Whose FacePrivacy policy
Whose Face (“the app”) helps you find the name of a public figure from a photo. This policy explains what data is processed when you use the app, why, by whom, for how long, and how to exercise your rights. The French version is available here.
In short
- No account, no history, and no analytics or crash-reporting tool added by us.
- A photo is sent to Amazon Web Services (AWS) for analysis only after your explicit agreement. It is resized and stripped of its metadata (including location) before sending. Mobiverse Games keeps neither the photos nor the results.
- The analysis is performed by the Amazon Rekognition service in the Europe (Ireland) region.
- The app shows a Google AdMob banner ad; your advertising choices are collected at launch and can be changed at any time in the app.
- The app is intended for people aged 16 and over.
1. Controller
The controller is Guillaume Paul Raoul Bourlart, a sole trader (entrepreneur individuel) operating under the trade name Mobiverse Games (“Mobiverse Games”, “we”).
Contact: contact@mobiversegames.com. The postal address and registration details are in the legal notice. No data protection officer has been appointed; any question can be sent to the address above.
2. Data processed, purposes and legal bases
2.1 Analysed photos
What? The photo you take or choose, only when you start an analysis. It may show one or more people. Before sending, the app prepares it on your device: orientation applied, resized to at most 2048 pixels, re-encoded as JPEG, and metadata removed (location, device, date). A photo taken with the camera from the app is not saved to your photo library.
Why? To detect the faces in the photo, compare them with the public-figure database of the Amazon Rekognition service, and display the result: name, estimated confidence score, face area and, where available, an information link (IMDb or Wikidata). This processing relies on an artificial intelligence system provided by AWS: its results are estimates and may be wrong. It cannot identify private individuals.
Legal basis: your explicit consent, collected in the app before any upload (Article 6(1)(a) and Article 9(2)(a) GDPR). You can withdraw it at any time in the app: Information › Sending photos to AWS › Withdraw permission. Withdrawal does not affect analyses already carried out.
Your responsibilities: only send photos you are allowed to use. The app is designed to identify public figures from images that have been made public (films, interviews, events). Do not use it to identify people without their knowledge.
Recipient: Amazon Web Services, as our processor (see section 3).
Retention: Mobiverse Games keeps neither the photos nor the results. The photo and the result stay in your device’s memory while they are displayed; the temporary copy created by the photo picker is deleted after preparation. Under the Amazon Rekognition terms, AWS may store and use processed images to provide and maintain the service. We have asked AWS not to use this content to improve or develop its technologies (AWS opt-out procedure). Deletion of content stored by AWS can be requested through us from AWS Support.
2.2 Technical access identifier
To obtain temporary access keys (valid for about one hour) without storing a permanent key in the app, the app uses Amazon Cognito. On first use, Cognito assigns a random identifier to the installation, stored on your device. It is not linked to your name, your email or your photos.
Requests to Cognito (identifier and IP address, no photo) are processed in the United States (N. Virginia). AWS may record technical calls, including the IP address, in our account’s activity log (AWS CloudTrail), kept for 90 days by default, for security purposes.
Legal basis: our legitimate interest in providing the requested service securely and preventing abuse.
2.3 Advertising and consent
The app shows a banner ad provided by Google AdMob (Google Ireland Limited and its affiliates, including Google LLC). On first launch, an IAB TCF consent message provided by Google lets you accept, refuse or customise advertising. You can change these choices at any time in the app: Information › Ad preferences.
Depending on your choices, Google and its partners may process the device advertising identifier (IDFA on iOS if you allow tracking, advertising ID on Android), IP address, approximate location derived from the IP address, device and app information, ad interactions and diagnostic data. Google acts as an independent controller for this data: see how Google uses information from sites or apps that use its services and its privacy policy.
On iOS, tracking permission (App Tracking Transparency) is requested only once, after your advertising choices, and not if you refused storage of information on your device. Refusing does not prevent you from using the app. Ads are limited to content suitable for a teen audience.
Legal basis: your consent for reading or storing information on your device and for personalised advertising (ePrivacy rules, Article 6(1)(a) GDPR). If you refuse, non-personalised or limited ads may be shown under Google’s rules.
2.4 Preferences stored on the device
The app stores locally your agreement to send photos, the technical identifier described in 2.2, your advertising choices (stored by Google’s SDK) and a counter used to show the store review prompt only rarely. This information does not leave the device, is excluded from Android backups and is removed when you uninstall the app. Legal basis: technical necessity and respect for your choices.
2.5 Device permissions
The app may ask for camera access, only to take a photo. To choose an image, it uses the system picker: only the images you select are shared with it, and full access to your photo library is not needed. The app does not request location, microphone or contacts.
2.6 Messages sent to support
If you write to us, we process your email address, your name if it appears, the content of your message and any attachments, in order to reply. Legal basis: our legitimate interest in answering requests. Retention: while handling the request, then at most three years after the last exchange. Our mailbox is hosted by IONOS SE (Germany), as a processor.
2.7 Downloading the app
Apple (App Store) and Google (Google Play) process download and update data as independent controllers. They provide us with aggregated statistics and, if you agreed with them, anonymised crash reports.
2.8 This website
whose-face.web.app is hosted on Firebase Hosting (Google). It uses no cookies, analytics or trackers. Google processes the technical data needed to deliver the pages (including the IP address) as a processor.
3. Recipients and processors
| Recipient | Role | Data | Processing location |
|---|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) and Amazon Web Services, Inc. | Processor (Rekognition, Cognito, logs) | Prepared photos, technical identifier, IP address | Ireland for photo analysis; United States for Cognito |
| Google Ireland Limited and Google LLC (AdMob) | Independent controller | Advertising data described in 2.3 | European Union and United States |
| Google (Firebase Hosting) | Processor | Website connection data | Google’s global network |
| IONOS SE | Processor | Support emails | European Union |
| Apple, Google (stores) | Independent controllers | Download data | According to their policies |
We do not sell your data and do not use it for purposes other than those described here.
4. Transfers outside the European Union
Photos are analysed in the European Union (Ireland). Requests for temporary credentials (Cognito) and some advertising data may be processed in the United States. These transfers rely on the EU–U.S. Data Privacy Framework, in which AWS and Google participate, and on the European Commission’s standard contractual clauses included in their data processing terms.
App versions earlier than 3.0 send photos, without prior removal of metadata, to the Amazon Rekognition service located in the United States (N. Virginia). We encourage you to install the latest version.
5. Retention periods
| Data | Period |
|---|---|
| Photos and results | Not kept by Mobiverse Games; retention by AWS as described in section 2.1 |
| Cognito technical identifier | On the device until uninstallation; on the AWS side, while the service is active |
| AWS activity logs | 90 days by default |
| Choices and preferences | On the device until uninstallation or change |
| Support messages | At most three years after the last exchange |
| Advertising data | According to Google’s rules |
6. Security
Communications are encrypted (HTTPS). The app contains no permanent AWS key: it uses temporary keys that last about one hour. Photos are resized and stripped of their metadata before sending and are not stored by us. The number of analyses is limited locally to prevent abuse.
7. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw your consent at any time, and, under French law, the right to give instructions about your data after your death. Write to contact@mobiversegames.com; we reply within one month.
As we keep no photos, results or accounts, we generally cannot find any data about you. For a request about content stored by AWS, tell us the approximate date and time of the analysis. For advertising data, you can also contact Google.
You can lodge a complaint with the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr), or with the data protection authority of your country.
8. Minimum age
Whose Face is intended for people aged 16 and over. If you are under 16, do not use the app. If we learn that a message was sent to us by someone under 16, we delete it.
9. Changes
We may update this policy to reflect changes to the app or the law. The update date appears at the top of this page. If the way photos are processed changes significantly, the app will ask for your agreement again.
10. Contact
contact@mobiversegames.com · Help and support · Legal notice