01LEGAL

Privacy Policy

Effective June 22, 2026 · Version 2.0

FaceIn Privacy Policy

Effective Date: June 22, 2026 Last Updated: July 24, 2026 Version: 2.1

WBX3 Holdings, Inc. ("FaceIn," "we," "us," or "our") operates the FaceIn mobile application (the "App"), the FaceIn developer dashboard at dashboard.facein.id (the "Dashboard"), the FaceIn JavaScript SDK ("@facein/sdk" or the "SDK"), and related services (collectively, the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect information in connection with our Service, and the choices you have regarding your information.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.

Overview of Our Architecture
Information We Do NOT Collect
Information We Collect
How We Use Your Information
Legal Bases for Processing (EEA/UK Users)
Biometric Data and Consent
The FaceIn SDK: Data Flow for Developers
Password Vault
Information Sharing and Disclosure
Data Retention and Deletion
Data Security
International Data Transfers
Third-Party Services
Children's Privacy
Your Privacy Rights
California Residents (CCPA/CPRA)
Illinois Residents (BIPA)
European Economic Area, United Kingdom, and Switzerland Residents (GDPR)
Other U.S. State Privacy Rights
Changes to This Privacy Policy
Contact Us

1. Overview of Our Architecture

FaceIn is built on a zero-knowledge architecture. This is the foundational principle of our Service and is critical to understanding how we handle your data:

Biometric data (face geometry, fingerprint templates, iris scans) is processed and stored exclusively on your device. It is never transmitted to, received by, or accessible to FaceIn's servers.
Your device's built-in biometric hardware and operating system (Apple Face ID / Touch ID, Android BiometricPrompt) handle all biometric matching locally.
FaceIn's servers receive only cryptographic verification results — a signed assertion confirming that you successfully authenticated on your device. We never see, store, or process the underlying biometric data.
This architecture means that even in the event of a breach of FaceIn's servers, no biometric data could be compromised, because we never possess it.

This is not a policy choice — it is an architectural constraint. Our systems are designed so that it is technically impossible for us to access your biometric data.

2. Information We Do NOT Collect

To be clear and unambiguous, FaceIn does not collect, store, transmit, receive, or process any of the following:

Facial geometry or face maps (e.g., Face ID data, facial recognition templates)
Fingerprint templates or fingerprint images (e.g., Touch ID data, fingerprint minutiae)
Iris scans or retinal imagery
Voiceprints or voice recognition data
Any other biometric identifiers or biometric information as defined by the Illinois Biometric Information Privacy Act (BIPA), the California Consumer Privacy Act (CCPA/CPRA), the General Data Protection Regulation (GDPR), or any other applicable law
Your passwords or credentials stored in the Password Vault feature (these are encrypted locally on your device with keys derived from your biometric authentication; we cannot access them)
The content of websites or applications you authenticate with using FaceIn

3. Information We Collect

3.1 Information You Provide Directly

| Data Type | Examples | Purpose | |-----------|----------|---------| | Account Information | Email address, display name, profile photo (optional) | Account creation and management | | Developer Account Information | Company name, billing address, payment information, API contact email | Developer Dashboard registration, billing, and communication | | Communications | Support requests, feedback, survey responses | Customer support and product improvement |

3.2 Information Collected Automatically

| Data Type | Examples | Purpose | |-----------|----------|---------| | Device Information | Device model, operating system version, unique device identifiers (e.g., IDFV on iOS, Android ID), screen resolution, language settings | Service compatibility, security, and analytics | | Usage Data | Authentication events (success/failure — without biometric data), features used, session duration, app version | Service improvement and analytics | | Log Data | IP address, access timestamps, referrer URL, browser type and version | Security monitoring and abuse prevention | | Crash Reports | Crash logs, stack traces, device state at time of crash | Bug fixing and stability improvement |

3.3 Information Collected via the SDK

When a website integrates the FaceIn SDK, the following information is collected in connection with authentication events:

| Data Type | Examples | Purpose | |-----------|----------|---------| | Authentication Results | Verification status (success/failure), confidence score, timestamp | Providing authentication service to the integrating website | | Session Tokens | JSON Web Tokens (JWTs) containing user identifier, verification status, and expiration | Secure transmission of authentication results | | SDK Analytics | SDK version, integration type, authentication method used, latency metrics | SDK performance monitoring and improvement |

3.4 Information from Third-Party Sources

We may receive information from the following third-party sources:

Payment Processors: Transaction confirmation, billing status (we do not receive or store full payment card numbers)
Analytics Providers: Aggregated usage statistics
App Store Platforms: App installation and update data provided by Apple App Store and Google Play Store

