1. Who is responsible for your data
Faata is operated by Усвицкий Евгений Вадимович, an individual registered under Russia’s professional income tax regime. Russian taxpayer identification number (ИНН): 645492092935. Location: Russia, Moscow. Contact: support@faata.ai.
This policy covers faata.ai, Faata galleries and support enquiries. The website currently operates as an informational storefront: registration, photo uploads and payments are unavailable. The personal photo session rules and retention periods below describe the service once those features open. We will update information about actual providers and processing before opening them. Personal photo sessions are intended for adults uploading their own photographs.
2. What data we use and why
2. What data we use and why| Data | Purpose |
|---|
| Email address and sign-in information | Email verification, secure access and order messages |
|---|
| Photographs, prepared visual materials and generated images | Assessing photo suitability, preserving your appearance, creating and delivering your chosen photo session |
|---|
| Order, payment and refund records | Fulfilling orders, handling payments, support and required recordkeeping |
|---|
| Support correspondence | Answering questions and resolving enquiries |
|---|
| Technical connection, browser, request and error data | Operating the website, preventing abuse and troubleshooting |
|---|
| Consent and preference records | Respecting your choices and recording permissions |
|---|
| Website visits and interactions | Optional analytics with separate consent |
|---|
We process email, photos and order information to take steps towards and perform a contract at your request. We rely on consent for optional analytics and photo operations where consent is required. Required records are kept to meet applicable legal obligations. Security and handling claims rely on an applicable obligation or a legitimate interest in protecting the service and its participants’ rights.
Without your email address and photos, we cannot provide a personal photo session. Declining analytics does not limit access to core features. This policy explains processing; it does not itself constitute consent.
3. Photographs and artificial intelligence
We use your photographs to prepare and create your requested photo session using AI services. Automated checks assess photo suitability; contact support if you disagree with the result. Photos are not used to authenticate you at sign-in: access is verified through email.
Faata does not use your photographs to train general-purpose generative models. Images needed to fulfil your session are sent to AI providers. Their operational retention and processing may differ from Faata’s storage periods.
We do not publish your images or use them in advertising without separate permission. If you create a public link, the selected images become accessible to anyone holding that link. Revoking it stops further access through Faata, but does not remove copies others have already saved.
4. Who receives data
The website uses Cloudflare for infrastructure and protection, and support uses Google Workspace for email. Personal photo sessions are designed to use OpenRouter and fal with model providers for image assessment and generation. Google Analytics through Cloudflare provides optional website analytics after your separate consent. The payment service used at checkout also processes payment data under its own policy. Necessary information may be disclosed to competent authorities where required by law.
Processing also takes place outside your country. Faata’s primary storage is in Western North America; providers also use other regions. Cloudflare and Google Workspace publish data processing terms, including standard contractual clauses for applicable international transfers: Cloudflare DPA and Google DPA. You can request information about the safeguards applicable to your data by email.
5. How long data is kept
5. How long data is kept| Data held by Faata | Retention |
|---|
| Unverified registration | 24 hours from the initial request |
|---|
| Verified registration with no paid orders | 30 days without meaningful user activity |
|---|
| Original uploaded photographs | No more than 24 hours after upload |
|---|
| Unfinished preparation | No more than 24 hours from the start |
|---|
| Prepared photos and temporary visual materials | 7 days from first readiness; retries do not extend this period |
|---|
| Completed collection | 30 days from readiness |
|---|
| Temporary ZIP download archive | No more than 24 hours |
|---|
| A paying user’s contact data | While orders remain active, then 90 days after the last service ends and payments are settled |
|---|
| Detailed records for an individual order | 90 days after closure or the end of collection access |
|---|
| Minimal financial archive | 5 complete calendar years after the settlement year |
|---|
An unresolved refund, dispute or legal obligation may require keeping limited necessary records. This does not extend image retention. The financial archive contains payment identifiers, but no photographs or email addresses.
Support correspondence is kept as needed to resolve the enquiry and preserve evidence for any related dispute within applicable time limits. Technical logs are kept for diagnostics and security within the relevant service’s retention periods. Cloudflare database recovery copies may remain for up to 30 days. Deletion from the working mailbox also does not instantly remove all Google copies: Google DPA periods and exceptions apply. The image periods in the table apply to Faata, rather than every copy held by AI providers.
6. Cookies and analytics
6. Cookies and analytics| Storage | Purpose | Lifetime |
|---|
| faata_session | Sign-in session, when requested | 30 days |
|---|
| faata_customer_analytics_consent | Analytics choice on faata.ai | 180 days |
|---|
| faata_analytics_consent | Independent gallery analytics choice | 180 days |
|---|
| faata_customer_analytics_state / faata_customer_analytics_context | Optional analytics identifiers/context | Up to 30 days from creation |
|---|
| __Host-faata_analytics_receipt / faata_analytics_revocation_pending | Server analytics permission/withdrawal handling, when enabled | Up to 30 days; receipt never outlives analytics context |
|---|
| faata:character-preference:v1 (localStorage) | Independent example-history choice | 180 days; expiry checked on site use |
|---|
| faata:marketing-characters:v1 (localStorage) | Optional history of illustrative characters | Up to 30 days from creation; only after separate consent |
|---|
| faata_language_v1 (localStorage) | Language selected by you | Until changed or browser storage is cleared |
|---|
| faata_zaraz_consent_v2 | Cloudflare purpose preference; Faata still checks its own current choice | About 1 year in the observed configuration |
|---|
| cf_zaraz_client | Cloudflare Zaraz infrastructure cookie; observed with an empty value before a choice | About 1 year in the observed configuration |
|---|
| cf_clearance | Cloudflare security challenge clearance | About 1 year in the observed configuration |
|---|
Necessary storage supports sign-in, security and remembering your choices. Optional analytics and example-photo history have separate controls in Privacy settings. You can use Faata without either optional purpose. These rules cover cookies and localStorage, not just third-party cookies.
The panel offers Only necessary (both optional purposes off), Accept all (both purposes on), and Customize. In settings, analytics and example personalization are independent. Save choices applies your selected options; closing the settings without saving changes nothing.
Google Analytics through Cloudflare measures visits and interactions only after analytics consent and when collection is enabled. Faata analytics events contain no photographs or email addresses. Your analytics choice lasts 180 days and Faata’s temporary analytics identifiers and context expire no later than 30 days after creation. Withdrawal stops subsequent optional analytics and clears local analytics state; it does not automatically erase data already sent to Google. Contact support for deletion requests.
Example-photo history is off until you separately enable Example personalization. Faata then stores the illustrative characters shown and the last activity time in this browser, to avoid repeating examples between visits. This history is not sent to Google. It expires within 30 days of creation without being extended by visits; expired records are discarded when the site next accesses storage. Turning this off deletes the history. The separate preference lasts 180 days. Older analytics consent does not enable this purpose.
The table lists Faata storage and the Cloudflare cookies observed on the storefront on 20 October 2026. Infrastructure configuration can affect Cloudflare lifetimes. Cookie expiry is separate from retention of data already sent to a service. Sign-in and server analytics entries are used only when those features are enabled. The faata.photos gallery has its own analytics choice; choices are not automatically shared with faata.ai.
7. Your rights and how to contact us
Where provided by applicable law, you may request access, correction, deletion, restriction of processing or data portability. You may object to processing based on legitimate interests. You can withdraw consent; withdrawal does not affect the lawfulness of earlier processing.
Use the available deletion controls in your account or email support@faata.ai. To prevent disclosure to another person, we may verify that the request is yours. Support provides an initial response within 24 hours; data rights requests are fulfilled within the period required by applicable law.
Deleting required photographs or withdrawing permission to process them may prevent completion of your session. Cancellation and refunds are handled under the order terms and applicable law. If some records must be retained, we will explain the reason and period.
You may complain to the competent data protection authority under applicable law. We use secure transmission and access controls. We communicate material policy changes before new processing begins and request separate consent when required.
