Privacy Policy
This policy explains what FaceEcho collects, why, who it is shared with, how long it is kept, and the control you have over it. It covers face data with particular care, because that is the most sensitive information we handle.
Who operates FaceEcho?
FaceEcho is operated by Vi Signal Inc., 5925 Almeda Rd, 12809, Houston, TX 77004, United States. In this policy, “we”, “us” and “our” refer to Vi Signal Inc.
For the purposes of India’s Digital Personal Data Protection Act, 2023, we are the Data Fiduciary. Under the EU and UK General Data Protection Regulation, we are the data controller.
For any privacy question, request or complaint, contact info@faceecho.ai.
Who does this policy apply to?
This policy applies to the FaceEcho mobile applications, the FaceEcho website at faceecho.ai, and any service that links to it. Our users are located primarily in India and the United States, and the policy is written to meet the requirements of both. If you are elsewhere, the rights described below still apply to you to the extent your local law provides them.
What information does FaceEcho collect?
We collect five categories of information: face data, account data, profile answers, device and log data, and — only with your permission — approximate location.
| Category | What it is | Why we collect it | How long we keep it |
|---|---|---|---|
| Face data | Photographs of your face and the readings derived from them | Your analysis, recommendations and progress tracking | While your account is active, and no more than 3 years from your last use |
| Account data | Name, email address | To create your account and contact you about it | Life of the account, then 30 days |
| Profile answers | Optional questions about your skin and goals | To tailor recommendations | Life of the account |
| Device & log data | Device model, OS version, app version, IP address, crash reports | To fix faults and keep the app working | Life of the account, then 30 days |
| Location | Approximate location, only if you allow it | To factor local air quality into recommendations | Not stored — used at the time of your request |
We do not sell your personal information. We do not use your face data for advertising, and we do not use it to train artificial intelligence models.
How does FaceEcho handle face data and biometric information?
Face data is the most sensitive information we hold, and this section governs it. Where anything else in this policy appears to conflict, this section takes precedence.
What counts as face data?
Face data means the photographs of your face that you upload, together with the facial geometry and measurements our analysis derives from them — for example readings relating to skin texture, hydration, redness, pores and visible blemishes. Under Illinois law this is a biometric identifier. Under the DPDP Act and the GDPR it is sensitive personal data.
Do you ask before collecting it?
Yes. We collect face data only after you have been told, in writing, that it is being collected, what it will be used for, and how long it will be kept — and only after you have given your express consent. You are never required to provide face data to use the app. Declining means only that the features which depend on analysis will not be available.
What is face data used for?
- Producing your facial analysis and the readings within it.
- Generating personalised skincare, makeup and routine recommendations.
- Letting you track changes over time by comparing analyses.
We do not use face data for any other purpose. We do not use it to identify you to anyone else, we do not match it against other people, and we do not disclose, sell, lease, trade or otherwise profit from it.
Who else processes your face data?
Facial analysis is performed by BrighTex Bio-Photonics (BTBP), which processes images on Google Cloud infrastructure located in the United States. BTBP acts on our instructions, may use the data only to perform the analysis, and must delete it within the period we specify.
We also send a limited set of derived information to the OpenAI API to generate written insights: your first name or a short identifier, together with analysis tags such as a skin condition reading. Photographs of your face are never sent to OpenAI, and neither are full email addresses. OpenAI’s terms for API data provide that this content is not used to train its models.
How long is face data kept, and when is it destroyed?
This is our published retention and destruction schedule, as Illinois law requires it to be published. We destroy your face data at whichever of the following comes first.
| Trigger | Destroyed |
|---|---|
| The purpose it was collected for has been satisfied | Once your analysis, recommendations and any progress tracking you have asked for are complete |
| Your account becomes inactive | Within 3 years of your last use of the service |
| You ask us to delete it | Within 7 days of the request |
| You withdraw your consent | Within 7 days of withdrawal |
| You close your account | Within 30 days of closure |
Destruction is permanent and covers copies held by our analysis provider. We do not extend these periods without asking you again.
What other information do you collect?
Beyond face data, we collect what you give us and a limited amount of technical information collected automatically.
Information you give us
- Your name and email address when you create an account.
- Optional answers about your skin type, concerns and goals.
- Anything you send us when you contact support.
Information collected automatically
- Device information — model, operating system and version, app version, language, and an app-generated identifier.
- Log and diagnostic data — IP address, timestamps, app configuration, and crash reports, collected through Google Analytics and UXCam.
- Approximate location, only where you have granted permission, and only to factor local air quality into recommendations. It is used at the time of the request and is not stored or shared.
We do not collect hardware serial numbers or IMEI numbers.
What is the legal basis for processing your data?
It depends on the purpose. The table below sets out each one.
| Purpose | Basis under the GDPR | Basis under the DPDP Act |
|---|---|---|
| Facial analysis and recommendations | Explicit consent — Article 9(2)(a) | Consent |
| Creating and running your account | Performance of a contract | Consent |
| Fixing faults, security, preventing abuse | Legitimate interests | Legitimate use |
| Meeting legal obligations | Legal obligation | Legal obligation |
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before you withdrew.
