User is a Minor, additional protections in Section 12 apply.

Where this policy refers to "you", it refers to whichever of the above categories applies in context.

4. Personal data we collect

4.1 Information you provide directly

4.2 Information collected automatically

4.3 Information we receive from third parties

4.4 Special category data

We do not intentionally collect special category data (such as data revealing racial or ethnic origin, religious beliefs, health, sexual orientation, or biometric data used for identification). However, you may choose to include such information in Content you post (for example, a video that discusses your health, beliefs or background). By making such Content public on the Service, you are choosing to make that information public.

5. How and why we use your personal data — lawful basis

Under UK GDPR we may only process personal data where we have a lawful basis. The table below sets out our purposes and the lawful basis we rely on for each.

You may object to our processing based on legitimate interests at any time (see Section 11). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.

6. Marketing communications

We will only send you marketing emails where:

• You have given consent; or
• You are an existing customer and the marketing is about similar services, and you did not opt out at the point of collection.

We do not send marketing communications to Users under 18. Every marketing message contains an unsubscribe link, and you can update your marketing preferences from your account settings at any time. Transactional and service-related messages (security alerts, booking confirmations, payment receipts, account notices, new-message alerts, Channel notifications you have subscribed to) are not marketing and are not opt-out, except by closing your account or unsubscribing from the relevant Channel.

7. Automated decision-making and AI

The Service uses automated processing and AI in several places. None of these features produce decisions that have legal or similarly significant effects on you within the meaning of UK GDPR Article 22 without human input. The principal AI and automated features are:

• Matching and recommendation engine — uses your location, follow / subscribe graph, watch history, search history and stated preferences to surface relevant Content, Channels, services, requests and Campaigns. For Users under 18, behavioural profiling is reduced or disabled by default.
• Video transcription — audio from your videos and Video Messages is automatically transcribed (currently using OpenAI Whisper).
• Chapter and summary generation — transcripts are summarised into chapters and key moments (currently using Anthropic Claude).
• AI Studio — assistive features for creating Content, where you actively submit input to AI tools. Additional content filters apply to inputs and outputs for Users under 18.
• Call AI — inbound calls to numbers connected to FacePing are handled by an AI voice agent (currently using ElevenLabs voice + Twilio telephony). Callers are informed where required and recordings are retained subject to Section 10.
• Virtual try-on (Swap) — when you choose to try on a garment, we send the reference photo you have selected, together with the product's image, to an AI image-processing provider (currently fal, running the FASHN try-on model), which generates an image of you wearing that garment and returns it to us. We process only the photo you select for that try-on. The result is saved to your account (My Swaps) and you can delete it at any time. We do not use your try-on photos to identify you, and we do not perform facial recognition or biometric matching — the photos are used only to generate the try-on images you request.
• Content moderation — automated screening to detect Content that may violate our policies or applicable law, including child-safety screening. Final decisions involve human review where the outcome is material.

You can request human review of any automated outcome that materially affects you by emailing info@faceping.dev.

8. Who we share your personal data with

8.1 Other users and the public

Much of the Service is inherently public or semi-public for Users aged 18 or over. The following information may be visible to other Users and, in some cases, to anyone on the internet (including via search engines):

• Your profile (handle, name, photo, bio, public posts)
• Public video Content you post, including videos embedded on third-party sites
• Channels you operate, and Content you publish on them (visible to Subscribers, and to the public for public Channels)
• Services and requests you post in marketplace verticals
• Reviews and Show Offs you give or receive
• Quotes and briefs exchanged in Bookings and Brand Campaigns

For Users under 18, higher-privacy defaults apply: profiles and Content are not public by default, contact from Users they do not already follow is limited, and Content is not indexed for public search by default. See Section 12.

Direct Messages and Video Messages sent privately are visible only to participants in the conversation. We do not routinely read or moderate Direct Messages — see the Terms of Service, Section 10.

We do not display imported contact data (including hashes) to other Users. Contacts data is used only to identify mutual users for friend-finding within the Service.

8.2 Service providers (sub-processors)

We use the following sub-processors to operate the Service. Each is bound by a written data processing agreement and processes personal data only on our documented instructions.

We may update this list from time to time. The current version of this policy at the page above always reflects our then-current sub-processors.

8.3 Other recipients

• Authorities and regulators: where required by law, court order or to defend or assert our legal rights — including HMRC for tax and Platform Operator reporting, and child-safety authorities where relevant.
• Professional advisers: legal, accounting and audit advisers, under duties of confidence.
• Acquirers and successors: in the context of any merger, acquisition, financing or restructuring.
• With your consent: any other recipient where you have specifically consented.

We do not sell your personal data.

9. International transfers

Many of our sub-processors are located in, or process data in, countries outside the UK and EEA — principally the United States. Where we transfer personal data outside the UK or EEA we rely on one or more of the following:

• UK adequacy regulations (for transfers to the EEA);
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission's Standard Contractual Clauses;
• Other safeguards specifically permitted under UK GDPR.

You can request a copy of the safeguards relevant to any particular transfer by emailing info@faceping.dev.

10. How long we keep your personal data

We keep personal data only as long as we need it for the purposes set out in this policy or to meet legal, accounting, tax or regulatory requirements. Indicative retention periods:

Where we anonymise data so that it can no longer be associated with you, we may retain it indefinitely.

11. Your rights

Under UK GDPR you have the following rights in relation to your personal data. Exercising them is free of charge in most cases.

• Right of access — to obtain a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate personal data corrected and incomplete data completed.
• Right to erasure ("right to be forgotten") — in certain circumstances, to have your personal data deleted.
• Right to restrict processing — in certain circumstances, to limit how we use your data.
• Right to data portability — to receive certain personal data in a structured, machine-readable format and to transmit it to another controller.
• Right to object — to processing based on our legitimate interests, including profiling, and to direct marketing at any time.
• Right to withdraw consent — where we rely on consent, you may withdraw it at any time.
• Right not to be subject to solely automated decisions that have legal or similarly significant effects.

To exercise any of these rights, email info@faceping.dev. We will respond within one month. We may need to verify your identity before responding.

If you are unhappy with how we handle your personal data, you have the right to complain to the UK Information Commissioner's Office:

• Website: ico.org.uk
• Helpline: 0303 123 1113

We would, however, appreciate the chance to address your concerns before you approach the ICO.

12. Children and Minors

12.1 Minimum age

The Service is intended for users aged 13 or over. This minimum corresponds to UK GDPR Article 8, which sets 13 as the age at which a child can consent on their own to information society services.

We do not knowingly collect personal data from anyone under 13. If we discover we have collected such data, we will delete it and close the account. If you believe a child under 13 has provided us with personal data, please contact info@faceping.dev.

12.2 Additional protections for Minors (13–17)

Where we know a User is a Minor, we apply default settings and processing limits designed to meet the standards of the ICO's Age Appropriate Design Code, including:

• Higher-privacy defaults on profile, Content visibility and discoverability;
• Restricted direct contact — Direct Messages from Users a Minor does not already follow or subscribe to are limited or blocked by default. Contacts import is disabled by default for Users under 18;
• No marketing communications;
• Reduced behavioural profiling and personalisation by default;
• Precise geolocation off by default and not used to make Content publicly discoverable to strangers;
• Additional AI content filters on AI Studio and Call AI inputs and outputs;
• No access to monetisation features (payouts, paid Subscriptions, monetised Channels, paid Brand Campaigns) until age 18;
• Conservative default audience for new Content posted;
• Clear, age-appropriate transparency in account and privacy controls.

Some of these defaults can be adjusted by the Minor in settings; some defaults are not adjustable while the User is under 18.

12.3 Age assurance

We rely on the date of birth you provide at signup, supplemented by signals from your activity on the Service, to apply the correct age tier. We may ask for additional verification (for example, when you apply to receive payouts or to unlock features with a higher age threshold) before granting access.

12.4 Parents and guardians

If you are a parent or guardian and have concerns about your child's use of the Service, please contact info@faceping.dev. We will respond as quickly as we can. You also have the right to make a complaint to the ICO (see Section 11).

13. Security

We use appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (TLS) and at rest;
• Strict access controls and authentication for our team;
• Row-level security and column-level privilege controls in our database;
• Logging and monitoring of access to production systems;
• Regular reviews of security practices and dependencies;
• Documented incident response and breach notification procedures.

No system is completely secure. While we take security seriously, we cannot guarantee the security of any information transmitted to or stored by the Service. Please use a strong, unique password and keep your login credentials confidential.

14. Cookies and similar technologies

We use cookies and similar technologies on faceping.dev to operate the site, remember your preferences, measure use of the Service and (where you consent) deliver analytics. You can manage non-essential cookies through our cookie banner and through your browser settings. Disabling essential cookies will affect how the Service functions.

A full cookie notice is available at faceping.dev/cookies (or by following the link in the cookie banner).

15. If you are a Channel Operator

If you operate a Channel on the Service, you and FacePing each act as independent data controllers for the personal data of your Subscribers and visitors, in respect of the following:

• Your own use of Subscriber data (for example, for your own marketing or analytics outside the Service) — you are the sole controller.
• The operation of the Service itself (hosting Content, delivering messages, providing analytics dashboards) — FacePing is the controller.

You must:

• Provide your own privacy notice to your Subscribers covering anything you do with their data outside the Service;
• Have a lawful basis under UK GDPR (or equivalent law) for any direct messaging, marketing or other processing you perform;
• Not export, sell or transfer Subscriber data for use outside the Service except where the relevant Subscriber has separately and clearly consented (see Terms of Service, Section 9.4);
• Apply additional caution where Subscribers are Minors, including not sending marketing communications to Subscribers you know to be under 18.

16. Linked third-party sites and content

The Service may link to third-party websites, applications and resources, and our Content may be embedded on third-party sites via our embeddable player. We are not responsible for the content or privacy practices of those third parties. Their use of your data is governed by their own policies, not ours.

17. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the latest version. Where changes are material, we will notify you by email or via a prominent in-Service notice. Continued use of the Service after the effective date of the updated policy constitutes acceptance.

18. Contact us

For any questions about this policy, our privacy practices, or to exercise your rights:

• Email: info@faceping.dev
• Post: FacePing Ltd, 66 Paul Street, London, England, EC2A 4NA

FacePing Ltd is registered in England and Wales (company number 17204155). Registered office: 66 Paul Street, London, England, EC2A 4NA.