Privacy Policy
Last updated: November 4, 2026
This policy explains what personal data Repicto collects, why we collect it, who we share it with, and what you can do about it. Please read it alongside our Terms and Refund Policy.
Summary of key points
- Who we are: Repicto is run by Aurelios Group LTD, a UK company. Email us at privacy@repicto.com for any privacy request.
- What we use: your account details, the selfies you send to train your face model, the photos you upload to fix, the results, and payment and usage records.
- Face data: we compute face measurements from your photos and train a personal face model from your selfies. This is biometric data. We process it only with your explicit consent, which we record.
- We never use your photos or face data to train or improve our general AI models.
- We never sell, rent, trade or share your face data for advertising.
- How long: your training selfies and face model are deleted when you delete them or your account, or after 90 days without activity on your account, whichever comes first. The full schedule is in section 9.
- Your choices: you can access, correct, delete or export your data, and withdraw consent at any time. Withdrawing biometric consent means we delete your face model and selfies.
- Age: Repicto is for people aged 18 and over.
1. Who we are
Repicto is a web app at repicto.com. It is run by Aurelios Group LTD, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. In this policy, "Repicto", "we" and "us" mean Aurelios Group LTD. For the Repicto service, we are the controller of your personal data.
Here is what the service does. You upload several selfies. We use them to train a personal AI model of your face. We then use that model to fix faces in photos you choose, for example to open closed eyes or soften an expression. The rest of the photo stays as it was.
For any privacy question or request, email privacy@repicto.com.
2. Information we collect
We collect the information below. Some of it you give us, some of it comes from third parties you choose to sign in with, and some of it is collected automatically when you use the site.
- Account details: your email address. If you sign in with Google or Apple, we receive your name and email address from them. We sign you in with a 6-digit code sent to your email.
- Photos: the selfies you upload to train your face model, the photos you upload to fix, and the edited results.
- Face data: face measurements (face embeddings) computed from your photos, and the personal face model trained from your selfies. See section 3.
- Onboarding answers: your answers to the quiz shown when you start.
- Consent records: your acceptance of our terms and your biometric consent, with the date and time you gave each one.
- Payment records: card details are entered with and handled by our payment processor. They never touch our servers. We keep your plan, subscription, invoice, refund and dispute records.
- Usage and marketing data: a first-party visitor cookie called
ff_vid, the ad campaign you arrived from (UTM parameters), the steps of our sign-up funnel you reach, and which test version of a page you saw. - Notifications: a browser push subscription, only if you allow notifications.
- Technical data: your IP address, device and browser information, server logs, and the result of a bot-protection check.
3. Biometric (face) data
Repicto works with faces, so some of the data we process is biometric data. This includes:
- Face embeddings: numbers that describe the features of a face, computed from your photos.
- Your personal face model: the AI model trained from your selfies.
We process this data only with your explicit consent, which we record with the time you gave it. We use it only to make edits to your own photos and to check that a result still looks like you. We never sell, rent, trade or share it, and we never use it for advertising.
You can withdraw your consent at any time. When you do, we delete your face model and your selfies. After that, the Service can no longer make face edits for you. To withdraw consent, email privacy@repicto.com.
4. How we use your information
We use your information to:
- create and run your account, and sign you in;
- train your personal face model, make edits to your photos, and check the likeness of the results;
- take payments, manage subscriptions, send invoices, and handle refunds and disputes;
- keep records of your consents and of your onboarding answers;
- send you emails, such as sign-in codes and important notices about the Service, and push notifications if you allowed them;
- understand which ads and pages bring visitors to us, and test different versions of our pages;
- keep the Service secure, prevent fraud and abuse, and stop bots;
- meet our legal and tax obligations.
We never use your photos or face data to train or improve our general AI models. Your face model is used only for your own edits.
7. Where your data is stored
Our data is stored and processed in the United States. When we send personal data from the UK or the EEA to providers in the United States, we protect it with one of these safeguards:
- the European Commission's Standard Contractual Clauses;
- the UK International Data Transfer Addendum; or
- the EU-US Data Privacy Framework and the UK Extension, where the provider is certified under them.
8. How we keep your data secure
- Data travels between your browser and us over encrypted HTTPS.
- Stored files are kept in private storage that is not publicly accessible.
- Access is limited to the systems and people who need it for their work.
- Card details never touch our servers. Our payment processor handles them.
