Compliance

Last updated: August 27, 2026

We make 5 claims about how this product handles your data. Each one is re-checked by a service that runs on a schedule, and each is shown below with the result of every check behind it. Where we have gaps, they are on the same page, in the same detail.

We hold no compliance certification. No auditor has examined any of this, and we have not undergone SOC 2, ISO 27001, or an equivalent assessment, and the checks below are our own. Where a framework requirement is cited it is to say what the control speaks to — not to imply we have been audited against it.

This page covers how we handle your data. It is not a security disclosure, and it does not describe our infrastructure.

Last run August 27, 2026 — 0 checked, 0 failing, 5 not checked recently, 3 open gaps. A control only shows as checked if every check behind it passed recently; if the checks stop running, it goes amber on its own rather than staying green.

What we claim, and what checks it (5)

Uploaded photos are never written to durable storage
Not checked recently
No route in the free preview path imports a filesystem or object-storage module, logs a request payload, or marks a photo response cacheable. A test reads every one of those route handlers, so a debug log surviving a merge fails the build rather than shipping.
- ✓ claim-suite — 51 assertions passed
SOC 2 CC6.1 · GDPR Art. 5(1)(c) · CCPA §1798.100(d) · checked August 27, 2026
The free preview renders without transmitting the photo
Not checked recently
The free path sends numeric measurements, never pixels, and the routes that receive it reject non-JSON bodies at runtime. Checked two ways that fail independently: statically at every call site, and by a headless browser driven through a real upload against the live site, recording every outbound request.
- ✓ claim-suite — 51 assertions passed
- ✓ egress-probe — real upload observed, 5 origins contacted, all declared
GDPR Art. 25 · SOC 2 CC6.7 · checked August 27, 2026
Facial measurements are processed transiently and never stored
Not checked recently
These measurements may constitute biometric information depending on jurisdiction. They are used to compute preview geometry and discarded; nothing writes them to disk and they never enter an analytics payload.
- ✓ claim-suite — 51 assertions passed
BIPA §15(a) · Texas CUBI · GDPR Art. 9 · checked August 27, 2026
The list of third parties who receive anything is complete, and enforced
Not checked recently
Every third-party origin the browser contacts is declared in a manifest and named in the privacy policy. Three independent things hold this: a test fails if our source contacts an undeclared origin, a Content-Security-Policy generated from that same manifest is served to every visitor, and a headless browser probes the live site for anything the source never spelled out.
- ✓ claim-suite — 51 assertions passed
- ✓ csp-header — served, allowlisting 7 declared recipients
- ✓ egress-probe — real upload observed, 5 origins contacted, all declared
SOC 2 CC9.2 · SOC 2 CC7.1 · GDPR Art. 28 · CCPA §1798.115 · checked August 27, 2026
Cross-context behavioral advertising is disclosed as CCPA 'sharing'
Not checked recently
Three advertising pixels load on every page and receive a conversion event when a photo is uploaded. The policy states this is 'sharing' under CCPA rather than denying it. Advertising tags are confined to declared files, so a fourth pixel added anywhere else fails the build, and a test asserts the events carry no face data or identifier.
- ✓ claim-suite — 51 assertions passed
CCPA §1798.140(ah) · CCPA §1798.115(c) · checked August 27, 2026

Open gaps (3)

Known and not addressed. Nothing checks these because nothing is claimed. We publish them because a compliance page that shows only what passes tells you nothing about what was left out.

Consumer opt-out mechanism for sharing
Gap
CCPA requires a consumer-facing way to opt out of the sharing performed by the advertising pixels — a 'Do Not Sell or Share My Personal Information' link, and handling of the Global Privacy Control signal.
The policy offers an email address and points to the ad platforms' own settings. There is no opt-out link and no GPC handling. This is a product change, not a copy change.
CCPA §1798.135 · CCPA §1798.120
Biometric consent basis reviewed against current facts
Gap
Whether upload-as-consent is adequate for biometric information is a legal judgment, not a mechanism. No check can settle it; the mechanism checks elsewhere on this page exist to detect when the facts an opinion rested on stop being true.
The prior opinion rested in part on 'no identifier is shared with a third party.' That stopped being true when the advertising pixels shipped: all three platforms receive their own identifiers timed to a biometric upload. The opinion should be re-obtained on the current facts before being relied on.
BIPA §15(b) · Texas CUBI §503.001
Uploaded video is deleted after delivery
Gap
The paid video feature is the one place user media leaves the device and is stored. The policy states the clip is deleted when the render finishes or fails, and the output within 24 hours.
A scheduled job performs the deletions and its decision logic is unit-tested, but nothing independently audits the store to confirm the deletions actually happened — that no object outlived its retention window. This is the largest unverified data-retention claim we make. Closing it means a check that lists the real store and fails on anything past its deadline.
SOC 2 CC6.1 · GDPR Art. 5(1)(e) · GDPR Art. 17

Frameworks referenced

SOC 2 (Trust Services Criteria) · GDPR · CCPA/CPRA · BIPA / Texas CUBI · ISO 27001. Cited to describe what each control speaks to. We are not certified against any of them.

Questions

For a security questionnaire, a data processing agreement, or anything not answered here, email isaac@looksoptimizer.com. If you find something on this page that is wrong, we would rather hear it than not.