Biometric notice

In short

CEVO takes scans of facial geometry from your photos: 478 landmark points and the measurements between them.
We use them only to measure your proportions for the report and renders you order, and to check that your renders still show you.
We never use them to identify or recognise you, and never sell, lease, trade or profit from them.
We ask for your written consent, by an unticked box, before any landmarking, even in your browser.
Landmark records are destroyed 30 days after your report is delivered. Measurements are destroyed at the latest 12 months after your latest report, re-scan or membership month. If you turn on "Keep my photos in my CEVO account", your photos, landmark records and measurements stay until you turn it off, delete them in My CEVO, or delete your account.

What we collect

Laws in Illinois, Texas, Washington, Colorado and elsewhere protect "biometric identifiers" and "biometric information". We treat all of the following as biometric data, whether or not a particular law would.

Landmark records: Scans of facial geometry obtained from your photos: the positions of 478 points on your face, such as the corners of the eyes, the edge of the jaw and the outline of the lips
Measurements: Distances, ratios and angles calculated from those points, and the facial balance breakdown, which every report includes: how they sit against their reference ranges, feature by feature, never as one overall score
Profile geometry: The same, from the 90° side photo you take after buying a $59 or $119 report. The free scan and the $29 report use no side photo
Photos: Your front photo and, for a $59 or $119 report, your side photo. Some laws exclude photographs, but we protect yours to the same standard because geometry is taken from them

We do not collect fingerprints, voiceprints, iris or retina scans, or any face template used for recognition. We compare faces only to check that your renders still show you, using a similarity score computed in memory; that score is never stored and never used to identify you.

Purpose and length of term

The one purpose is to measure your facial proportions and produce the report, re-scans and renders you ordered. If you opt in separately, photos uploaded for a paid report and their measurements may also be used to test and improve CEVO's own measurements; free-scan photos are never used for this. That box is off unless you tick it.

In the $59 and $119 reports, CEVO's software also estimates the age your face appears in the photo, shown as the Biological Facial Age Index (EU AI Act Art. 50(3)). It is an estimate made by CEVO's software, not your actual age.

The term is as short as that purpose allows: landmark records are kept until 30 days after your report is delivered, and measurements until 12 months after your last report, re-scan or membership month. The full schedule is below.

What it is never used for

Identifying you, recognising you, verifying who you are, or matching you against anyone else. The only face comparison checks that your renders still show you, and its score is never stored.
Inferring your ancestry, race, sex, health, emotions or personality. Ancestry and sex come only from your own answers.
Advertising, ad targeting or audience building.
Training AI models, unless you tick the separate "Improving CEVO" box. Our providers' contracts do not allow them to train on your data either.
Sale, lease, trade or any other profit. We never take payment for your biometric data.

Where it is processed

Step	Where it runs	What leaves your devices
Free scan	In your browser, on your devices. A private copy of each photo is stored encrypted on CEVO's servers, hosted by Hetzner Online GmbH in Helsinki, Finland	No landmark records. Apart from the steps our visit measurement records (for example scan started, photo accepted, readout shown, never a photo or a measurement; see the privacy policy) and the private copy of each photo described at the end of this row (with your device type, browser and screen size), nothing else leaves your devices unless you choose Continue on your phone (next row). Your three free measurements (FWHR, canthal tilt (an estimate, about ±1.5°), and the middle-to-lower face ratio) are calculated in your browser from one front photo, and the landmarks are discarded when you close the tab. A private copy of each photo you take or upload in the scan, with its photo-quality readings and without landmarks, is kept on CEVO's server for up to 90 days to fix problems and improve quality; CEVO staff may view it. The scan makes no requests to any third party.
Phone hand-off	Your phone and your computer, relayed by CEVO's server (Hetzner Online GmbH, Helsinki, Finland), which cannot read what it relays	Only if you choose Continue on your phone. Your answers, and whether you ticked the optional ancestry and body-fat boxes, go from your computer to your phone, where you give your own consent, the photo you take there goes back to your computer, and both devices share their progress and, once you unlock, your email address, all end-to-end encrypted (AES-256-GCM). The key travels only in the QR code's link and never reaches CEVO's server, so the server holds only encrypted data, in memory, never on disk, and deletes it once delivered or after 30 minutes. Your computer measures the photo itself; no landmarks or measurements are sent between your devices. Once the photo reaches your computer, your computer keeps a private copy of it on CEVO's server for up to 90 days, like every scan photo (row "Photo checks"). After you buy, a photo you take on your phone with your computer's code is uploaded straight to CEVO's servers for your report, as if you had taken it on your computer
Paid analysis	CEVO's servers, hosted by Hetzner Online GmbH in Helsinki, Finland. The photos are encrypted there and stored as encrypted files in Cloudflare R2 (Western Europe), which cannot read them	Your front photo from the free scan, uploaded when you buy a report. For the $59 and $119 reports you then take a 90° side photo, uploaded the same way. The $29 report uses the front photo only
Kept in your CEVO account	CEVO's servers, hosted by Hetzner Online GmbH in Helsinki, Finland, stored encrypted	Only if you turn on "Keep my photos in my CEVO account": your photos, landmark records and measurements stay so you can compare your progress, until you turn it off, delete them in My CEVO, or delete your account
Photo checks	CEVO's servers, hosted by Hetzner Online GmbH in Helsinki, Finland, stored encrypted	Every photo taken or uploaded in the free scan, for a paid report or for a re-scan, including ones our photo checks did not accept, with its quality readings, kept up to 90 days to fix problems and improve quality. CEVO staff may view them. No landmark records are kept with them
Report text	Anthropic, PBC (US), which writes the report text	Measurements and the questionnaire answers you allowed. Your ancestry answer is never sent: CEVO's servers use it to choose the reference norms, and Anthropic receives only the comparison results, not the answer or which norms were used. Anthropic never receives your photos, landmark records, name or email. It deletes what it receives within 30 days, except content its safety systems flag, which it may keep for up to 2 years, and may not train on it
Renders	fal.ai (Features & Labels, Inc., US)	For a $59 or $119 report, your front photo, and side photo if a render needs it, with a short description of each style. Never landmark records, measurements, name or email

