1. What biometric data we process
SenurPRO processes biometric data — specifically face embeddings (also called "faceprints") — for one purpose only: to detect unauthorized copies of a creator's content across the web.
The only biometric data we ever store is the faceprint derived from reference images provided or expressly confirmed by you, the enrolled creator, during the enrollment flow. These reference images come exclusively from content you upload directly or from your own public catalog that you authorize us to fetch.
No biometric data belonging to any third party is ever stored. Face embeddings computed from third-party imagery (such as potentially infringing content found during a scan) are derived transiently in memory solely to perform a one-time comparison against your stored faceprint, then immediately discarded. They are never written to any database, log, cache, or backup.
2. What we never do
We never persist face embeddings of persons who have not consented. There is no database table, index, or data store that holds face vectors for anyone other than the enrolled, consenting creator. This is an architectural constraint enforced in code, not merely a policy statement.
We never build or contribute to a searchable database of faces. The computational step during a scan is strictly match-and-discard: one comparison, one result, zero retention.
We never store explicit imagery on our own servers. When scan evidence is required for a DMCA notice, only perceptual hashes and source URLs are stored on our servers. Any actual image bytes used as evidence are held in encrypted object storage (Cloudflare R2, server-side encrypted) and are never written to the application server disk. Thumbnails used for your review inside the dashboard are served directly from R2 and do not reside on the application server.
We never sell, license, trade, or otherwise profit from biometric data.
3. Consent
Biometric processing begins only after you provide explicit, written consent during enrollment. The consent flow presents the exact purpose, scope, and retention terms of the processing in plain language before any biometric data is captured.
Consent is versioned: we record the specific consent text you agreed to, the date and time of consent, and the version identifier. This record is retained for the life of your account and for as long as required by law after deletion, to demonstrate compliance.
Consent is voluntary and fully reversible. You may withdraw consent and request deletion of your biometric data at any time by contacting us at the address in Section 7. Withdrawal of consent stops all face-matching for your account and triggers the deletion process described in Sections 4 and 5.
4. Retention schedule
Your faceprint is retained for as long as your account is active and no longer. Specifically, your stored face embeddings are deleted upon the first of the following events:
(a) You close your account or request deletion of your biometric data.
(b) Three years pass from your last authenticated interaction with the service.
The three-year outer limit is chosen to satisfy the Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14/15(a)), Colorado's biometric retention requirements (effective July 1 2025), and similar state laws. We do not rely on this outer limit as an operating default — active accounts are served continuously and deletion on closure is immediate.
We do not retain biometric data beyond the minimum period necessary to provide the protection service you enrolled for.
5. Destruction procedure
Upon account closure or a verified deletion request, your face embeddings are permanently deleted from the live database within 72 hours of the triggering event. You will receive a confirmation email once live deletion is complete.
Encrypted backups are rotated on a 30-day cycle. Because backups are encrypted before being uploaded to object storage, deleted records are not recoverable from backups after the backup that first captured the deletion request has been overwritten — which occurs within 30 days. There is no manual re-introduction of deleted biometric data.
Deletion is permanent and irreversible. If you re-enroll after deletion, you begin a new enrollment and a new consent record is captured.
6. Security measures
Face embeddings are encrypted at rest using application-level envelope encryption (AES-256-GCM with per-record data encryption keys wrapped by a key-encryption key held outside the database). This means that even a full database export does not expose plaintext biometric data.
Encryption keys are managed independently of the database server and are rotated on a schedule or immediately upon a suspected security event.
Row-level security policies isolate each creator's data at the database layer. No application code path can access one creator's biometric records while acting in the context of another creator's session.
All access to biometric records is logged in an append-only audit trail that is shipped off the production server. Logs cannot be modified by an application-level compromise.
Data in transit between your browser, our servers, and object storage is protected by TLS 1.3.
7. Your rights and how to contact us
You have the right to: access a copy of the biometric data we hold about you; request correction of inaccurate data; request deletion of your biometric data at any time (see Section 5); object to or restrict processing; and, where applicable under GDPR Art. 20, receive your data in a portable format.
If you are located in the European Economic Area, United Kingdom, or a jurisdiction with equivalent data-protection law, you also have the right to lodge a complaint with your local supervisory authority.
To exercise any right, or with any question about this policy, contact us at:
Contact
Email: [email protected]
For data subject requests (access, erasure, portability) we aim to respond within 30 days. For urgent matters — including a suspected breach affecting your biometric data — please include "BIOMETRIC URGENT" in your subject line and we will acknowledge within 72 hours.
This policy may be updated from time to time. Material changes will be communicated by email and the version number and effective date above will be incremented. Continued use of the service after the updated effective date constitutes acceptance of the revised policy.