Biometric Data Policy

1. What Is Biometric Data?

As used in this Policy, "Biometric Data" means:

• Biometric identifiers — unique biological characteristics used to identify individuals, including retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, and other similar identifiers.
• Biometric information — any information, regardless of how it is captured, converted, stored, or shared, based on a biometric identifier that is used to identify an individual.

Biometric Data does not include information derived from items or procedures excluded under applicable law, such as photographs themselves (as distinct from facial geometry extracted from photographs), writing samples, or physical descriptions.

2. What Biometric Data We Collect

SplatChat collects the following Biometric Data:

2.1 Facial geometry from uploaded photographs

When you upload a photograph to create a custom avatar, our AI systems extract and process facial geometry — a scan of face geometry — from the photograph in order to generate a 3D Gaussian Splat avatar model. This facial geometry extraction constitutes collection of a biometric identifier under BIPA and similar laws.

The original photograph is stored separately and is also protected under this Policy. The derived 3D model contains embedded facial geometry data.

Reference photographs (dual-image mode). For stylized or animated characters, you may optionally provide a separate “reference photograph” in addition to the primary character image. The reference photograph is used solely for geometry extraction to ensure accurate facial animation; the visual appearance of the avatar is derived from the primary image. The reference photograph and any facial geometry extracted from it are subject to the same protections as any other photograph uploaded under this Policy. You must have the same rights, consent, and legal authorization to upload a reference photograph as you do for the primary photograph.

2.2 Voice characteristics during real-time calls

During video call sessions, your voice is transmitted in real time for speech recognition and response generation. Your voice patterns and characteristics may constitute a voiceprint (a biometric identifier) under applicable law. Outside of the opt-in voice cloning feature described in Section 2.3, we do not permanently store or enroll voice biometric templates: call audio is processed in-session and discarded when the session ends.

2.3 Voice samples for voice cloning (opt-in)

If you choose to use the voice cloning feature, you record or upload audio samples of a voice, and we create a synthetic voice model (a voiceprint) from those samples via our service provider ElevenLabs. Both the audio samples and the derived voice model constitute biometric identifiers under BIPA and similar laws.

Voice cloning is strictly opt-in and requires your explicit, affirmative consent at the time of creation. You must attest that you are the speaker in the samples, or that you have the speaker's explicit permission to clone their voice. Cloning another person's voice without their consent is prohibited and violates our Acceptable Use Policy.

Your audio samples are stored in a private, access-controlled storage bucket (never publicly accessible), and the derived voice model is stored with ElevenLabs. Both are retained only while the voice clone exists in your account, and both are destroyed when you delete the clone (see Section 7).

3. How We Use Biometric Data

We use Biometric Data for the following purposes and no others:

• Avatar generation. Extracting facial geometry to construct a photorealistic 3D avatar model.
• Avatar animation. Using the 3D model and associated facial geometry to drive real-time lip-sync, facial expressions, and head movement during conversations.
• Pipeline quality improvement. We may use aggregated, de-identified facial geometry data (from which no individual can be reasonably identified) to improve the accuracy and quality of our avatar generation pipeline. We will not use individually identifiable Biometric Data for this purpose without your separate explicit written consent.

We do not use Biometric Data for:

• Advertising, marketing, or commercial purposes unrelated to providing your avatar.
• Identifying you in contexts unrelated to your own avatar and account.
• Training third-party AI models without your explicit consent.

4. No Sale, Lease, or Profit from Biometric Data

SplatChat does not and will not sell, lease, trade, or otherwise profit from Biometric Data. Biometric Data is shared with third-party service providers (listed in Section 6) only to the extent strictly necessary to provide the Service, and only under written contracts that prohibit those providers from using Biometric Data for any other purpose.

5. Consent

Before collecting Biometric Data from you, we will:

1. Inform you in writing that we are collecting Biometric Data (the photograph upload flow includes this notice before you proceed).
2. Inform you in writing of the specific purpose for which the Biometric Data is being collected, stored, and used, and the length of time for which it will be retained.
3. Receive your written consent (your affirmative action to proceed with the upload after reviewing this Policy and the in-flow notice constitutes written consent).

If you are a minor between 13 and 17, your parent or legal guardian must consent to the collection of your Biometric Data before you proceed with avatar creation. By permitting the minor to create an avatar, the parent or guardian confirms they have read this Policy and consent on behalf of the minor.

You may withdraw your consent at any time by deleting the associated character or requesting deletion of your Biometric Data by contacting us at privacy@splatchat.com. Withdrawal of consent will result in deletion of your avatar assets and associated Biometric Data as described in Section 7.

6. Third-Party Service Providers

We share Biometric Data with the following third-party service providers solely as necessary to provide the Service:

Each provider is contractually prohibited from using your Biometric Data for any purpose other than providing services to SplatChat. We do not share Biometric Data with any other third parties without your explicit written consent.

