Biometric Data Notice and Policy

Effective date: November 8, 2026

This notice and policy explains how HELPERG LLC (“PhotoForPass”, “we”, “us”) handles photos uploaded to photoforpass.com (the “Service”). It is our publicly available written policy, retention schedule and destruction guideline for any biometric identifiers or biometric information we may process.

It is written to meet the requirements of the Illinois Biometric Information Privacy Act (740 ILCS 14, “BIPA”), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code 503.001, “CUBI”), Washington’s biometric identifier law (RCW 19.375) and My Health My Data Act (RCW 19.373), Colorado’s biometric data law (C.R.S. 6-1-1314), the California Consumer Privacy Act as amended (CCPA), the GDPR and UK GDPR, and similar laws. It supplements our Privacy Policy.

1. Our position in plain terms

We do not use face recognition. We do not create face templates, faceprints, face geometry scans, or any other data designed to identify or recognize a person. We do not compare anyone’s face against a database or against photos of other people.

Our Service works with photos of people, and some laws define “biometric” information broadly or may treat face photos, or measurements taken from them, as biometric data. Because the law in this area is still developing, we choose to treat every uploaded photo, and every image we make from it, as if it were biometric data, and we give you the notice, choice and protections those laws require.

2. What we collect

• The photo you upload or take in your browser, of yourself or of people you are authorized to act for (such as your child), or of a loved one for a memorial portrait.
• Edited and generated images made from it: document photos, print sheets, keepsake portraits and cards.
• Temporary face position data: the location, size and tilt of a face in the image (for example, a box around the face, or the position of the eyes and chin), used to center and crop the photo. It is used only during processing and is not designed to identify anyone.

Before you pay, the free photo check runs in your browser, and your photo is not sent to us. We collect the photo only after you place an order.

3. Specific purposes

We use photos and the data above only to:

1. Run automated checks (lighting, focus, background, head position, eyes open).
2. Send the photo, with fixed instructions we write, to a third-party AI model, through an AI gateway (OpenRouter, which routes the request to Google Gemini models), to edit the background, lighting and framing of a document photo, or to create the keepsake images you ordered.
3. Review the result automatically, which may include comparing the finished image with your original photo, within your own order, to confirm that the person’s appearance was not changed and that the result meets the specification.
4. Size and crop document photos to the specification you selected.
5. Store the files so you can download, re-check or regenerate them within your order, and show them in “My photos”.
6. Handle your support or refund request about that order, if you contact us.

We never use them for identification, authentication, surveillance, marketing, advertising, profiling, or AI model training.

4. No sale, no profit, limited disclosure

We do not sell, lease, trade, or otherwise profit from photos or any data derived from them, other than by charging you for the order you placed.

We disclose photos only:

• To our service providers that process them on our behalf to provide the Service, under terms that restrict their use to that purpose and do not allow training AI models on them: Cloudflare (hosting, processing, image resizing and encrypted storage in the United States), OpenRouter (AI gateway, set to use only providers that do not collect request data for their own purposes), and Google (Gemini AI models).
• When you, or the person’s legally authorized representative, ask or consent to the disclosure.
• When required by federal, state or local law, or by a valid warrant or subpoena issued by a court of competent jurisdiction, including mandatory reports of apparent child sexual abuse material.

Photos are never included in our email, payment, analytics, session replay, sign-in or owner notification systems.

5. Retention schedule

Data	Maximum retention
Photo during the free check before payment	Not sent to us. Stays in your browser
Uploaded photo	Permanently deleted 90 days after upload, or sooner when you delete it
Edited and generated images	Each file is permanently deleted 90 days after it is created, or sooner when you delete it
Temporary face position data	Deleted when processing of that photo ends, and never kept after the photo is deleted
Photos attached to support or refund messages	Permanently deleted within 90 days of receipt

We keep no photo or derived data longer than 90 days. This is far shorter than the limits set by BIPA (when the initial purpose is satisfied or within 3 years of your last interaction, whichever comes first), CUBI (no later than one year after the purpose expires) and Colorado law. If the purpose for collecting a photo is fulfilled earlier, for example because you delete it or close your account, we delete it sooner.

6. Destruction policy

• Automatic deletion. An automatic deletion rule on our photo storage (Cloudflare R2) permanently deletes each file when it reaches 90 days of age.
• Deletion on request. When you delete a photo in “My photos”, delete your account, or ask us by email, we permanently delete the photo and the images made from it from our storage promptly.
• AI providers. Our AI providers process photos to return a result. They may keep request data only briefly for abuse monitoring or legal compliance where their terms allow, and never for training.
• Method. Deletion removes the stored files and the links to them so they cannot be recovered through the Service. Photos are not kept in database backups.
• Legal holds. If we are legally required to preserve specific data, for example by a court order, we will keep only what is required, only for as long as required, and will continue to protect it as described here.

7. How we protect it

We store and transmit photos using a reasonable standard of care that is the same as or more protective than how we protect other confidential and sensitive information, including:

• Encryption in transit (TLS) and at rest.
• Private storage, accessible only to your account or private order link and to systems that need it to process your order.
• Restricted access. We do not look at photos unless needed to resolve a support request you made or to investigate a suspected violation of our Terms.
• A security incident response process. If a breach affects photos, we will notify affected people and regulators as required by law.

8. Your consent

Before you upload a photo, we ask you to check a box confirming that:

• You have read this notice and our Privacy Policy.
• You consent (give your written release) to our collection, storage and use of the photo, and any biometric identifiers or biometric information that may be derived from it, for the purposes and retention period described here, including processing by third-party AI models.
• If the photo shows anyone else, you are that person’s parent or legal guardian, or have their consent, and you give this consent on their behalf as their legally authorized representative.

We do not process a photo until you give this consent. Processing the photo is necessary to provide the Service, so if you do not consent, we cannot create your order.

Withdrawing consent. You can withdraw consent at any time by deleting your photos in “My photos” or emailing us. We will stop processing and delete the photos as described above. If this happens before we deliver your order, you can request a refund under our Refund Policy.

9. Your rights

You can ask us to tell you whether we hold photos of you, give you a copy, or delete them. See Your privacy rights in our Privacy Policy. We will not discriminate against you for exercising your rights.

10. Washington consumer health data

Under the Washington My Health My Data Act, biometric data can be “consumer health data”. Our practices for that data are the same as described in this notice: we collect photos only with your consent, use them only to provide the Service, do not sell them, share them only with the processors listed above, and delete them within 90 days. Washington residents can access or delete their data, and withdraw consent, as described in Section 9.

11. Changes

If we change how we handle photos, we will update this notice, change the effective date, and ask for new consent before applying a materially different practice to your photos.

12. Contact

HELPERG LLC 30 N Gould St, Ste N Sheridan, WY 82801 USA

Email: contact@photoforpass.com