4. How We Use Your Information

We use the information we collect for the following purposes:

Provide and maintain the Service: Process authentication requests, manage your account, deliver the SDK functionality to developer customers
Billing and payments: Process developer subscription fees, generate invoices, manage subscription tiers
Security and fraud prevention: Detect and prevent unauthorized access, abuse, or fraud; enforce our Terms of Service
Communication: Send service-related notices (e.g., security alerts, account verification, billing notifications), respond to support requests
Analytics and improvement: Analyze usage patterns to improve the Service, fix bugs, develop new features
Legal compliance: Comply with applicable laws, regulations, and legal processes

We do not use your information for:

Selling or renting personal information to third parties
Targeted advertising or ad profiling
Building behavioral profiles based on biometric data (because we do not have biometric data)
Any purpose unrelated to providing and improving the Service

5. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, we process your personal data on the following legal bases under the GDPR:

| Legal Basis | Data Processed | Purpose | |-------------|---------------|---------| | Contract Performance (Art. 6(1)(b)) | Account information, authentication data, payment data | Necessary to provide the Service you requested | | Legitimate Interests (Art. 6(1)(f)) | Device information, usage data, log data, crash reports | Service security, fraud prevention, analytics, product improvement | | Consent (Art. 6(1)(a)) | Marketing communications (if any), optional analytics | Where we specifically request your consent | | Legal Obligation (Art. 6(1)(c)) | Records required by tax, financial, or other laws | Compliance with applicable legal requirements |

Regarding biometric data: Because FaceIn's zero-knowledge architecture means we never collect, receive, or process biometric data on our servers, Article 9 of the GDPR (special categories of personal data) does not apply to FaceIn's server-side data processing. All biometric processing occurs locally on your device under your device operating system's privacy framework (Apple's LocalAuthentication, Android's BiometricPrompt), which are governed by the respective device manufacturer's privacy policies.

6. Biometric Data and Consent

6.1 How Biometric Authentication Works in FaceIn

When you use FaceIn to authenticate:

You initiate authentication by tapping the FaceIn button on a website or within the App.
Your device's operating system prompts you for biometric verification (Face ID, Touch ID, fingerprint, etc.) using your device's built-in biometric hardware.
Biometric matching occurs entirely on your device. Your device's secure enclave (iOS) or Trusted Execution Environment (Android) compares your live biometric input against the stored template. This process is managed by Apple or Google, not by FaceIn.
Your device sends a cryptographic assertion to FaceIn confirming that you were successfully verified. This assertion contains no biometric data — only a signed confirmation.
FaceIn issues a JWT token to the requesting website confirming your identity.

At no point does FaceIn receive, transmit, store, or process your actual biometric data.

6.2 Consent

Before enabling biometric authentication, you will be presented with a clear disclosure explaining:

That your device will use biometric authentication (face recognition, fingerprint)
That biometric data remains on your device and is never sent to FaceIn
That you can disable biometric authentication at any time through the App's settings or your device's settings
That alternative authentication methods are available

Your use of biometric authentication with FaceIn is voluntary. You may disable biometric authentication at any time without losing access to your account.

6.3 Revocation of Consent

You may revoke your consent to biometric authentication at any time by:

Disabling biometric login in the FaceIn App settings
Removing FaceIn's access to biometrics in your device settings
Deleting the FaceIn App (which removes all locally-stored biometric associations)
Contacting us at mazy@facein.id to request account deletion

Upon revocation, no biometric processing will occur in connection with FaceIn, as all biometric data is stored and controlled by your device.

7. The FaceIn SDK: Data Flow for Developers

This section is for developers integrating the FaceIn SDK and their end users.

7.1 What Developers Receive

When a user authenticates on a developer's website using the FaceIn SDK, the developer receives only the following:

| Data | Description | |------|-------------| | JWT Token | A signed JSON Web Token containing: user identifier (pseudonymous), verification status (success/failure), authentication method used, confidence score, token expiration timestamp | | Verification Status | A boolean indicating whether the user successfully authenticated | | User Identifier | A pseudonymous, application-specific identifier — NOT the user's FaceIn account email or personal details |

7.2 What Developers Do NOT Receive

Developers integrating the FaceIn SDK never receive:

Biometric data, biometric templates, or biometric identifiers of any kind
The user's FaceIn account email or password
The user's credentials stored in the FaceIn Password Vault
Device biometric hardware information
Other users' data or authentication results

7.3 Developer Obligations

Developers using the FaceIn SDK agree (under our Terms of Service) to:

Maintain their own privacy policy disclosing the use of FaceIn for authentication
Not attempt to reverse-engineer, de-anonymize, or correlate FaceIn user identifiers with biometric data
Handle JWT tokens and user identifiers in compliance with applicable privacy laws
Not use the SDK for surveillance, tracking, or any purpose other than user authentication
Promptly delete user data upon user request in accordance with applicable law

8. Password Vault

8.1 How the Password Vault Works

FaceIn includes an optional Password Vault feature that allows you to store website credentials (usernames and passwords) and auto-fill them after biometric authentication.