Who does FaceEcho share your data with?
We share data with five service providers, each bound by contract to process it only on our instructions and only for the purpose shown.
| Recipient | What they receive | Purpose |
|---|---|---|
| BrighTex Bio-Photonics | Face images and derived measurements | Performing the facial analysis |
| OpenAI | Analysis tags and a first name or short identifier — no images | Generating written insights |
| Google Cloud | Data at rest during processing | Hosting infrastructure |
| Google Analytics | Device and usage data | Understanding how the app is used |
| UXCam | Device, session and crash data | Diagnosing faults |
We may also disclose information where the law requires it, or to establish or defend legal claims. If Vi Signal Inc. is involved in a merger, acquisition or sale of assets, we will tell you before your information becomes subject to a different privacy policy.
Is your data transferred outside your country?
Yes. We are based in the United States, and our processing partners operate there too. If you are in India, the European Economic Area or the United Kingdom, your information will be transferred outside your country.
For transfers out of the EEA and UK we rely on the European Commission’s Standard Contractual Clauses together with the UK Addendum. For users in India, transfers are made to countries not restricted by the Central Government under the DPDP Act. You may request a copy of the safeguards that apply by writing to us.
How long does FaceEcho keep your data?
| Information | Retention |
|---|---|
| Face data | While the account is active; no more than 3 years from last use |
| Account and profile data | While the account is open, then 30 days |
| Diagnostic and crash data | While the account is open, then 30 days |
| Analytics data | As set in our analytics provider’s retention controls |
| Support correspondence | While needed to handle your enquiry, and for a reasonable period afterwards |
| Records we must keep by law | As the relevant law requires |
What rights do you have over your data?
Everyone can see, correct and delete their data, withdraw consent, and complain. Some regions add further rights.
Rights everyone has
- See what we hold about you and get a copy.
- Correct anything inaccurate or incomplete.
- Delete your information, including all face data.
- Withdraw consent at any time, as easily as you gave it.
- Complain to us, and to a regulator.
If you are in India
Under the DPDP Act you may also nominate another person to exercise your rights in the event of your death or incapacity, and you have the right to have a complaint heard. If we do not resolve it, you may complain to the Data Protection Board of India.
If you are in the United States
Depending on your state you may have the right to know what is collected and disclosed, to delete it, to correct it, to obtain a portable copy, to opt out of sale or targeted advertising, and to limit the use of sensitive personal information. We do not sell personal information and do not use it for targeted advertising. We will not discriminate against you for exercising any of these rights. If you are in Illinois, Texas or Washington, the biometric protections above apply to you specifically.
If you are in the EEA or UK
You may additionally object to processing based on legitimate interests, request restriction of processing, and receive your data in a portable format. You may lodge a complaint with your local supervisory authority.
How do you exercise these rights?
Two ways. In the app, go to Profile → Privacy → Manage my data, where you can download or delete your data and withdraw consent to face data processing. Or email info@faceecho.ai with “Data request” or “Complaint” in the subject line.
We acknowledge every request and complaint within 7 days and respond substantively within 30 days. We may ask you to confirm your identity before acting, and will only use what you give us for that purpose. Exercising these rights is free.
How does FaceEcho handle children’s data?
The age at which a person can consent for themselves differs by country, and we apply the stricter rule where both could apply.
| Where you are | A child is | What we require |
|---|---|---|
| India | Under 18 | Verifiable consent from a parent or lawful guardian before any processing |
| United States | Under 13 | Verifiable parental consent; the service is not directed at children under 13 |
| EEA / UK | Under 16, or the lower age your country sets | Consent from a person with parental responsibility |
We do not knowingly collect face data from a child without the consent described above. We do not use a child’s data for tracking, behavioural monitoring or targeted advertising. If you believe a child has provided information without proper consent, write to info@faceecho.ai and we will delete it.
How is your data kept secure?
We use technical and organisational measures designed to protect your information, including encryption of data in transit, access controls that limit who can reach face data, and contractual security obligations on the providers who process it on our behalf. Access is restricted to personnel who need it to do their job.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal data we will notify you and the relevant authorities as the law requires — including the Data Protection Board of India within the timeframe the DPDP Rules set.
Does FaceEcho use cookies?
Our website uses cookies and similar technologies for functionality and analytics. The apps do not use cookies, but third-party components within them may set similar identifiers. You can refuse non-essential cookies through the banner on our website or through your browser, though some features may not work as a result.
What about links to other sites?
Our service may link to sites we do not operate. We are not responsible for their content or their privacy practices, and we encourage you to read their policies before providing information to them.
How will you be told about changes to this policy?
We may update this policy. Where a change is material — a new purpose, a new category of recipient, or a longer retention period — we will tell you in the app or by email before it takes effect, and where the law requires it we will ask for your consent again. The date at the foot of this page always reflects the current version.
How do you contact us?
Vi Signal Inc.
5925 Almeda Rd, 12809
Houston, TX 77004
United States
Privacy enquiries, requests and complaints: info@faceecho.ai
Related documents: Terms of Service · End User Agreement · Close my account
Last updated 13 September 2026.