Your privacy is foundational to how Neovace is built. This policy explains what we collect, why, how long we keep it, and the rights you have over it — under the GDPR and applicable laws.
This Privacy Policy explains how Neovace ("we", "us", "our") collects, uses, shares, and protects the personal data of visitors and customers of neovace.com (the "Service").
It applies to everyone who interacts with the Service, regardless of their country of residence. For users in the European Union, we comply with the General Data Protection Regulation (GDPR) as the standard framework, since it offers among the strongest protections worldwide.
Three commitments worth knowing upfront: (1) we never sell your data; (2) we never use your photos to train any public model; (3) your photos and AI model are automatically deleted within 30 days.
The data controller responsible for the personal data processed through the Service is:
For all questions about your personal data — access, deletion, rectification, portability, complaint — please write to the address above.
We collect only the data strictly necessary to deliver our Service. Specifically:
Your data is processed exclusively for the following purposes:
Under Article 6 of the GDPR, each processing operation rests on at least one of the following legal bases:
| Processing | Legal basis (GDPR Art. 6) |
|---|---|
| Service delivery, training of your AI model | Performance of a contract — Art. 6(1)(b) |
| Account creation and management | Performance of a contract — Art. 6(1)(b) |
| Billing and tax compliance | Legal obligation — Art. 6(1)(c) |
| Customer support | Legitimate interest — Art. 6(1)(f) |
| Service improvement and analytics | Legitimate interest — Art. 6(1)(f) |
| Marketing emails (newsletter) | Consent — Art. 6(1)(a) |
Because our Service relies on artificial intelligence applied to your selfies, we want to be especially clear about what we do — and what we never do.
| Data | Retention period |
|---|---|
| Uploaded selfies (Inputs) | Maximum 30 days after order delivery, then automatic deletion |
| Private AI model | Maximum 30 days after order delivery, then automatic deletion |
| Generated portraits (Outputs) | Available in your dashboard until you delete them or close your account |
| Account data (name, email) | Until you request closure of your account |
| Invoices and billing data | 10 years (legal obligation: tax and accounting) |
| Support communications | 3 years after the last interaction |
| Server logs | 12 months maximum |
We share your data only with the trusted technical service providers ("processors") strictly necessary for the operation of the Service. Each one is bound by a contract requiring GDPR-compliant data protection.
| Processor | Purpose |
|---|---|
| Stripe Payments Europe Ltd. (Ireland) | Payment processing, fraud prevention |
| Cloudflare, Inc. (USA, with EU edge) | Hosting, CDN, DDoS protection |
| EU-based GPU compute provider | AI model training and inference (servers in the European Union) |
| Email-delivery provider | Sending transactional emails (order confirmations, magic links) |
We do not sell or transfer your data to any third party for marketing purposes. We may also disclose your data when required by a competent legal authority (court order, judicial request).
Although the bulk of personal data is processed within the European Union, certain processors are based outside the EU (notably in the United States).
For each transfer outside the European Union, we rely on the appropriate safeguards provided by the GDPR, in particular:
You may request a copy of the safeguards in place for any specific transfer by writing to support@neovace.com.
We use a limited number of cookies to operate the Service correctly and to measure its audience. Detailed information is provided in our dedicated Cookie Policy.
If you are located in the European Union (or a country with similar protections), you have the following rights regarding your personal data:
To exercise any of these rights, send an email to support@neovace.com. We respond within thirty (30) days at the latest. To prevent fraud, we may ask you to confirm your identity before processing the request.
The Service is reserved for users aged 18 and over. We do not knowingly collect personal data from anyone under 18 years of age.
If you become aware that a minor has provided us with personal data without parental authorization, please contact support@neovace.com so we can delete the data immediately.
We apply technical and organizational measures appropriate to the level of risk to protect your data:
In the unlikely event of a personal-data breach, we will notify the affected users and the relevant supervisory authority within 72 hours, in accordance with Articles 33 and 34 of the GDPR.
We may update this Privacy Policy from time to time, in particular to reflect changes in our processors, applicable law, or our internal practices. The current version is always accessible at neovace.com/privacy.
For significant changes, we will notify registered users by email at least 30 days before the changes take effect.
For any question about this Privacy Policy, to exercise your rights, or to file a complaint, please contact us:
We respond to every inquiry within 30 days at the latest, and most often within 24 hours.