7. Retention Schedule and Destruction

Biometric Data is retained only for as long as necessary to fulfill the purpose for which it was collected. Specifically:

• Avatar-linked facial geometry and photographs are retained for as long as the associated character avatar exists in your account.
• Upon character deletion, associated Biometric Data (photographs and 3D facial geometry) is permanently and irreversibly destroyed within 30 days of deletion.
• Upon account deletion, all Biometric Data associated with your account is permanently and irreversibly destroyed within 30 days of account deletion.
• Real-time voice data is discarded at the end of each session and is never permanently stored.
• Voice cloning samples and voice models (Section 2.3) are retained for as long as the voice clone exists in your account. When you delete a clone, the stored audio samples are deleted from our storage and the derived voice model is deleted from ElevenLabs. Full destruction completes within 30 days.
• Maximum retention period. In no event will Biometric Data be retained for more than 3 years after the date of your last interaction with the Service, or sooner as required by applicable law.

Destruction means permanent deletion using industry-standard methods such that the Biometric Data cannot be recovered. We will instruct our service providers to destroy your Biometric Data within the same timeframes.

8. Security of Biometric Data

We use a reasonable standard of care — at least as protective as the standards we apply to other confidential and sensitive data — to store, transmit, and protect Biometric Data from disclosure. Our security measures for Biometric Data include:

• Encryption in transit (TLS/HTTPS) for all transfers of Biometric Data.
• Encryption at rest for stored photographs and facial geometry data.
• Access controls limiting Biometric Data access to personnel and systems with a legitimate operational need.
• Contractual security requirements imposed on third-party service providers that process Biometric Data.

9. Your State-Specific Rights

9.1 Illinois residents (BIPA)

If you are an Illinois resident, you have the following rights under the Illinois Biometric Information Privacy Act (740 ILCS 14/):

• Right to be informed. To be informed in writing before your Biometric Data is collected.
• Right to consent. To provide (or withhold) written consent before your Biometric Data is collected, stored, or used.
• Right against sale or profit. Your Biometric Data will not be sold, leased, or traded.
• Right to a written policy. To have access to this written Biometric Data policy (which you are reading now).
• Right to deletion. To request deletion of your Biometric Data.

BIPA provides a private right of action for violations. We are committed to full compliance. To exercise your BIPA rights, contact us at privacy@splatchat.com.

9.2 Texas residents (CUBI)

If you are a Texas resident, the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code §§ 503.001–503.006) applies to our collection and use of your facial geometry biometric identifier. We:

• Inform you of the collection and purpose before collecting.
• Obtain your consent before collecting or using your biometric identifier.
• Do not sell, lease, or disclose your biometric identifier to third parties except as permitted by law.
• Destroy the biometric identifier within a reasonable time after the initial purpose for collection has been satisfied (see Section 7).

9.3 Washington residents

If you are a Washington resident, the Washington My Health MY Data Act and related biometric privacy laws may apply. We collect and use biometric data as described in this Policy. You have rights to access, correct, and delete your biometric data. Contact us to exercise these rights.

9.4 Colorado, Virginia, and other state residents

Colorado (CPA), Virginia (VCDPA), and other states have enacted comprehensive privacy legislation that may apply to biometric data. Under these laws you may have rights to access, correct, delete, and obtain a portable copy of your biometric data, and in some cases the right to opt out of processing. We apply the same base standards described in this Policy to all users regardless of state. Contact us at privacy@splatchat.com to exercise any rights you may have under applicable law.

9.5 Non-U.S. residents

If you are located outside the United States, your biometric data may be subject to the data protection laws of your country. In the European Union and UK, facial geometry derived from photographs constitutes “special category” biometric data under GDPR Article 9 and UK GDPR, and we process it only on the basis of your explicit consent (Article 9(2)(a)). You may withdraw consent at any time as described in Section 5 of this Policy. For GDPR inquiries, contact privacy@splatchat.com.

10. How to Exercise Your Rights

To exercise any of your rights under this Policy or applicable biometric privacy law:

• Delete your avatar: Delete the associated character from within the Service. This initiates the 30-day destruction schedule.
• Delete a voice clone: Delete the cloned voice from the voice cloning manager (available wherever you assign voices to characters). This destroys the stored audio samples and the synthetic voice model.
• Delete your account: Use the account deletion option in your profile settings. This destroys all Biometric Data within 30 days.
• Email us: Contact privacy@splatchat.com with the subject line "Biometric Data Request" to request access, correction, or deletion of your Biometric Data. We will respond within 30 days.

We will not discriminate against you for exercising your biometric privacy rights.

11. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or applicable law. If we make material changes we will provide notice (including where required by applicable law) before the changes take effect. Your continued use of the avatar creation feature after the effective date constitutes acceptance of the updated Policy. We always post the current Policy at splatchat.com/biometrics.

12. Contact Us

For questions, concerns, or requests related to this Biometric Data Policy: