Privacy Policy

1. How the Platform Works, in One Paragraph

Individuals (“Talent”) create an account, upload photographs of themselves, verify their identity with Stripe and choose which campaign categories they are open to, at which point they are listed. Brands, agencies and production companies (“Licensees”) create campaigns. When a Licensee adds a Talent to a campaign that falls within the Talent’s settings and completes checkout, the Platform concludes a campaign licence on the Talent’s behalf under the standing authority the Talent gave in the Talent Agreement, compiles the Talent’s unmodified photographs into a file or set of files (the “Character Sheet”) and delivers it to the Licensee, who generates the advertising imagery. The Talent is notified by email and the licence is recorded in their account. We do not generate any imagery ourselves, we create no models or embeddings from anyone’s photographs, and our involvement with the images ends at delivery, apart from administering and enforcing the licence. Everything from account creation to delivery is done in performance of the Talent Agreement, which is the contract the Talent accepts at sign-up.

2. Data We Collect

2.1 We collect the following categories of personal data.

2.2 What we do not collect. We do not collect or hold information about criminal convictions, charges or offences. Talent give a contractual warranty in the Talent Agreement that they have no unspent conviction for (i) an offence of violence against the person; (ii) a sexual offence; (iii) an offence of dishonesty, including fraud; (iv) an offence that was racially or religiously aggravated or otherwise motivated by hostility towards a protected characteristic; or (v) a terrorism offence, but we do not ask them to describe any conviction, we do not run criminal record checks, and no conviction data is recorded in any profile or account (see Section 5). We do not collect ethnicity, health, religious, political or other special category data, and we do not receive the images or biometric data used in identity verification (see Section 3.3).

3. Our Position on Photographs and Biometric Data

3.1 Photographs are personal data, and we treat them with strict safeguards. The photographs Talent upload, and the Character Sheet, are personal data and are protected with the technical and organisational measures described in Section 14, including encryption at rest and in transit and restricted access.

3.2 We do not process photographs to identify anyone. We do not create biometric templates, embeddings, measurements or models from photographs. We do not use facial recognition, facial matching or any comparable technology. No processing on the Platform is carried out for the purpose of uniquely identifying a natural person, and every licence we administer contractually prohibits Licensees from any such use and from training or fine-tuning any model on the photographs. On that basis, our processing of photographs is not processing of special category biometric data within Article 9 UK GDPR.

3.3 The one exception: identity verification, which is ringfenced and carried out by Stripe. Before a Talent can be listed, their identity is verified by Stripe through Stripe Identity. Talent are redirected to Stripe, capture the required images themselves, and Stripe carries out the verification checks, which involve biometric processing performed by Stripe on the basis of the explicit consent Talent give to Stripe (Article 9(2)(a) UK GDPR). We never receive, hold or process the verification images or the biometric data involved. We receive only the outcome of the check and minimal associated metadata. Stripe’s processing is described in Stripe’s privacy notice, presented before verification begins.

4. Lawful Bases

4.1 The table below sets out the lawful basis for each kind of processing we carry out.

4.2 The marketplace runs on contract. When a Talent accepts the Talent Agreement, they enter into a contract with us under which we host their photographs, list their profile when they choose to switch it on, conclude campaign licences on their behalf within the settings they have chosen, deliver their Character Sheet under each licence, and account to them for their share of the fee. All of that processing is necessary to perform that contract, and Article 6(1)(b) is our lawful basis for it. The same basis covers our processing of Licensee personal data to operate their accounts and transactions.

4.3 Why we do not ask for consent to list you. Being listed is the service you sign up for, not an optional extra. If we asked for a separate consent to list you, that consent could not be freely given, because refusing it would defeat the purpose of the account. Your control sits in the contract instead: your listing switch decides whether you can be licensed at all, your category settings decide which campaigns you can be licensed for, and both are checked at every checkout and take effect immediately. Relying on contract is more honest about what is happening and gives you clearer rights: you can switch your listing off, or leave the Platform entirely, at any time and for free, and the Talent Agreement spells out exactly what happens to any campaign licence in each of the two states described in Section 10.

4.4 Where we do rely on consent, it is real consent. We rely on consent for two things only: the identity check (which you consent to with Stripe, on Stripe’s own screen) and marketing messages from us. Each is requested separately, is never pre-ticked, is not a condition of using the Platform, and can be withdrawn at any time without affecting your account. We do not treat acceptance of the Talent Agreement, the Licence Agreement or the Terms of Service as consent to anything.

4.5 Other bases. We rely on legitimate interests (Article 6(1)(f)) for Platform security, fraud prevention and enforcement of our terms, having concluded on assessment that these interests are not overridden by your rights; and on legal obligation (Article 6(1)(c)) for tax, accounting and regulatory compliance.

4.6 What consent is not used for.A Talent’s campaign category preferences (for example staying closed to alcohol or gambling campaigns) and their listing on/off setting are contractual settings, not data protection consents. Changing them is a contract variation and does not affect the lawfulness of processing.

