FaceApp procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Standard Contractual Clauses (or an alternative legal tool, such as the UK Government-approved International Data Transfer Agreement or Addendum) to require the third party to protect your data and to provide you with EU- and UK-level rights and protections;” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ For users in the United Kingdom, VeraSafe has been appointed as FaceApp’s representative in the United Kingdom for data protection matters, pursuant to Article 27 of the UK General Data Protection Regulation. VeraSafe can be contacted only on matters related to the processing of personal data or data protection.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ To make such an inquiry, please contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +44 (20) 4532 2003.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Make sure that the relevant safeguards are in place to afford adequate protection for your personal information.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Policies and processes to challenge disproportionate or unlawful government authority requests.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ We do this using a variety of protections, as appropriate for each data transfer. For example, we use:” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ If we transfer your personal information internationally, these countries may not provide the same protections as the data protection laws where you are based. Where we transfer information internationally, we:” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “We configure Google Cloud Platform and Amazon Web Services to delete photographs and videos, and the information associated with those photographs and videos, within 24 to 48 hours after the photograph or video was last edited using the Apps. This allows you to revisit photographs or videos to make additional modifications during that time.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “Photographs or videos may remain cached in the cloud for a limited period between 24 to 48 hours after your last edit, so that you can return to it and make additional changes if you so choose.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Deletion of personal information that we no longer need to provide the services or for other lawful purposes.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 1.1. When you use the Apps and select photographs or videos for editing, we cache them for processing to render the requested editing service:” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Photographs or videos may remain in the cloud for a maximum limited period of 24 to 48 hours, for improved performance and lower bandwidth allowing additional changes to recently selected photos or videos in an optimal manner.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Cloud processing. You may request that we remove your information, including the photographs and videos that are temporarily cached on Google Cloud Platform or Amazon Web Services, prior to the automatic 24 to 48 hours post-edit deletion time by clicking the “Request cloud data removal” button in the “Support” section of the Apps settings.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ With respect to non-photograph and non-video information that we may collect, we will retain such information only for as long as necessary to fulfill the purposes we have set out in this Privacy Policy unless a different retention period is permitted or required by applicable law. You may also ask that we delete your information using the “Request cloud data removal” option in the “Support” section of the Apps settings.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ For compliance, fraud prevention, and safety. We may use and disclose the information we collect (such as device data and Apps usage information) where it is in our legitimate business interests to: (a) protect our, your, or others’ rights, privacy, safety, or property (including by making and defending legal claims); (b) enforce the terms and conditions that govern the Apps and Site; and (c) protect, investigate, and deter against fraudulent, harmful, unauthorized, unethical, or illegal activity. We may disclose this information to government authorities and other third parties as required by applicable law. We cannot disclose the photos and videos that have been cached for processing as we do not store the encryption keys.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 3.2. We do not sell personal information. We may share your non-photograph and non-video information in the following circumstances:” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 3.1. We do not disclose user photographs or videos to third parties (with the exception of temporarily caching an encrypted version with our cloud providers, Google Cloud Platform and Amazon Web Services, to provide the photo and video editing features of the Apps). We cannot disclose the photos and videos cached for processing as we do not store the encryption keys.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Service providers. We may share your information with service providers that perform services on our behalf or help us operate the Apps (such as customer support, hosting, analytics, email delivery, marketing, and database management services). These third parties may use your information only as directed or authorized by us and in a manner consistent with this Privacy Policy and are prohibited from using or disclosing your information for any other purpose.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Business transfers. We may also transfer or assign your personal data in the course of corporate divestitures, consolidations, mergers, acquisition, reorganization or other transfers of assets, or in the event of bankruptcy or dissolution.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We use third-party cloud providers - specifically, Google Cloud Platform and Amazon Web Services - to process and edit photographs and videos.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Professional advisors. We may disclose your information to professional advisors, such as lawyers and auditors, where necessary in the course of the professional services that they render to us.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “To create anonymous, aggregated, or de-identified data. We may create anonymous, aggregated, or de-identified data where it is in our legitimate business interests, and use and share it with third parties.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Affiliates. We may share information we collect from you with our subsidiaries and affiliates, for purposes consistent with this Privacy Policy.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Compliance with law . We may be required to disclose your information to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities, or for the compliance, fraud prevention, and safety reasons described above. We do not have any access to your photos or videos as they are cached in encrypted format, and the key resides on the user’s device so we cannot disclose such content.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Note, our technical support team may also access your information, such as Apps usage information, in locations outside of your state, province, or country.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Third-party platforms and social media networks. You may select to post the edited photograph or edited video to your social media account. We do not control any third-party platform’s use of your information, which is governed by that third party’s privacy policy and terms and conditions.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ The Apps may contain links to other websites, mobile applications, and other online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. In addition, our content may be included on web pages or in mobile applications or online services that are not associated with us. We do not control third party websites, mobile applications, or online services, and we are not responsible for their actions. Other websites, mobile applications, and online services follow different rules regarding the collection, use, and sharing of your personal information. We encourage you to read the privacy policies of the other websites, mobile applications, and online services you use.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | Paid | medium | “Subscriptions to the Services can only be purchased via third-party marketplaces (e.g., through the Apple App Store or Google Play Store). FACEAPP DOES NOT SELL ANY PAID SUBSCRIPTIONS DIRECTLY, DISTRIBUTE ANY PAID CONTENT AND/OR PROCESS PAYMENT FOR ANY SERVICES OR PURCHASES DIRECTLY. BY AGREEING TO THIS AGREEMENT, USERS THAT PURCHASE SUBSCRIPTIONS TO, OR OTHERWISE PAY FOR, THE SERVICES AGREE TO BE BOUND BY THE TERMS AND CONDITIONS AND/OR END USER LICENSE AGREEMENTS (OTHER LEGAL AGREEMENTS) WITH THE RELEVANT THIRD-PARTY MARKETPLACES (APPLE APP STORE, GOOGLE PLAY STORE, ETC.) WITH RESPECT TO SUCH SUBSCRIPTIONS OR OTHER PAYMENTS.” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.