This document explains what data FaceMirror collects, how it is processed, stored, and shared. The document complies with the principles of the EU General Data Protection Regulation (GDPR).
FaceMirror service operator. Contact email: contact@facemirror.online.
The service requires access to microphone and camera for up to 7 minutes during the test. The audio stream is sent to a speech recognition service and is not stored. The video stream is processed locally in your browser to extract facial expression parameters; video frames are never transmitted to the server.
Audio is converted to text by an external service. The resulting text is stored and used for behavioral pattern analysis and comparison with future sessions. The transcription may incidentally contain personal information mentioned during the session (such as names, places, or other identifying details); this content is treated as personal data and retained for the full data retention period.
Numerical indicators are extracted from audio and video — speech rhythm, pauses, facial expression measures, vocabulary characteristics. During the recording we also store frame-by-frame series: voice pitch (fundamental frequency) and loudness, 10 times per second; facial expression components, several times per second, with frames where no face was detected marked as such. These are numbers, not audio or images. Stored and used to generate the report.
If you complete the questionnaire (50 statements about yourself), your answers are stored as numbers from 1 to 5. From them the server computes five scores: extraversion, agreeableness, conscientiousness, emotional stability, and intellect / imagination. These scores are used in preparing your report and in de-identified scientific research.
Optional fields: age range, native language, previous-session FM code. Optional and does not block test completion.
If you joined with an invitation code, the service stores an irreversible fingerprint (hash) of the code and its link to your session, not the code itself.
Used for delivery of personal report and for letters in response to your requests (data access).
IP address, browser type and request time are automatically recorded in server logs for diagnostics; server logs are not associated with your email unless necessary. With each session we also store the device class (computer or phone, operating system, browser family — no device identifiers) and the actual microphone and camera settings (sample rate, automatic gain control, noise and echo suppression, resolution, frame rate). They are used to check measurement quality.
This is exactly what FaceMirror stores after a completed session:
| Data type | What is stored |
|---|---|
| Email address | Links your session to your account. Deleted on request, or after the retention period in section 6. |
| Your spoken responses | Text transcript only. The audio recording is not stored. |
| Facial analysis | Numerical metrics (e.g. symmetry index, movement frequency), including frame-by-frame series during the session. No images or video frames. |
| Voice analysis | Numerical metrics (e.g. pause duration, speech rate) and frame-by-frame series of pitch and loudness (10 per second). No audio recording. |
| Self-description answers | Demographic answers (field values) and questionnaire answers (numbers from 1 to 5). |
| Session metadata | Timestamp, language, technical quality indicators, device class, microphone and camera settings. |
Video is processed locally in your browser. Raw video frames are never transmitted to our servers. Audio is sent to a speech recognition service for transcription only; we do not retain audio recordings. Third-party retention is described in section 7.
Audio recording after conversion to text. Video imagery is never transmitted to the server.
Speech transcription text, numerical metrics, questionnaire responses, demographic data (if provided), email, generated report.
The identifying email address is retained for up to 36 months from the date of your session, or until you submit a deletion request — whichever comes first. After that period the address is removed, while de-identified behavioural and derived session data may be retained for research purposes. You have the right to request deletion at any time.
External service providers are used. Data shared with each is minimal and limited to the processing purpose.
Audio is transferred to Whisper API for conversion to text. Per OpenAI's public policy, API data is not used for model training and is deleted after processing.
Transcribed text, numerical metrics and the five questionnaire scores (not the answers themselves) are transferred to Claude API. Per Anthropic's policy, API data is not retained and not used for model training.
Email and report content are transferred to Brevo for letter delivery.
Data is stored in a managed Supabase database. Access is protected by Row Level Security: read and write are possible only via the FaceMirror server-side application.
At any time you may:
Email requests are processed within 30 calendar days. Before processing, a confirmation email is sent to verify the address.
The service is not intended for individuals under 18. If you are a legal representative of a minor under 18 whose data was uploaded without your consent — contact the operator, data will be deleted.
The service is not intended for personal identification, medical diagnosis, psychological assessment, or decisions affecting user rights.
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to request deletion, and the right to opt out of the sale of personal information.
FaceMirror does not sell your personal information as defined under the CCPA. De-identified data used for internal research is not considered a sale under applicable law.
To exercise your rights, contact: contact@facemirror.online or use the data request page.
Material changes are published on this page with a new effective date. Continued use of the service after publication of changes constitutes acceptance of the new version.
Email for all questions: contact@facemirror.online