Biometric & Face Data Notice

Try-on, avatar, hair, Animate, photo sizing and Trial Room pictures make images and measurements of you from photos of your face and body. To do that, the photos are analysed for facial and body geometry. Some laws call this a biometric identifier or biometric information, including Illinois' Biometric Information Privacy Act, Texas' Capture or Use of Biometric Identifier Act, Colorado's Privacy Act, Washington's My Health My Data Act, and similar laws. In this notice we call all of it face and body data.

• The photos of your face and body you choose to provide.
• The facial and body geometry derived from them.
• Measurements and a 3D body shape we estimate from them.
• The images and short videos we make of you.

We don't create face templates for recognising you, and we never use face and body data to identify you.

Only to:

• (a) make the images, videos and sizes you ask for;
• (b) check images for safety, including for nudity and for images of children;
• (c) keep the records the law requires.

Never: to identify you, for advertising, to train AI models, or to sell. We don't keep copies of images of people for staff review.

• Before we collect any face and body data, you give us a separate written permission in the app by ticking a box. A tick is an electronic signature.
• Showing an image of your face to anyone else (a share link, a post, a card for a stylist) needs a second, separate permission.
• Live try-on, in the app or in a Trial Room, needs its own separate permission too, on its own screen, which tells you who our live video partner is.
• In Trial Room stores, a separate permission covers photos taken in the store. Keeping Trial Room pictures in an ATTYR account needs the app's permission.

ATTYR and the providers marked “face/body” on Our service providers:

• AI services: OpenAI, Google, OpenRouter and its US-based model hosts, Anthropic, fal.ai, Replicate, Hugging Face, Modal and FASHN.
• Infrastructure: Render, Neon, Vercel and Cloudflare (hosting and storage).
• Live try-on (only where offered, only with separate consent): our live video partner (listed on Our service providers).

Each may use it only to perform its service for us. None may use it for training, or sell or disclose it except to perform the service. We don't sell, lease, trade or otherwise profit from your face and body data.

We permanently destroy face and body data at the earliest of:

• (a) when you delete it;
• (b) when you withdraw permission (in Settings → Account → Biometric data);
• (c) when you delete your account;
• (d) when the purpose is satisfied;
• (e) 12 months after your last use of a face feature. This one window applies to everyone, wherever you live, and it is at least as strict as every state law we know of (Texas requires destruction within a year of the purpose ending).

Trial Room: your photo and any pictures you don't keep are destroyed when your visit ends (12 hours at most).

If we learn you're under 18, we destroy your face and body data straight away (section 8).

Copies held elsewhere:

• Deleted data can remain in our hosting providers' backups for a limited time before they're overwritten.
• Our AI providers may keep request data for a limited time, solely to detect abuse, and then delete it.
• We review this schedule at least once a year.

Withdraw anytime in Settings → Account → Biometric data, or by email to privacy@attyr.app. Withdrawing deletes:

• your avatar photos and avatar, your sizing photos and your 3D body shape;
• your hair sessions and hair images;
• the try-on images in your saved looks, and your Animate clips;
• your photo-based measurements and style-analysis photos;
• your public profile photo;
• images of you on cards you sent to a stylist or barber. Your community posts are unpublished, and every share link you created stops working.

It also removes the try-on photo from that device. This can't be undone. Your closet photos, outfits, the measurements you typed in and anything else not made from your face-feature photos stay.

Face features are for 18+ only. A minor's permission isn't valid. If we learn face and body data came from someone under 18, we destroy it and close the account.

We store and send face and body data with reasonable care, using measures at least as protective as those we use for our other confidential information. That includes encryption in transit and at rest and access limited to staff who need it.

privacy@attyr.app. We keep a record of each permission you give or withdraw (with no image) for the life of your account and 5 years after, as proof of consent; see the Privacy Policy.