5. Criminal Offence Data

5.1 We hold none. The Talent Agreement asks each Talent to warrant that they have no unspent conviction in the five categories listed in Section 2.2. That is a contractual promise, not a data collection exercise. We do not ask anyone to disclose a conviction, we do not run criminal record checks, we do not store any answer to a question about convictions, and no field relating to convictions exists in any profile or account. The only record we keep is that the Talent accepted the Talent Agreement, which version, and when.

5.2 If you choose to tell us something. A Talent may contact support to ask whether they can give the warranty, or to tell us that it is no longer accurate. Anything you volunteer in that way is personal data relating to criminal convictions and offences under Article 10 UK GDPR. We process it on the basis of Article 6(1)(b) (it is necessary to decide whether the Talent Agreement can be performed) and the condition in paragraph 29 of Schedule 1 to the Data Protection Act 2018 (your consent, expressed by your choosing to tell us). We handle it as follows: it is dealt with in the support system, never copied into your profile or account record; it is seen only by the people who need to answer you; a person, not an automated system, makes any decision that follows from it; and it is deleted within three months of the query being resolved, unless we need to keep it to establish, exercise or defend a legal claim. You do not have to tell us anything beyond the fact that the warranty is or is not accurate.

6. Marketing Communications

6.1 We will send you marketing messages by email only if you have opted in. The opt-in is a separate, unticked box and is not a condition of holding an account or being listed. You can withdraw at any time using the unsubscribe link in any message, and we will stop within a reasonable time. Service messages that are necessary to operate your account, such as notifications that your likeness has been licensed, payout confirmations and notices of changes to our agreements, are not marketing and do not depend on the opt-in.

7. The Character Sheet and Who Receives It

7.1The Character Sheet is a file, or set of files, containing only the Talent’s unmodified uploaded photographs, a listing reference and a professional name. It is delivered to a Licensee only under a campaign licence concluded within the Talent’s settings on the Talent’s standing authority, and delivery is gated on payment for a campaign order that passes those checks.

7.2 From delivery, the Licensee is an independent controller of the personal data in the Character Sheet. The Licensee is contractually bound to use it solely for the licensed campaign, by reference-conditioned generation only (supplying the Character Sheet as an input to each generation, with no training, fine-tuning or persistent model of any kind), to keep it secure, to share it only within a recorded delivery chain (production companies and the named end client, each bound to the same obligations), never to use it for identification purposes, and to delete it, and confirm deletion in writing, at the end of the licence term.

8. Data Use

We use personal data to: operate and maintain the Platform; verify eligibility; match campaigns to Talent settings at checkout and conclude and record campaign licences; compile and deliver Character Sheets under those licences; notify Talent of each licence; process licensing transactions and payouts; manage accounts and provide support; send marketing messages where you have opted in; enforce our agreements, including auditing Licensee compliance; detect and prevent fraud, abuse and security incidents; and comply with legal obligations.

9. Cookies and Tracking Technologies

The Platform currently sets strictly necessary cookies only (session management, security and, once we introduce any optional cookies, your cookie preferences). Strictly necessary cookies do not require consent under the Privacy and Electronic Communications Regulations 2003 (PECR), so no cookie banner is shown. If we introduce analytics, functional or advertising cookies in future, we will update our Cookie Policy first, identify any analytics cookies that fall within the Data (Use and Access) Act 2025 exemption, and obtain consent through a cookie banner before placing any cookie that requires it. For further detail see our separate Cookie Policy.

10. Withdrawal, Removal and What Happens to Licences

10.1 Talent may switch their listing off at any time in account settings, and may withdraw from the Platform entirely at any time through account settings or by contacting support@likeness-app.com. Both are free and require no reason. Withdrawal ends the Talent Agreement in respect of the listing; it is a termination of contract, and the effect depends on which of two states each licence is in:

• (a) Listed only. The listing is removed immediately. No further campaign licence is concluded and nothing further happens.
• (b) Delivered. The campaign licence continues to the end of its stated term. This is explained to Talent at sign-up, and the standing authority they give in the Talent Agreement, within the settings they chose, is what commits the Talent to that term. At term end the Licensee and every party in its delivery chain must delete the Character Sheet, confirm deletion in writing, and cease all use of the generated content.

10.2Following withdrawal we erase the Talent’s photographs and Character Sheet from the Platform within 30 days, or, where a delivered licence is still running, within 30 days after the last such licence ends, because we need them to administer that licence until then. This is subject to any longer retention required or permitted by law (for example fraud prevention, tax, or the establishment, exercise or defence of legal claims), in which case we retain them only for as long as and to the extent required. Withdrawal does not affect the lawfulness of processing before it took effect.

10.3 Where a licence continues to term under Section 10.1(b), the lawful basis for the continued use of already-generated content is the performance of the campaign licence (Article 6(1)(b)) and, where applicable, the establishment, exercise or defence of legal claims (Article 17(3)(e)).