All credentials are encrypted locally on your device using AES-256 encryption with keys derived from your biometric authentication.
Encrypted credential data may be stored in your device's secure keychain (iOS Keychain, Android Keystore) for persistence across app sessions.
FaceIn's servers never receive, store, or have access to your stored credentials. The encryption keys are derived from device-local secrets that never leave your device.
Auto-fill functionality operates through standard platform APIs (iOS AutoFill Credential Provider, Android Autofill Framework) and standard browser autofill mechanisms.

8.2 Credential Sync (If Applicable)

If we offer cross-device credential synchronization in the future:

Credentials will be encrypted end-to-end before leaving your device
FaceIn's servers will store only encrypted blobs that we cannot decrypt
Decryption will only be possible on your authenticated devices
We will update this Privacy Policy before enabling any sync functionality

9. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information. We share information only in the following limited circumstances:

9.1 Service Providers

We engage trusted third-party service providers who process data on our behalf to help us operate the Service. These providers are contractually bound to use your data only for the purposes we specify and in accordance with this Privacy Policy. Categories of service providers include:

Cloud Infrastructure: Hosting and data storage
Payment Processing: Subscription billing and payment handling
Analytics: Aggregated usage analytics (e.g., crash reporting, performance monitoring)
Communication: Email delivery for transactional messages (e.g., account verification, billing receipts)
Customer Support: Help desk and ticketing systems

9.2 Developers Using the FaceIn SDK

When you authenticate on a third-party website using FaceIn, we share your verification status and a pseudonymous user identifier with that website's developer, as described in Section 7. We do not share biometric data, personal account information, or stored credentials.

9.3 Legal Requirements

We may disclose your information if we believe in good faith that disclosure is necessary to:

Comply with applicable law, regulation, legal process, or governmental request
Enforce our Terms of Service or other agreements
Protect the rights, property, or safety of FaceIn, our users, or the public
Detect, prevent, or address fraud, security, or technical issues

9.4 Business Transfers

If FaceIn is involved in a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Service of any change in ownership or uses of your information, as well as any choices you may have regarding your information.

9.5 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

10. Data Retention and Deletion

10.1 Retention Periods

| Data Type | Retention Period | Basis | |-----------|-----------------|-------| | Account Information | Duration of your account, plus 30 days after deletion request | Contract performance; legal compliance | | Device Public Key and Enrollment Record | Deleted within 7 days of account deletion or device removal | Purpose satisfied; BIPA § 15(a) | | Developer Account Information | Duration of subscription, plus 1 year for tax/billing records | Contract performance; legal obligation | | Authentication Logs | 60 days (pass/fail timestamps only; no biometric content, never tied to a biometric identifier) | Security and fraud prevention | | Usage Analytics | 24 months (aggregated/anonymized) | Service improvement | | Crash Reports | 12 months | Bug fixing and stability | | Payment Records | As required by applicable tax law (typically 7 years) | Legal obligation | | Support Communications | 3 years after resolution | Service quality and legal compliance |

10.2 Biometric Data Retention

Because FaceIn does not collect or store biometric data, there is no biometric data to retain or delete on our servers. Biometric templates stored on your device are governed by your device manufacturer's retention policies (Apple, Google) and can be deleted through your device settings at any time.

The device public key and enrollment record that FaceIn does hold (which contain no biometric content) are deleted within 7 days of account deletion or device removal. Consistent with the destruction standard in the Illinois Biometric Information Privacy Act (BIPA) Section 15(a), the associated records are destroyed when the initial purpose for their collection has been satisfied (such as account or device deletion, within 7 days) or within three years of the individual's last interaction with us, whichever occurs first.

10.3 Account Deletion

You may request deletion of your account and associated data at any time by:

Using the "Delete Account" feature in the FaceIn App settings
Emailing mazy@facein.id with the subject line "Account Deletion Request"

Upon receiving a verified deletion request, we will:

Delete the device public key and enrollment record within 7 days
Delete or de-identify your remaining account information within 30 days
Remove your data from active systems within 30 days
Remove your data from backup systems within 90 days
Retain only data required by law (e.g., billing records) for the legally mandated period

Deletion of your FaceIn account does not affect biometric data stored on your device, which remains under your control.

