Face & Biometric Data Notice
Effective date: July 27, 2026 · This is the document the Mend app refers to as the "Biometric Policy".
This notice explains, in plain language, what happens to photos and videos that contain faces when you use Mend: AI Photo & Video Editor ("Mend", the "App"). Mend is operated from Lithuania, European Union (see our Privacy Policy for controller contact details).
The short version
- Mend performs no facial recognition. We do not identify, match, verify, or profile anyone from a photo — ever.
- Mend creates no biometric identifiers. No faceprints, no face templates, no face embeddings, no scans of face geometry, and no face database exist anywhere in our systems.
- Your photo is processed for exactly one purpose: to create the AI edit, style, or video that you requested.
- Processing happens with your explicit, recorded consent, given in the App before you first use AI features, and the App shows you a one-time face-photo notice before your first upload.
- Uploaded photos and videos are automatically and permanently deleted from our storage 24 hours after upload. You can also delete any generation (which deletes its uploaded photo, result, and thumbnail) or your entire account from inside the App at any time.
- We never sell your photos or any data derived from them, and we do not use them for advertising or to train AI models.
1. What Mend does with a photo that contains a face
When you upload a photo or video and request an AI transformation, the following happens:
- Your photo is uploaded over an encrypted connection to a private storage bucket that only your account can access.
- The photo is automatically checked by OpenAI's content-moderation service (via a time-limited private link) to block prohibited content before any generation runs.
- The photo (again via a time-limited private link) and the effect's text instructions are sent to fal.ai, the AI infrastructure provider that runs the generative model producing your result.
- The generated result and a thumbnail are stored in your private gallery until you delete them or delete your account.
- Your original uploaded photo is automatically and permanently deleted from our storage 24 hours after upload — or sooner if you delete the generation or your account first.
Some effect instructions ask the AI model to "preserve the likeness" of the people in your photo. This is an aesthetic instruction so that your result still looks like you — it does not involve measuring, extracting, or storing any facial features, and it produces no data that could be used to recognize you elsewhere.
2. What Mend does NOT do
Mend explicitly does not:
- Perform facial recognition, face matching, or identity verification of any kind;
- Extract, measure, compute, or store face geometry, facial landmarks, faceprints, face templates, or face embeddings;
- Build, maintain, or contribute to any face database;
- Use photos to identify who appears in them, to link photos of the same person together, or to profile anyone;
- Collect retina or iris scans, voiceprints, or scans of hand or face geometry;
- Use your photos or any data derived from them for advertising, tracking, or AI model training;
- Sell, lease, trade, or otherwise profit from your photos or any data derived from them.
The Mend app contains no face-detection or face-analysis software. Our instructions to our AI providers are limited to producing the transformation you requested.
3. Where this sits legally
Biometric-privacy laws — such as the Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act, Washington's biometric law, and Article 9 of the EU GDPR — regulate data that is created or used to identify a person: for example scans of face geometry, faceprints, and face-recognition templates.
Our position
Mend does not collect, capture, purchase, or otherwise obtain biometric identifiers or biometric information within the meaning of these laws, because Mend never creates or uses data capable of identifying a person from their face. Under the GDPR, an ordinary photograph is treated as biometric "special category" data only when it is processed through specific technical means to uniquely identify someone (GDPR Art. 4(14) and Recital 51) — which Mend does not do. Your photos are protected as ordinary personal data under the GDPR's general rules and our Privacy Policy.
Even though we believe these identification-based laws do not apply to Mend's generative processing, we voluntarily apply similar safeguards anyway: a published written notice (this document), explicit consent before processing, no sale of or profit from your photos, security measures, and user-controlled deletion.
4. Consent and the face-photo notice
Before you can use AI features, the App requires you to give explicit consent to AI processing of your photos and videos. Your consent is recorded on our servers together with the consent version and a timestamp (and technical metadata such as the network address it was given from, which is removed if you delete your account). In addition, the App shows a one-time face-photo notice before your first upload, reminding you that photos containing faces are processed only to create the transformation you chose.
If you do not consent, do not upload photos of yourself or others. If you upload photos that include other identifiable people, you are responsible for making sure they are comfortable with — and where required by law, have consented to — their photo being processed as described here.
5. Who receives your photo
Only the following processors receive photo data, and only to deliver the service you requested:
| Provider | Role | What it receives | Location |
|---|---|---|---|
| Supabase | Private cloud storage and database | Your uploads (deleted 24 hours after upload), generated results, and thumbnails, in access-controlled private buckets | EU (Ireland) |
| fal.ai | Runs the generative AI models | A time-limited private link to your upload, the effect instructions, and a pseudonymous account identifier used for abuse prevention | United States |
| OpenAI | Automated content-safety moderation and prompt safety | A time-limited private link to your upload and, for custom effects, your prompt text — with no account identifier attached | United States |
Neither provider is permitted to use your photos for anything other than providing their service to us. Under their published API terms, fal.ai and OpenAI state that API content is not used to train their models. Each provider retains API data only per its published policies (for example, OpenAI may retain moderation inputs for a limited period for abuse monitoring). See the fal.ai Privacy Policy, the fal.ai media-retention documentation, and the OpenAI Privacy Policy.
6. Retention and deletion
- Uploaded photos and videos are stored in your private storage so your generation can run and are automatically and permanently deleted 24 hours after upload — a scheduled process runs every minute, so deletion happens within about a minute of the 24-hour mark. They are deleted sooner if you delete the generation in the App or delete your account.
- Generated results and thumbnails are stored in your private gallery until you delete them or delete your account.
- Account deletion (Settings > Delete Account) permanently removes your uploads, results, thumbnails, and account records; incomplete deletions are automatically retried until finished.
- The time-limited private links shared with AI providers expire automatically (typically within one hour).
We do not promise deletion timelines we cannot control at third parties: once a provider has processed your photo, any residual retention on their side is governed by their published policies linked above.
7. Your rights and how to withdraw consent
- Delete a single creation: delete it in the App — this removes the uploaded photo, the result, and the thumbnail from our storage.
- Delete everything: Settings > Delete Account in the App, or email support@usemend.app with the subject "Account Deletion Request".
- Withdraw consent: simply stop using AI features, and/or email support@usemend.app with the subject "Withdraw AI Processing Consent". We will note the withdrawal and, on request, delete your stored photos and generations. Withdrawal does not affect the lawfulness of processing that happened before it.
- Export your data: Settings > Export My Data in the App.
We aim to answer data requests within 30 days, consistent with the GDPR.
8. If our practices ever change
If Mend ever introduced features that create biometric identifiers or identify people from photos (we have no plans to), we would update this notice first, ask for new, explicit consent before any such processing, and comply with the biometric laws that would then apply. Material changes to this notice will be announced in the App or by email, with the effective date updated above.
9. Contact
- Controller: Lukas Vaičiulis, operating Mend, Vilnius, Lithuania
- Location: Lithuania, European Union
- Email: support@usemend.app
- Related documents: Privacy Policy · Terms of Service
Summary: your face is used to make the picture you asked for — and for nothing else.