Privacy Policy

We collect the following categories of personal data:

• Account data — your email address and name, and, if you sign in with a provider such as Google, the basic profile details that provider returns.
• Content you upload — the selfies and reference images you provide to create and use a character (see Section 2).
• Generated media — the photo avatars and videos you create, stored so you can access and download them.
• Payment data — when you subscribe or buy credits, billing is handled by Stripe. We receive limited details such as the last four digits and card brand and your subscription status; we do not receive or store your full card number.
• Usage & device data — basic logs, credit balances and transactions, and diagnostic information needed to operate and secure the Service.

To create a character, you upload a small set of selfies. These face images are processed to train a personalized machine-learning model — a mathematical representation of your facial features. Depending on where you live, this face model may be considered biometric data and given special protection under law. We ask for your consent before you upload selfies and use them for this purpose.

How we handle your selfies and face model:

• Purpose limitation — your selfies and face model are used only to train your character and to generate the outputs you request. We do not use them to identify you elsewhere, to build advertising profiles, or to train models for other users.
• Storage — uploaded selfies and generated media are stored as private objects in cloud storage (Amazon S3). Files are not public; access is granted only through short-lived, signed URLs generated when you (or the Service on your behalf) need them.
• Retention — we keep your selfies and face model for as long as the associated character exists in your account. When you delete a character, or delete your account, the associated selfies and trained model are scheduled for deletion.
• Deletion — you can delete a character at any time, and you can delete your entire account, which removes your characters, selfies, face models, and generated media from active systems (see Section 6).

Generating photos and videos requires specialized AI models. Some of this processing is performed by third-party AI providers acting as our processors — for example, providers that run image-generation and video-generation models. When a generation runs, the inputs needed for that generation (such as your character reference and the prompt) are sent to the relevant provider to produce your Output, and are processed under contractual terms that restrict use to providing the service to us.

We also rely on Stripe for payment processing and may use an email provider (such as SendGrid) to send transactional messages like verification and receipts. These providers process data on our behalf and are not permitted to use it for their own purposes.

We use a small number of strictly necessary cookies to keep you signed in and to secure your session. Authentication tokens are stored in HttpOnly cookies, which are not readable by client-side scripts, reducing the risk of token theft. We do not use these cookies for advertising. Because they are essential to the Service, they cannot be switched off from within the app.

We process your personal data to:

• Provide the Service — create and store characters, generate and deliver your photos and videos;
• Operate accounts, authentication, and the server-authoritative credit and subscription system;
• Process payments and prevent fraud and abuse;
• Communicate with you about your account (verification, receipts, important service notices);
• Maintain security, debug issues, and comply with legal obligations.

Subject to your local law, you have the right to access, correct, export, and delete your personal data, and to withdraw consent for biometric processing. The most complete way to exercise erasure is the Delete account action in your account settings, which removes your characters, selfies, trained face models, and generated media from active systems; backups are purged on a rolling schedule.

You can also delete individual characters at any time to remove their selfies and face model while keeping your account. To make any other privacy request, contact us using the details in Section 9.

We keep personal data only as long as needed for the purposes above: account and content data for the life of your account; selfies and face models for the life of the associated character; billing records for as long as required by tax and accounting law. When data is no longer needed it is deleted or anonymized.

MyAvatar is intended for adults. You must be at least 18 years old to use the Service, and you must not upload images of anyone under 18. We do not knowingly collect personal data from children; if we learn we have, we will delete it.

We may update this Privacy Policy from time to time. Material changes will be reflected in the “Last updated” date above and, where appropriate, communicated to you.

For any privacy question or request, contact our privacy team at privacy@musavir.ai.