11. Data Security

We implement industry-standard technical and organizational measures to protect your information, including:

Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher
Encryption at Rest: All data stored on our servers is encrypted using AES-256
Access Controls: Strict role-based access controls limit employee access to personal data on a need-to-know basis
Infrastructure Security: Our infrastructure is hosted on SOC 2-compliant cloud providers with physical security, redundancy, and disaster recovery
Security Monitoring: Continuous monitoring for unauthorized access, anomalous activity, and potential threats
Incident Response: Documented incident response procedures with defined notification timelines
Regular Audits: Periodic security assessments and penetration testing

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your information using commercially reasonable measures consistent with industry standards.

12. International Data Transfers

FaceIn is operated by WBX3 Holdings, Inc., a company incorporated in Delaware, United States. If you access the Service from outside the United States, your information may be transferred to, stored in, and processed in the United States or other countries where our service providers operate.

Important: Because biometric data never leaves your device, there is no international transfer of biometric data. Only account information, usage data, and authentication logs may be transferred internationally.

For transfers of personal data from the EEA, UK, or Switzerland to the United States, we rely on:

Standard Contractual Clauses (SCCs) approved by the European Commission
UK International Data Transfer Addendum where applicable
Supplementary measures including encryption and access controls to ensure an adequate level of data protection

By using the Service, you consent to the transfer of your non-biometric information to the United States and other countries as described in this section.

13. Third-Party Services

The Service may contain links to or integrate with third-party websites, applications, or services that are not operated by FaceIn. This Privacy Policy does not apply to such third-party services. We encourage you to review the privacy policies of any third-party services you access.

When you authenticate on a third-party website using FaceIn, that website's own privacy policy governs how they handle the verification data they receive from FaceIn.

We currently use the following categories of third-party services:

| Category | Purpose | Data Shared | |----------|---------|-------------| | Cloud Hosting | Infrastructure and data storage | Encrypted account data, logs | | Payment Processing | Subscription billing | Billing address, payment method (tokenized) | | Analytics | Usage analytics and crash reporting | Anonymized/aggregated usage data, crash logs | | Email Services | Transactional email delivery | Email address, message content | | CDN | Content delivery for SDK | SDK files (no personal data) |

We require all third-party service providers to process data in accordance with our instructions and applicable data protection laws.

14. Children's Privacy

The Service is not directed to children under the age of 13 (or under 16 in the EEA/UK). We do not knowingly collect personal information from children under these ages.

If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at mazy@facein.id. If we become aware that we have collected personal information from a child under the applicable age without parental consent, we will take steps to promptly delete that information.

Developers integrating the FaceIn SDK must not use the SDK in applications or websites directed at children under 13 (or the applicable age in their jurisdiction) unless they comply with the Children's Online Privacy Protection Act (COPPA) and equivalent laws, including obtaining verifiable parental consent where required.

15. Your Privacy Rights

Depending on your jurisdiction, you may have some or all of the following rights regarding your personal information:

| Right | Description | |-------|-------------| | Access | Request a copy of the personal information we hold about you | | Correction | Request correction of inaccurate or incomplete personal information | | Deletion | Request deletion of your personal information | | Portability | Request a machine-readable copy of your personal information | | Restriction | Request that we restrict processing of your personal information | | Objection | Object to processing of your personal information based on legitimate interests | | Withdrawal of Consent | Withdraw consent where processing is based on consent | | Non-Discrimination | Exercise your privacy rights without facing discriminatory treatment |

To exercise any of these rights, please contact us at mazy@facein.id. We will respond to your request within the timeframe required by applicable law (typically 30–45 days).

We may need to verify your identity before processing your request to protect your privacy and security.

16. California Residents (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA").

16.1 Categories of Personal Information

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

| CCPA Category | Examples | Collected | |---------------|----------|-----------| | Identifiers | Email address, display name, IP address, device identifiers | Yes | | Commercial Information | Subscription tier, billing history (developers) | Yes | | Internet/Electronic Activity | Authentication events, usage data, log data | Yes | | Geolocation Data | Approximate location derived from IP address | Yes (coarse only) | | Biometric Information | Fingerprints, face geometry, voiceprints | No | | Sensitive Personal Information | Biometric data, precise geolocation, credentials | No |

16.2 Sale and Sharing

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We have not sold or shared personal information in the preceding 12 months.

16.3 Your California Rights

Right to Know: You can request the categories and specific pieces of personal information we have collected about you.
Right to Delete: You can request deletion of your personal information.
Right to Correct: You can request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing: Not applicable, as we do not sell or share personal information.
Right to Limit Use of Sensitive Personal Information: Not applicable, as we do not collect sensitive personal information as defined by the CCPA.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

16.4 Authorized Agents

You may designate an authorized agent to make a CCPA request on your behalf. We may require the agent to provide proof of authorization and may need to verify your identity directly.

16.5 Contact for CCPA Requests

To exercise your CCPA rights, contact us at mazy@facein.id with the subject line "CCPA Request."

17. Illinois Residents (BIPA)

If you are a resident of Illinois, the Biometric Information Privacy Act ("BIPA") provides you with specific rights regarding biometric identifiers and biometric information.

17.1 FaceIn's BIPA Compliance Statement

FaceIn does not collect, capture, purchase, receive through trade, or otherwise obtain biometric identifiers or biometric information as those terms are defined under BIPA (740 ILCS 14/10). Specifically:

FaceIn does not collect or store retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, or any other biometric identifiers.
All biometric matching is performed locally on your device by your device's operating system and hardware. FaceIn's servers receive only a cryptographic verification result (success or failure) — never the underlying biometric data.
Because FaceIn does not possess biometric identifiers or biometric information, BIPA's requirements regarding written consent, retention schedules, and destruction guidelines are addressed at the device operating system level (Apple, Google), not at the FaceIn application level.

17.2 Data Destruction

Although FaceIn does not store biometric data, we maintain a data destruction schedule for all personal information as described in Section 10. Biometric templates on your device can be deleted at any time through your device's settings.

17.3 Prohibition on Sale of Biometric Data

FaceIn does not and will not sell, lease, trade, or otherwise profit from any biometric identifiers or biometric information.

17.4 BIPA Contact

For any BIPA-related inquiries, please contact us at mazy@facein.id.

18. European Economic Area, United Kingdom, and Switzerland Residents (GDPR)

If you are located in the EEA, UK, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and equivalent local laws.

18.1 Data Controller

The data controller for information processed in connection with the Service is:

WBX3 Holdings, Inc. Email: mazy@facein.id

18.2 Your GDPR Rights

In addition to the rights listed in Section 15, you have the right to:

Lodge a complaint with your local data protection authority (a list of EEA data protection authorities is available at https://edpb.europa.eu)
Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal
Object to processing based on legitimate interests, including profiling

18.3 Data Protection Impact Assessment

Because FaceIn does not process biometric data on its servers, a Data Protection Impact Assessment (DPIA) for biometric processing is not required at the server level. However, we have conducted a DPIA for our overall data processing activities and maintain it as part of our compliance documentation.

18.4 Biometric Data Under the GDPR

Biometric data is classified as "special category data" under Article 9 of the GDPR when processed for the purpose of uniquely identifying a natural person. Because FaceIn's zero-knowledge architecture ensures that no biometric data is processed on our servers, Article 9 does not apply to FaceIn's server-side processing. The biometric processing that occurs on your device is governed by your device manufacturer's privacy policies and the biometric frameworks they provide (Apple's Face ID/Touch ID, Google's BiometricPrompt).

19. Other U.S. State Privacy Rights

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia may have additional privacy rights under their respective state privacy laws. These rights generally include:

The right to access, correct, and delete personal data
The right to data portability
The right to opt out of targeted advertising, sale of personal data, and certain profiling
The right to appeal a denial of a privacy request

FaceIn does not sell personal data, engage in targeted advertising, or profile users for decisions that produce legal or similarly significant effects. To exercise any rights under your state's privacy law, contact us at mazy@facein.id.

Texas Residents: Under the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001), FaceIn does not capture biometric identifiers. All biometric processing occurs on your device. FaceIn does not sell, lease, or disclose biometric identifiers.

Washington Residents: Under the Washington Biometric Identifiers statute (RCW 19.375), FaceIn does not enroll biometric identifiers in a database. All biometric matching occurs on your device.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

Update the "Last Updated" date at the top of this Privacy Policy
Notify you via email (for account holders) or a prominent notice within the App at least 30 days before the changes take effect
For material changes to biometric data handling (if any such changes were ever made), require your affirmative consent before the changes take effect

Your continued use of the Service after the effective date of the updated Privacy Policy constitutes your acceptance of the changes.

21. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

WBX3 Holdings, Inc. Email: mazy@facein.id Website: https://facein.id

For GDPR-related inquiries, you may also contact our data protection point of contact at mazy@facein.id.

We will respond to all inquiries within 30 days, or sooner if required by applicable law.

This Privacy Policy was last reviewed and updated on June 22, 2026.