FaceSwapAI Logo - Professional Face Swap Platform
Face Swap AI

Security & Privacy

Last updated: 2026-05-07

Short Version

Uploads encrypted in transit (TLS 1.2+) and at rest (AES-256). Original uploads deleted within 24 hours. Biometric embeddings discarded immediately after processing. User uploads never used to train AI models. Full compliance with BIPA, GDPR, CCPA, EU AI Act Article 50, and TAKE IT DOWN Act 2025. See our trust page for primary-source documentation.

Data Path

  1. Upload over TLS 1.2+. No unencrypted transfer.
  2. Storage at rest: AES-256-encrypted object storage. Per-object encryption keys; key rotation enabled.
  3. Inference: Image is decrypted in GPU memory for the duration of processing. Biometric embeddings (face vectors) exist only in memory and are discarded.
  4. Output delivery: Returned to the user; C2PA Content Credentials embedded.
  5. Retention: Original upload auto-deleted within 24 hours. Output retained for 30 days for re-download, then deleted.

What We Don't Store

  • No face embeddings or biometric templates retained beyond processing.
  • No copies of uploads in caches, CDNs, or logs.
  • No personal data shared with third parties without your explicit consent.

What We Don't Train On

User uploads are never used to train, fine-tune, or improve any AI model. Training data is sourced separately from rights-cleared corpora. This is contractually binding, not a soft policy.

Regulatory Compliance

  • BIPA — biometric data handling per Illinois statute.
  • GDPR — Article 15–22 subject rights honored within 30 days.
  • CCPA — California consumer privacy rights.
  • EU AI Act Article 50 — transparency disclosure for AI-generated content.
  • TAKE IT DOWN Act 2025 — non-consensual intimate imagery prohibition and removal SLA.

Authentication

Account creation and login over TLS only. Passwords hashed with bcrypt (cost factor 12). OAuth via Google with PKCE flow. Session tokens are HTTP-only secure cookies with SameSite protection. No password resets without email verification.

Infrastructure

GPU inference workloads run on isolated tenants. Per-customer data isolation enforced at the application layer. Audit logs of administrative access retained 12 months. Vulnerability disclosure: see security.txt.

Incident Response

Breach notification per GDPR Article 33 (72-hour clock to supervisory authorities) and per applicable US state laws. Incident response runbooks aligned with NIST SP 800-61. See trust page for the broader compliance posture.

Your Rights

  • Access: Request export of your account data (Article 15).
  • Delete: Account closure deletes all stored content within 30 days.
  • Portability: Account data exported in machine-readable JSON.
  • Object: Opt out of any legitimate-interest-based processing.

Exercise these rights via [email protected].

Related