11. Data Sharing

We share personal data with: payment processors (to facilitate transactions and payouts); Stripe (for the ringfenced identity verification described in Section 3.3); cloud infrastructure providers (hosting and storage); email providers (to deliver service messages and, where you have opted in, marketing); technical service providers (operation and security); Licensees (the Character Sheet, only under a campaign licence as described in Section 7); legal authorities (where required by law, court order or regulatory requirement); and professional advisors (legal, accounting and audit, under confidentiality obligations). We do not sell personal data. Our service providers process personal data only on our instructions and in accordance with applicable data protection law.

12. International Data Transfers

Personal data may be transferred to and processed in countries outside the UK and the EEA, including where our cloud infrastructure, payment or technical providers are based. Where we transfer personal data outside the UK or EEA we ensure appropriate safeguards, including: transfers to countries recognised as adequate by the UK Secretary of State or the European Commission; Standard Contractual Clauses supplemented by the UK International Data Transfer Addendum where required; or other lawful transfer mechanisms. In assessing protection in third countries we apply the “not materially lower” standard introduced by the Data (Use and Access) Act 2025. Transfers of photographs and Character Sheets additionally carry encryption in transit and contractual restrictions on sub-processing. You may request a copy of the safeguards by contacting support@likeness-app.com.

13. Data Retention

14. Security

We implement appropriate technical and organisational measures, including: encryption of personal data at rest and in transit; access controls and authentication; segregated storage of photographs and Character Sheets with access restricted to authorised personnel and systems; regular security assessments and penetration testing; staff training; and incident response procedures.

15. Data Breach Notification

In the event of a personal data breach we will: notify the Information Commissioner’s Office within 72 hours of becoming aware, where the breach is likely to result in a risk to individuals’ rights and freedoms; notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms; and document all breaches in our internal breach register. Given the personal significance of facial photographs, any breach involving photographs or Character Sheets will be treated as likely to meet the high-risk threshold requiring individual notification unless a documented risk assessment concludes otherwise.

16. Automated Decision-Making

16.1 Concluding campaign licences is automated. When a Licensee completes checkout for a campaign, the Platform automatically checks whether the Talent’s listing is on and their account is listable, whether the campaign category is one the Talent is open to, whether any exclusive licence in force would conflict, and whether the Licensee has accepted the Licence Agreement and paid, and if so concludes the campaign licence on the Talent’s behalf and delivers the Character Sheet, without human review. This is a decision with legal effect for the Talent. It is necessary for the performance of the Talent Agreement (Article 22(2)(a) UK GDPR): concluding licences within the Talent’s chosen settings, without referring each one to them, is the service the Talent has signed up for. The safeguards are that every licence is recorded in the Talent’s account with the campaign name, category, tier, term and fee; the Talent may contest any licence they believe falls outside their settings by contacting support@likeness-app.com, and a person will review it; and the Talent can stop the automation at any time by switching their listing off.

16.2 Other automated processing. Identity verification is automated by Stripe as described in Section 3.3. We do not use automated comparison of faces or any facial recognition technology, and we make no automated decisions about anyone on the basis of criminal offence data, because we hold none. Where automated processing produces decisions with legal or similarly significant effects, we ensure the safeguards required by the UK GDPR and the Data (Use and Access) Act 2025, including the right to obtain human intervention, to express your point of view and to contest the decision. To request human review of an automated decision, contact support@likeness-app.com.

17. Your Rights

Under the UK GDPR and EU GDPR you have the following rights: access (Article 15); rectification (Article 16); erasure (Article 17), subject to the licence provisions in Section 10; restriction of processing (Article 18); data portability (Article 20); objection (Article 21), including to processing based on legitimate interests and to direct marketing; withdrawal of consent at any time (Article 7(3)), which applies to marketing messages and to identity verification through Stripe, without affecting prior processing; and the right to lodge a complaint with the Information Commissioner’s Office at ico.org.uk or another relevant supervisory authority. To exercise any of these rights contact support@likeness-app.com. We will respond within 30 days.

18. Data Privacy Complaints Procedure

In accordance with the Data (Use and Access) Act 2025 we maintain a formal complaints procedure. You may submit a complaint to support@likeness-app.com or by post to the address in Section 20. We will acknowledge receipt within 30 days, investigate without undue delay and provide a substantive response including any actions taken or proposed. If you are not satisfied, you may complain to the ICO or seek a judicial remedy.

19. Impact Assessment and Records

We have conducted a Data Protection Impact Assessment covering the Platform’s processing of photographs, the delivery of Character Sheets and the licensing model, and we review it regularly as our processing, technology and the regulatory environment change. A summary is available on request from support@likeness-app.com. We maintain Records of Processing Activities under Article 30 UK GDPR, reviewed regularly and available to the ICO on request.

20. Data Protection Contact and Supervisory Authority

Data protection enquiries should be addressed to our data protection lead at support@likeness-app.com, or by post to Likeness Ltd, Flat 3, 50 Dunlace Road, London, England, E5 0NE. Our lead supervisory authority is the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom (ico.org.uk).

21. Changes to This Policy

We may update this Privacy Policy from time to time and will notify you of material changes by email at least 30 days before they take effect. Where changes are required to comply with new or amended legislation or regulatory guidance, we may implement them on shorter notice or with immediate effect where legally mandated.