Optical Lens Normalization

Faces photographed from close up look different from faces photographed from further away. CEVO's Optical Lens Normalization (24mm to 85mm) estimates how far the camera was from your face, using the size of your iris and the photo's lens data, and checks whether the photo was taken too close. It does not change your photo. If the photo looks too close, we warn you or ask you to retake it.

Your written release

Before any landmarking happens, in the browser or on our servers, step 6 of the questionnaire shows this notice in short form and asks for your consent with an unticked box. Ticking it and continuing is your electronic signature: a written release that you have been told what is collected, why and for how long.

For each consent we record the exact wording shown, its version, the time, and the account or free-readout unlock it belongs to. We keep that record for 5 years after the consent ends. If you have an account, its Privacy page lists each consent you gave and when; otherwise email privacy@cevolab.com and we send you the list.

You can withdraw at any time by emailing privacy@cevolab.com. We then destroy your photos, landmark records and measurements within 30 days.

Who it is disclosed to

We disclose biometric data only with your consent, and only to:

Anthropic, PBC (US), which receives measurements and the questionnaire answers you allowed, never photos, to write your report text; it deletes what it receives within 30 days, except content its safety systems flag, which it may keep for up to 2 years;
fal.ai (Features & Labels, Inc., US), which receives your photos and a short description of each style, never your geometry, name or email, to create the renders in a $59 or $119 report; it uses them only to make the images, may not train on them, and deletes them under its data processing terms;
a trained CEVO team member bound by a confidentiality agreement, who checks your report and its renders inside CEVO's own signed-in tool (renders with no name or email attached);
our hosting provider, Hetzner Online GmbH, which stores it for us on servers in Helsinki, Finland;
Cloudflare, Inc., which stores your paid photos and their landmark records for us in its R2 storage in Western Europe, only in encrypted form: they are encrypted on CEVO's server first and the keys stay there, so Cloudflare cannot read them.

We disclose it to anyone else only if the law, a warrant or a subpoena requires it. Landmark records go to no other provider: besides CEVO's own server, they are stored only in Cloudflare R2, with your paid photos and encrypted on CEVO's server first, so Cloudflare cannot read them. Each provider is bound by contract to use the data only for us and to delete it when we ask.

Retention schedule

We destroy biometric data when the purpose it was collected for is satisfied, or at the legal maximum, whichever comes first. The legal maximums are 3 years after your last interaction (Illinois), 1 year after the purpose ends (Texas) and 24 months after your last interaction (Colorado). Our own periods are shorter than all three.

Data	Destroyed
Free-scan photo and landmarks	The landmarks are never sent to CEVO, and the photo's private copy is a photo check record, kept up to 90 days. While you sign in to unlock the free readout, an encrypted copy is kept in this browser for up to 30 minutes, so your scan is still there when you come back from Google or your email. It is deleted when the readout opens, when you discard the photo, exit or start over, when you come back to the scan after leaving it, and otherwise the next time you open the CEVO questions or scan once 30 minutes have passed. Only that tab, and the Google sign-in tab it opened, hold the key, so once those tabs are closed the copy cannot be read. Otherwise discarded when you close the tab
Photo sent with Continue on your phone	Held by CEVO's server only end-to-end encrypted, in memory, never on disk. Deleted once your computer has received it, and in any case 30 minutes after the QR code was made. The private copy your computer then keeps is a photo check record, kept up to 90 days
Link to take a photo on your phone after you buy	The code works once. Your phone must open it within 15 minutes, and it then works for 30 minutes from that first opening; its one-way hash is deleted a day after it expires. Your consent record, age range and cookie choice held with it are deleted when it is used or ended (it ends as soon as your photo arrives another way), and within 10 minutes after it expires. The photo itself is kept like any photo for your report
Paid photos (front, and side for $59 and $119)	30 days after your report and renders are delivered, from CEVO's server and from Cloudflare R2. The encrypted copy kept in your browser from the moment you press Pay is deleted as soon as CEVO has the photo, when you discard the photo or start over, when you exit the scan with no payment open, when the payment is cancelled or expires, and otherwise the next time you open the CEVO questions, scan or order page once 2 hours have passed; only the tab you paid from and its payment tab hold the key
Landmark records	With the photos, 30 days after delivery
Re-scan photos and landmark records	30 days after that re-scan's report is delivered
Measurements	12 months after the latest of: report delivery, your last re-scan, the end of your membership
Copies held by fal.ai	Deleted under fal.ai's data processing terms, and in any case with your photos
Everything above, on request	Within 30 days of your request or withdrawal

How it is destroyed

An automatic job runs daily and permanently deletes every record past its date from the database and from photo storage, including Cloudflare R2.
Photos and landmark records are not in our database backups. Those backups are encrypted on our server, and each is deleted 30 days after it is made, so anything deleted from the database is gone from backups within 30 days.
We send a deletion instruction to any provider that holds a copy and keep its confirmation where the provider gives one.
We log each deletion by date and record type, without keeping the data itself.
Once a year we review what we hold against this schedule and destroy anything no longer needed within 45 days (C.R.S. 6-1-1314(2)(a)(III)(C)).

If this schedule changes, we update this page first.

Security and incidents

We store and transmit biometric data with at least the care used across our industry, and at least as carefully as any other confidential data we hold: encrypted in transit and at rest, reachable only by named team members through the signed-in admin tool, and with every access logged.

If a security incident affects biometric data, we:

contain it and work out what was affected;
notify the people affected without undue delay, and in any case within 30 days of discovering it (including the notice required by C.R.S. 6-1-716), and regulators as each law requires;
record the incident and the fix, and review this policy.

State-specific rules

Illinois: This page is our public written policy under the Biometric Information Privacy Act (740 ILCS 14/15). We inform you in writing and get your written release before collection, and never sell, lease, trade or profit from your data.
Texas: Under the Capture or Use of Biometric Identifier Act (Bus. & Com. Code 503.001) we capture face geometry only after your consent and destroy it within a year after the purpose ends, in practice much sooner.
Washington: Face imagery and geometry are consumer health data under the My Health My Data Act. We collect them only after you tick the unticked consent box at step 6, and we never share them with a third party; fal.ai and Anthropic receive them only as our processors, under contract, to make what you ordered. The only consumer health data we share is what Google Ads receives if you came from a Google ad: that you unlocked your free readout and, if you pay, the amount you paid, and only until you switch Google Ads measurement off in Cookie settings or send a Global Privacy Control signal. Meta advertising tools are not in use yet; before we turn them on, we will update this notice. Details are in the consumer health data policy.
Colorado: This page is our biometric policy under C.R.S. 6-1-1314, including the retention schedule, the incident steps above and an annual review. We delete biometric data at the latest 24 months after your last interaction, and much sooner under our schedule.
Other states: Where biometric data is sensitive data, as in Virginia, Connecticut, Oregon and others, we collect it only with your opt-in consent.
EU and UK: We treat face geometry as special-category data and process it only with your explicit consent (GDPR Art. 9(2)(a)). See the privacy policy for your rights.

Questions and requests

To see, download or delete your biometric data, or to withdraw consent, email privacy@cevolab.com. CEVO is run by Fideo LLC, a Wyoming limited liability company, 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA.