FrameFinder Privacy Policy

Summary for humans

Question	Short answer
Do my face scans leave my computer?	Yes — but only derived data, and only if you opt in. Face detection and embeddings run locally on your device. If you opt in to cloud processing, derived face embeddings (mathematical descriptors, not photographs) and the person names you assign are sent to our servers to power recognition features. Your original media files are never uploaded.
What do you store on your servers?	Account data (name, email, password hash), billing references, and — only if you enable cloud processing — derived face embeddings, face-bearing keyframes, and the person names you assign. Never your original media files.
Do you sell my data?	No. We do not sell personal information.
Who else touches my data?	Supabase (auth/database), Cloudflare (connectivity), Stripe (payments), TMDB & kino.is & Wikimedia Commons (metadata/content lookups).
Can I delete everything?	Yes — deletion rights below; local data can be wiped by deleting the app's index.

1. Who we are

FrameFinder is a desktop application for AI-powered video frame search, provided by Cine Pro for Artistic Production S.A.E. ("FrameFinder", "we", "us"). This policy covers the FrameFinder desktop application, the FrameFinder website and waitlist, and the admin dashboard.

2. What we collect

2.1 On our servers (account & web)

Data	Purpose	Legal basis (GDPR)	Retention
Name, email	Account creation, waitlist	Contract performance (Art. 6(1)(b)); legitimate interest (waitlist)	While the account is active, plus 5 years after deletion (legal, tax, and fraud-prevention obligations); waitlist-only emails: 24 months of inactivity
Password	Authentication — stored only as a salted hash (bcrypt/argon2)	Contract	Until account deletion
Subscription tier & billing references	Entitlement, billing	Contract; legal obligation	7 years (tax law)
Support correspondence	Support	Legitimate interest	24 months
Server logs (IP, timestamps, API calls)	Security, abuse prevention	Legitimate interest	90 days

2.2 On your device — and the limited data that travels

Never uploaded:

• Your original video and photo files — read locally, never uploaded.
• Your full media archive or folder contents.

Sent to our servers (derived data only, with opt-in cloud-processing consent):

Data	Purpose	When sent
Face embeddings (512-dimension mathematical descriptors, not photographs) + the person names you assign	Cross-device face suggestions and recurring-face recognition	Only if you opt in to cloud processing (see §3.4 consent)
Face-bearing keyframe images	Server-assisted indexing and face verification	When local processing is unavailable, or when you verify a match — only with cloud-processing consent
Search queries (text or a submitted image)	Generating search embeddings	Per query

We do not receive or store your media library, your files, or your folder contents.

2.3 Lookups sent to third parties (content metadata, not biometric)

• TMDB API — film/actor metadata queries and cast photos (TMDB terms apply).
• kino.is — Arabic title enrichment queries.
• Wikimedia Commons — celebrity reference images (licensed CC/PD only).

3. Biometric processing — the important part

3.1 What the app does

FrameFinder detects faces in video files you select on your own device and computes mathematical representations ("face embeddings") locally. You may match faces against a built-in gallery of public figures compiled from openly licensed images (Wikimedia Commons: CC0/CC-BY/CC-BY-SA/Public Domain only).

3.2 Our role — and what we do NOT do

• We act as the data controller for the derived biometric data described in §2.2 when it reaches our servers; we do not sell, lease, or trade biometric identifiers or biometric information — in any jurisdiction, including under Illinois BIPA (740 ILCS 14 §15(c)).
• We do not use biometric data for advertising or profiling.
• We do not use biometric data for model training.

3.3 Your responsibilities (see Terms of Service §4)

The faces in your videos may belong to third parties (family, guests, performers). You are responsible for your lawful basis to process that content. FrameFinder indexes your media on your own device, transmitting only the limited derived data described in §2.2; we cannot and do not consent on behalf of persons appearing in your media.

3.4 Illinois BIPA notice & release (applies to Illinois residents)

If you enable cloud processing, we provide this written notice: the app creates face-geometry scans (embeddings) from videos you index, and derived embeddings, the person names you assign, and face-bearing keyframe images are transmitted to and stored on our servers to power recognition features (see §2.2). Retention: server-stored embeddings persist only while your account is active; they are never sold or shared; they are deleted within 30 days of a deletion request or account closure — and in any case no later than 3 years after your last interaction with the app (BIPA §15(a)). Locally stored embeddings are destroyed when you delete the person profile, wipe the index, or uninstall with data removal. Disabling cloud processing or revoking consent in Settings → Privacy stops all biometric transmission immediately. By enabling cloud processing in the app's consent screen, you give a written release (electronic signature per BIPA as amended 2024) for this processing. [Counsel must confirm this controller framing and the server-transmission disclosure against BIPA precedent.]

3.5 GDPR special-category note

Face embeddings are biometric data under GDPR Art. 4(14). Where face embeddings reach our servers (§3.2), we act as data controller relying on explicit consent (Art. 9(2)(a)) captured via the separate cloud-processing consent control — never bundled into general terms acceptance. Withdrawal via Settings → Privacy stops all further transmission and processing; erasure of server-stored embeddings is a separate explicit action — request it via Settings → Privacy or [email protected] — after which they are deleted within 30 days (§3.4). For face processing that stays on your device, you remain the controller of your local data.

4. How we use server-side data

Providing the service, authentication, billing, security/abuse prevention, product improvement using aggregated, de-identified statistics only, and legal compliance.

5. Sharing

Service providers under contract: Supabase (auth/database — Egypt hosting), Cloudflare (tunnel/CDN/WAF), Stripe (payments — we never see full card numbers), Resend (transactional email). No sale of personal information (CCPA/CPRA "sale"/"share" — none). Law-enforcement disclosure only where legally required.

6. International transfers

Data is stored in Egypt (Supabase hosting in Egypt). Transfers from the EEA/UK rely on [SCCs / adequacy — counsel to select mechanism].

7. Your rights

Region	Rights
GDPR (EEA/UK)	Access, rectification, erasure, portability, restriction, objection; withdraw consent at any time; complain to your supervisory authority
CCPA/CPRA (California)	Know/access, delete, correct, opt-out of sale/share (none occurs), non-discrimination
Other US states	Equivalent rights under VA/CO/CT/UT and successors — honored via the same channel

Exercise via [email protected] or in-app Settings → Privacy → Export/Delete. We verify requests before acting and respond within statutory timelines (30 days GDPR / 45 days CCPA).

8. Security

We apply reasonable administrative, technical, and organizational safeguards: encrypted transport (TLS), hashed credentials, scoped service credentials, least-privilege access. No system is 100% secure; we do not promise absolute security.

9. Children

FrameFinder is not directed at persons under 18. We do not knowingly collect children's data. [Age gate needed on signup to enforce the 18+ floor.]

10. Retention

See §2 tables. Guiding rule: we keep server data only while the purpose persists. After account deletion, core account records are retained for 5 years for legal, tax, and fraud-prevention purposes — except server-stored biometric data, which is deleted within 30 days of a deletion request or account closure per §3.4. Local data persists until you delete it — we cannot access it to delete it for you.

11. Changes

We will post updates with a new effective date and, for material changes, require re-consent in-app (see legal/consent-flow-spec.md).

12. Contact

Cine Pro for Artistic Production S.A.E. · First Floor, 14 Tiba Street, Mohandessin, Giza, Arab Republic of Egypt · [email protected]

---

This draft must be reviewed by qualified counsel (US biometric law + GDPR) before publication. All bracketed items are open decisions.