Privacy Policy

The data controller responsible for the processing of your personal information on Sameface (sameface.in) is:

• Entity: {{COMPANY_LEGAL_NAME}}, a {{COMPANY_FORM}}
• Registered Address: {{REGISTERED_ADDRESS}}
• General Support: [email protected]
• Privacy & Data Protection Inquiries: [email protected]
• Legal Team: [email protected]

In accordance with the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023 (DPDP Act), our designated Grievance Officer is:

• Name: {{GRIEVANCE_OFFICER_NAME}}
• Email: [email protected]
• Address: {{REGISTERED_ADDRESS}}
• Acknowledgment Window: Within 24 hours of receipt [CONFIRM]
• Resolution Target: Within 15 business days of receipt [CONFIRM]

We collect information across three categories:

• Account Data: Your name, email address, password (stored in salted hashed format via Google Firebase Auth), and profile picture.
• Content Inputs: Scripts, character prompts, dialogue, voice samples, and uploaded reference images.
• Support and Feedback: Messages, bug reports, and survey responses you send to our support team.

• Device and Connection Information: Browser type, operating system, preferred language, and coarse regional location derived from your network.
• Usage Metadata: Timestamp of renders, episode generation duration, credit transactions, and tool usage events.
• Diagnostic and Error Logs: Crash traces scrubbed of email addresses and authentication tokens through automated PII scrubbers.
• Cookies and Local Storage: Necessary session cookies and preference tokens (see our Cookie Notice).

• Google Sign-In: If you register or authenticate using Google, we receive your verified email, display name, and avatar URL.
• Stripe Payment Status: When you subscribe or buy credits, Stripe returns transaction identifiers, card expiration dates, card brand, and subscription status. We do not receive or store your complete payment card number.

We process your data only where a valid legal basis exists under applicable data protection laws:

Sameface is powered by automated artificial intelligence pipelines.

To generate character visuals, synthetic voices, and animated scenes, your User Inputs (prompts, scripts, and reference images) are transmitted to secure third-party AI model providers {{AI_PROVIDERS}} via encrypted API connections.

• Sameface Models: We do not use your private scripts, character designs, or reference images to train our own public foundation models without your express opt-in consent [CONFIRM].
• Third-Party Model Providers: Our contracts and API terms with third-party providers specify that API payloads are not used to train external public foundation models {{PROVIDER_DATA_POLICY}} [CONFIRM per provider].

We do not sell, rent, or trade your personal information. We share data only with trusted infrastructure providers and subprocessors that assist us in operating the platform.

We may disclose information if required to do so by a lawful court order, subpoena, or valid law enforcement request. In the event of a merger, acquisition, corporate reorganization, or sale of company assets, user data may be transferred to the successor entity subject to this Privacy Policy.

Our servers, infrastructure providers, and subprocessors are located in several jurisdictions around the world, including India, the United States, and the European Union.

When we transfer personal information internationally, we take steps to ensure that your data continues to receive adequate protection, such as relying on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful cross-border transfer mechanisms [CONFIRM].

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected:

We implement administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, alteration, loss, or disclosure.

• Encrypted data transmission in transit using modern Transport Layer Security (TLS 1.3).
• Encrypted storage at rest for cloud databases and media repositories using industry-standard AES encryption.
• Automated PII scrubbing on error reports to prevent passwords, tokens, or personal identifiers from appearing in diagnostic logs.
• Server-side access controls and strict Firestore security rules preventing unauthorized database access.

No online computer system is 100% impenetrable. If we become aware of a security incident affecting your personal information, we will notify affected users and competent regulatory authorities in accordance with applicable laws.

Depending on where you reside, you may have statutory rights regarding your personal information:

• Right to Access: Request a copy of the personal information we hold about you.
• Right to Data Export: Export your generated videos, character assets, and scripts through your in-app settings.
• Right to Correction: Correct inaccurate or incomplete account information.
• Right to Deletion: Request permanent deletion of your account and personal data.
• Right to Withdraw Consent: Revoke consent for marketing emails or non-essential cookies at any time.
• Right to Lodge a Complaint: File a complaint with your local data protection supervisory authority.

You can manage account data, download videos, or initiate account deletion directly in your workspace settings. You may also contact our team at [email protected] or reach our Grievance Officer at [email protected]. We respond to verifiable privacy requests within {{DSAR_RESPONSE_DAYS}} days [CONFIRM].

Sameface is not intended for children under the minimum age of {{MINIMUM_AGE}}. We do not knowingly collect personal information from children under this age. If we learn that a child under the minimum age has created an account without verified parental authorization, we will promptly suspend the account and delete the associated data. If you believe a child has provided us with personal data, please contact [email protected].

If you are located in the EEA or UK, you enjoy rights under the General Data Protection Regulation (GDPR / UK GDPR). Our legal bases for processing are detailed in Section 3. You have the right to lodge a complaint with your national Data Protection Authority (DPA). Cross-border transfers outside the EEA are governed by approved transfer safeguards [CONFIRM].

For users located in India, personal data is processed in accordance with the Digital Personal Data Protection Act, 2023. You have the right to access a summary of your personal data, request correction or erasure, nominate another individual in case of death or incapacity, and access our grievance redressal mechanism as detailed in Section 1 [CONFIRM].

If you are a California resident, the California Consumer Privacy Act gives you the right to know what personal information we collect, request deletion, and request correction. We do not sell your personal information or share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than providing the Service [CONFIRM].

We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal requirements. When we make updates, we will update the "Last updated" date at the top of this page. For significant updates, we will provide additional notice through an in-app banner or email notification.

For questions regarding this policy, contact [email protected].