C
CastProofLegal← Back to Home

Biometric Data Consent

Last updated: February 2026

Consent Version: 1.0

This Biometric Data Consent ("Consent") is required by the Illinois Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act, the Washington Biometric Identifiers law (RCW 19.375), and similar state laws. This Consent is separate from and in addition to our general Terms of Service and Privacy Policy.

1. What Biometric Data We Collect

When you register as a Model on CastProof, we collect the following biometric identifiers and biometric information:

Data TypeSourceClassification
Facial geometry (faceprint)Headshot photos, full-body photos, reference videosBiometric identifier
VoiceprintVoice samples, consent video audioBiometric identifier
Body geometryFull-body photos, reference videosBiometric information
Facial expression patternsConsent video, reference videoBiometric information

2. Purpose of Collection

Your biometric data is collected and processed for the following specific purposes:

  1. AI Model Training: To create machine learning models that can generate a Digital Replica of your likeness in response to approved Usage Requests from Creators
  2. Identity Verification: To verify that uploaded Likeness Assets match your verified identity (via Stripe Identity)
  3. Content Generation: To produce video, image, and audio content featuring your Digital Replica as part of the Platform's core service
  4. Watermark Verification: To verify the provenance of generated content and support enforcement of your likeness rights

Your biometric data will not be used for surveillance, tracking, profiling, or any purpose other than those described above.

3. Third-Party Disclosure

Your biometric data is shared with the following third-party AI vendor sub-processors for the purposes described above:

VendorBiometric Data SharedPurposeJurisdiction
Tavus Inc.Facial geometry, expressionsVideo replica trainingUnited States
HeyGen Inc.Facial geometryVideo avatar generationUnited States
ElevenLabs Inc.VoiceprintVoice cloningUnited States
Stripe Inc.Facial scan (ID verification)KYC/age verificationUnited States

Note regarding other AI vendors: CastProof also uses Google Cloud (Veo) and OpenAI (Sora) for video generation. These vendors receive text prompts and reference images only — they do not receive raw biometric identifiers (faceprints, voiceprints, or body geometry data). Because these vendors do not process biometric data as defined under BIPA or similar statutes, they are not listed in the biometric data disclosure table above. For a complete list of all sub-processors, see our Data Processing Agreement.

CastProof maintains Data Processing Agreements with each vendor requiring them to protect your biometric data, use it only for the specified purposes, and delete it upon our instruction.

Your biometric data will not be sold, leased, or otherwise commercially disclosed to any party not listed above.

4. Retention Schedule

Your biometric data is retained according to the following schedule:

Data TypeRetention PeriodDeletion Trigger
Likeness Assets (photos, videos)Duration of account + 30 daysAccount deletion or consent revocation
AI training model weightsDuration of account + 30 daysAccount deletion or consent revocation
Generated contentPer approved license termLicense expiration or takedown
Audit logs (hashes only)7 yearsLegal retention period

When biometric data reaches the end of its retention period, it will be permanently and irreversibly destroyed using secure deletion methods. Vendor sub-processors are contractually required to confirm destruction within 30 days of our deletion request.

5. Your Rights

You have the following rights with respect to your biometric data:

  1. Right to Withdraw Consent: You may withdraw this consent at any time by deactivating your Model profile or contacting us at privacy@castproof.com. Withdrawal does not affect the lawfulness of processing performed before withdrawal.
  2. Right to Access: You may request a copy of the biometric data we hold about you.
  3. Right to Deletion: You may request permanent deletion of all biometric data. We will process deletion requests within 30 days.
  4. Right to Know: You may request information about what biometric data we have collected, how it has been used, and which third parties have received it.
  5. Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

6. Security Measures

We protect your biometric data with the following security measures:

  • Encryption at rest (AES-256) and in transit (TLS 1.3)
  • Access controls limiting biometric data access to authorized personnel and automated systems only
  • Malware scanning of all uploaded assets before processing
  • Regular security audits and penetration testing
  • Incident response procedures including 72-hour breach notification

By clicking "I Accept" or "I Consent" during Model onboarding, you confirm that:

  1. You have read and understand this Biometric Data Consent in its entirety
  2. You voluntarily and knowingly consent to the collection, storage, use, and sharing of your biometric data as described herein
  3. You understand that this consent is separate from and in addition to the general Terms of Service
  4. You understand that you may withdraw this consent at any time
  5. You are at least 18 years of age

8. Changes to This Consent

If we make material changes to this Biometric Data Consent, we will notify you via email and require you to re-consent before continuing to use the Platform as a Model. Continued use after notification without re-consent will result in suspension of your Model profile until re-consent is obtained.

9. Contact

For questions about biometric data handling, to exercise your rights, or to withdraw consent: