Biometric Information Privacy Policy

Another Planet ("the Service", "we", "us") generates AI-recreated posts, images, video, and voice in the likeness of a deceased person, based on photos, videos, and voice recordings a family member uploads. This policy specifically covers the biometric identifiers extracted from that material — facial geometry and voiceprint-adjacent data derived from the images and audio you upload — separately from the general categories of personal information described in our Privacy Policy.

• Facial data: derived from uploaded photos and videos, used as a reference so generated images/video resemble the Deceased.
• Voice data: derived from uploaded audio/video containing the Deceased's voice, used as a reference so generated voice output sounds like them.

We do not collect biometric data for identification or verification purposes (e.g., we do not match faces against a database to identify people) — only to condition AI generation on a specific person's likeness and voice.

Solely to generate the Service's core product: AI-recreated posts, images, video, and voice replies in the Deceased's likeness, shown only to family members explicitly invited to that profile. This material is sent to our third-party AI processors (fal.ai for image/video, Google Gemini for text) only to produce that output.

Before any biometric material is processed, the uploader must affirmatively check a dedicated consent checkbox (kept separate from general Terms acceptance) confirming they understand what's being extracted and how it will be used. Consent, along with a timestamp, the submitting IP address, and the version of this policy in effect at the time, is recorded against the profile to support an audit trail. Recording an IP address against a specific consent event is itself personal-data collection with its own retention considerations — it's covered by the same retention/destruction rules as the rest of this profile's data (§5), not retained separately or longer.

Illinois BIPA §15(a) requires biometric data to be destroyed when the initial purpose for collecting it has been satisfied, or within 3 years of the individual's last interaction with the company — whichever occurs first. This isn't a "the company picks whatever schedule it likes" standard; it's two specific triggers, and we map each one onto how this product actually works:

• "Purpose satisfied" trigger — on request: a Primary Account can request permanent deletion of a Deceased profile at any time, which we treat as the family confirming the purpose (an ongoing AI-recreated presence for that person) is no longer wanted. Deletion is immediate — all uploaded material and derived biometric data are permanently destroyed and cannot be recovered.
• "Last interaction" trigger — automatic, absent a request: the deceased person cannot interact with anything directly, so we treat the family's ongoing engagement with a profile — new posts, comments, replies, direct messages, or a new family member joining — as the closest available proxy for "the individual's last interaction with the company." If a profile has no such family activity for 3 consecutive years, it and all associated biometric data are automatically and permanently destroyed, whether or not anyone requests it — satisfying the statute's 3-year outer bound even when no one asks.

Because these are two independent triggers evaluated on a "whichever comes first" basis, the combination is designed to satisfy §15(a) regardless of which trigger applies to a given profile — not to rely on one prong being "good enough" on its own.

If a family member believes whoever uploaded material for a profile didn't actually have the right to do so, they can dispute it — see the "Dispute rights to this profile" option on the profile itself (only visible to non-primary family members; the Primary Account can delete a profile directly). Filing a dispute immediately and automatically suspends the profile — no new posts, replies, or messages, hidden from the family feed — while it's reviewed, without deleting any data. This is separate from, and does more real work than, the indemnification clause in Terms §4: indemnification only gives us a contractual claim against the uploader after the fact (worth little if they're insolvent or unreachable), while an immediate suspension on actual notice is what actually limits how long a disputed use of someone's likeness continues.

Uploaded material (and the biometric data derived from it) is sent to fal.ai (image and video generation) and Google Gemini (text generation — captions, comment replies, direct messages). Both process this material solely to produce your requested output. We do not sell biometric data, and we do not use it to identify people across unrelated contexts.

See Privacy Policy §8 ("Your choices & rights") — the same access/correction/deletion rights described there apply to biometric data specifically. To request deletion, use the delete option on the Deceased profile (Account → My Deceased), or contact us through whatever channel you were given access to the Service.

We may update this policy from time to time. Material changes will be reflected in the version recorded against future consent and communicated to Members before taking effect.

Terms & Conditions — general product terms, including representations you make when uploading material about a Deceased person. Privacy Policy — general data handling practices.