9. How long we keep your data
This table shows how long we keep each kind of data.
| Data | How long we keep it |
|---|---|
| Data about a visitor who never creates an account | Deleted after 7 days. |
| Edited photos and results | Deleted 90 days after they were created. |
| Training selfies and your personal face model | Deleted when you delete them or your account, or after 90 days without any activity on your account, whichever comes first. |
| Anything you delete | Permanently erased from our systems within 15 days. |
| Payment and invoice records (plans, subscriptions, invoices, refunds, disputes) | Kept for as long as tax and accounting law requires. |
10. Your rights
Depending on where you live, you can ask us to:
- tell you what personal data we hold about you (access);
- correct data that is wrong;
- delete your data;
- restrict how we use your data;
- object to certain uses of your data;
- give you a copy of your data in a usable format (portability, or an export);
- withdraw any consent you have given, at any time. Withdrawing consent does not affect what we did before you withdrew it.
To use a right, email privacy@repicto.com. We may ask you to confirm your identity before we act on a request. To delete your account, send us that request by email. We answer within one month under UK and EU law, and within 45 days for California residents.
We make no decisions about you based solely on automated processing that have legal or similarly significant effects.
You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority in the EU country where you live. We would welcome the chance to answer your question first, so please contact us before you complain.
11. UK and EEA residents
If you live in the United Kingdom or the European Economic Area, the UK GDPR or EU GDPR applies to our processing of your personal data. Aurelios Group LTD is the controller. Our legal bases are below.
| Purpose | Legal basis |
|---|---|
| Running the Service and taking payments | Contract: we need this data to provide the Service you ask for. |
| Face data: the face embeddings and your personal face model | Your explicit consent (special category data, Article 9(2)(a)). You can withdraw it at any time, which means we delete your face model and selfies. |
| Advertising cookies and pixels; push notifications | Your consent. You can change your choice at any time. |
| Security, fraud and bot prevention, and service analytics | Our legitimate interests in keeping the Service safe, reliable and working well. |
| Tax and accounting records | Legal obligation: we must keep these records. |
Section 7 explains how we protect personal data sent to the United States. Section 10 explains your rights and how to complain.
12. California residents
This section is for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA").
Categories of personal information we collect, as the CCPA describes them:
- Identifiers: your email address, IP address, and device and browser identifiers.
- Commercial information: plan, subscription, invoice, refund and dispute records.
- Biometric information: face embeddings and your personal face model. This is sensitive personal information under the CCPA.
- Internet or other electronic network activity: your visitor cookie, the funnel steps you reach, which ad you came from, and server logs.
- Geolocation data: a rough location inferred from your IP address.
- Inferences: we do not create inferences about you.
We do not sell personal information for money. Sending data from our pages to Meta and Google through their advertising pixels may count as "sharing" under the CCPA, because it can be used for cross-context behavioral advertising. Pixels load only after you accept advertising cookies.
You can opt out of this sharing with the "Do Not Sell or Share My Personal Information" link, which you will find in the cookie settings. We also honor the Global Privacy Control (GPC) browser signal. If your browser sends it, we treat it as a request to opt out.
We use your biometric information only to provide the Service, as described in section 3. We will not discriminate against you for using your privacy rights. We keep personal information for the periods in section 9.
You can ask us to tell you what we hold about you, to correct it, to delete it, or to opt out of sharing, using the contact details in section 16. We respond within 45 days.
13. US state biometric privacy laws
Some US states, including Illinois (Biometric Information Privacy Act), Texas and Washington, have laws about biometric identifiers. For residents of those states, we do the following:
- We collect face data only after you give written consent, and we keep a record of that consent.
- We collect it only to provide the Service: to train your personal face model, make edits to your photos, and check likeness.
- We keep it and destroy it on the schedule in section 9.
- We never sell, lease or trade it, and we never profit from it.
14. Age limit and children
Repicto is only for people aged 18 and over. When you sign up, you confirm that you are 18 or older. We do not knowingly collect personal data from anyone under 18. If we learn that we have data from a minor, we will delete it. If you think a minor has given us their data, email privacy@repicto.com.
15. Changes to this policy
We may update this policy. When we do, we will post the new version here with a new "Last updated" date. If a change is material, we will also tell account holders by email before it takes effect.
16. Contact us
For any question about this policy, or to use your rights, email privacy@repicto.com. You can also write to us at Aurelios Group LTD, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.