This document explains what data FaceMirror collects, how it is processed, stored, and shared. The document complies with the principles of the EU General Data Protection Regulation (GDPR).
FaceMirror service operator. Contact email: contact@facemirror.online.
The service requires access to microphone and camera for up to 7 minutes during the test. The audio stream is sent to a speech recognition service and is not stored. The video stream is processed locally in your browser to extract facial expression parameters; video frames are never transmitted to the server.
Audio is converted to text by an external service. The resulting text is stored and used for behavioral pattern analysis and comparison with future sessions. The transcription may incidentally contain personal information mentioned during the session (such as names, places, or other identifying details); this content is treated as personal data and retained for the full data retention period.
Numerical indicators are extracted from audio and video — speech rhythm, pauses, aggregated facial expression scores (tension level, dominant expression category), vocabulary characteristics. Stored and used to generate the report.
If you complete the questionnaire, your responses are stored and used together with behavioral metrics to calculate agreement between self-report and observed behavior.
Optional fields: age range, native language, previous-session FM code. Optional and does not block test completion.
Used for delivery of personal report and for letters in response to your requests (data access).
IP address, browser type, session timestamp are automatically recorded for diagnostics. Not associated with email unless necessary.
This is exactly what FaceMirror stores after a completed session:
| Data type | What is stored |
|---|---|
| Email address | Links your session to your account. Deleted on request, or after the retention period in section 6. |
| Your spoken responses | Text transcript only. The audio recording is not stored. |
| Facial analysis | Numerical metrics (e.g. symmetry index, movement frequency). No images or video frames. |
| Voice analysis | Numerical metrics (e.g. pause duration, speech rate). No audio recording. |
| Self-description answers | Your responses to the questionnaire, as text. |
| Session metadata | Timestamp, language, technical quality indicators. |
Video is processed locally in your browser. Raw video frames are never transmitted to our servers. Audio is sent to a speech recognition service for transcription only; we do not retain audio recordings. Third-party retention is described in section 7.
Audio recording after conversion to text. Video imagery is never transmitted to the server.
Speech transcription text, numerical metrics, questionnaire responses, demographic data (if provided), email, generated report.
Data is retained for up to 36 months from the date of your session, or until you submit a deletion request — whichever comes first. You have the right to request deletion at any time.
External service providers are used. Data shared with each is minimal and limited to the processing purpose.
Audio is transferred to Whisper API for conversion to text. Per OpenAI's public policy, API data is not used for model training and is deleted after processing.
Transcribed text and numerical metrics are transferred to Claude API. Per Anthropic's policy, API data is not retained and not used for model training.
Email and report content are transferred to Brevo for letter delivery.
Data is stored in a managed Supabase database. Access is protected by Row Level Security: read and write are possible only via the FaceMirror server-side application.
At any time you may:
Email requests are processed within 30 calendar days. Before processing, a confirmation email is sent to verify the address.
The service is not intended for individuals under 18. If you are a legal representative of a minor under 18 whose data was uploaded without your consent — contact the operator, data will be deleted.
The service is not intended for personal identification, medical diagnosis, psychological assessment, or decisions affecting user rights.
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to request deletion, and the right to opt out of the sale of personal information.
FaceMirror does not sell your personal information as defined under the CCPA. De-identified data used for internal research is not considered a sale under applicable law.
To exercise your rights, contact: contact@facemirror.online or use the data request page.
Material changes are published on this page with a new effective date. Continued use of the service after publication of changes constitutes acceptance of the new version.
Email for all questions: contact@facemirror.online