Privacy Policy

1. Information We Collect

1.1 Account Information

When you create a PersonaWatch account, we collect:

• Email address
• Password (stored as a cryptographic hash; we never store plaintext passwords)
• Authentication tokens and session data
• If you sign in via a third-party provider (e.g., Google OAuth), we receive your name and email address from that provider

1.2 Uploaded Media and Content

To perform analysis, you may upload the following types of content:

• Images (JPEG, PNG, WebP, HEIC/HEIF)
• Videos (MP4, MOV, AVI, WebM)
• Screenshots of headlines or text for fact-checking
• Audio recordings (WAV, MP3, M4A, AAC, and similar formats) for synthetic voice and voice clone analysis
• Screenshots of emails, messages, or communications for phishing and fraud detection

Important: Uploaded media may contain embedded metadata (EXIF data), including device information, GPS coordinates, timestamps, and camera settings. Our Service extracts and analyzes this metadata as part of the forensic analysis process.

1.3 Automatically Collected Information

When you use the Service, we may automatically collect:

• Device type, browser type, and operating system
• IP address
• Usage data such as scan counts, feature usage, and session duration
• Log data including access times, pages viewed, and error reports
• Device push notification tokens, if you enable notifications in the PersonaWatch mobile app (used solely to deliver analysis results and service notifications to your device)

1.4 Payment Information

If you purchase a subscription, payment is processed by our third-party payment processor (Stripe, Inc.). We do not store your full credit card number, CVV, or banking details. We receive only a transaction identifier, subscription status, and billing summary from the payment processor.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To perform AI detection analysis, deepfake detection, synthetic voice and voice clone detection, source attribution, metadata analysis, headline fact-checking, phishing email detection, and SMS spam text analysis on your uploaded media and content.
• Account Management: To create, maintain, and authenticate your account; track scan usage against your subscription tier; and communicate with you regarding your account.
• Service Improvement: To analyze aggregate usage patterns, diagnose technical issues, and improve the accuracy and performance of our detection models.
• Security: To detect and prevent fraud, abuse, or unauthorized access to the Service.
• Legal Compliance: To comply with applicable laws, legal processes, or enforceable governmental requests.

3. Media Processing and Data Retention

3.1 How Uploaded Media Is Processed

When you upload media for analysis, the following occurs:

• Media is transmitted via encrypted connection (TLS/HTTPS) to our processing servers.
• AI detection models analyze the media for indicators of synthetic generation, facial manipulation, and image/video manipulation.
• Embedded metadata (EXIF) is extracted and analyzed for provenance verification.
• Uploaded audio is analyzed for indicators of synthetic or cloned speech. Like other uploaded media, audio files are not permanently stored after analysis (see Section 3.2).
• For headline fact-checking, text extracted from images is sent to multiple third-party AI services for independent verification (see Section 5).
• For phishing email detection, text and sender information extracted from uploaded email screenshots are sent to multiple third-party AI services for claim verification and sender domain analysis (see Section 5). No email account credentials or inbox access is required or requested.
• For SMS spam text analysis, text and URLs extracted from uploaded text message screenshots are analyzed. URLs are resolved by following HTTP redirect chains via HEAD requests only — no page content is rendered or executed. The final destination domain and any claims in the message are sent to third-party AI services for verification (see Section 5).
• For Image History (provenance research), which runs only when you choose to run it on an image, the image is sent to Google Cloud Vision for reverse-image matching and a written description of the image is sent to third-party AI research services (see Section 5).
• Analysis results are compiled and presented to you in the platform interface.

3.2 Data Retention

• Uploaded Media: Media files uploaded for analysis are processed in real time and are not permanently stored on our servers after analysis is complete. Temporary copies may exist in server memory or cache during processing and are purged upon completion or within 24 hours, whichever is sooner.
• Analysis Results: Summary results (scores, classifications, metadata summaries) may be retained in association with your account for your reference and to support report generation. These results do not include the original uploaded media.
• Account Data: Account information is retained as long as your account is active. Upon account deletion, we remove your personal data promptly (and in all cases within 30 days), except for the limited records described below and where retention is required by law.
• Deleted Account Records: When you delete your account, we retain a minimal record that you were a customer — your name, email address, membership dates, subscription tier at the time of deletion, and the version of our terms and this policy you accepted — for legal, audit, and fraud-prevention purposes. This record is retained for five (5) years from the date of deletion, is stored separately from active account data, is not linked to any active account, and is accessible only to authorized personnel.
• Call Consent Records: If you use call scanning features, records documenting that the consent announcement was delivered on a scanned call are retained for five (5) years from the date of the call, including after account deletion, for legal and audit purposes.
• Server Logs: Automatically collected log data is retained for up to 90 days for security and diagnostic purposes, after which it is deleted or anonymized.

4. AI Models and Automated Decision-Making

PersonaWatch uses multiple AI and machine learning models to analyze uploaded content. These include models for AI-generated content detection, facial manipulation detection, image manipulation localization, and source attribution.

We do not use your uploaded media to train our AI models. Your content is processed solely for the purpose of providing analysis results to you. Model training is conducted using separately sourced and licensed datasets.

Analysis scores and classifications are generated by automated systems. These results are intended as investigative aids and should not be treated as definitive determinations. Human judgment and additional verification should always be applied, particularly in legal or evidentiary contexts.

5. Third-Party Services and Data Sharing

We use the following categories of third-party services in connection with the platform:

Category	Provider(s)	Data Shared
Authentication	Supabase	Email, hashed password, session tokens
Payment Processing	Stripe, Inc.	Payment details (processed directly by Stripe; we receive only transaction IDs and subscription status)
AI Fact-Checking & Phishing Detection	Anthropic (Claude API), OpenAI (ChatGPT API), Perplexity AI (Sonar API)	Text and sender information extracted from uploaded images for headline verification, claim verification, phishing analysis, and SMS spam text analysis. No personally identifiable user information is transmitted. Each provider independently verifies claims using real-time web search.
Provenance Research (Image History)	Google Cloud Vision (Web Detection); Anthropic, OpenAI, Perplexity AI	Only when you choose to run Image History: the uploaded image is sent to Google Cloud Vision for reverse-image matching; a written forensic description of the image is sent to AI research engines. See the Image History paragraph below.
Cloud Hosting	Railway, RunPod	Uploaded media is processed on these platforms' infrastructure during analysis

Image History (Provenance Research)

When you choose to run Image History on an image, we research that image's public circulation history. This involves transmitting data to third-party processors: (1) the image itself is sent to Google Cloud Vision (Web Detection), which performs reverse-image matching against Google's web index and returns matching URLs and page titles; and (2) a written forensic description of the image is sent to AI research engines that search public reporting and publication records. These transmissions occur only when you run Image History and are not part of standard scans. Google processes images under the Google Cloud Data Processing Addendum and does not use your content to train its models. For images that do not depict public figures, we discard identity-related data returned by these services and retain publication history only.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

We may disclose your information if required to do so by law, court order, or governmental regulation, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of PersonaWatch, our users, or the public.

6. Data Security

We implement industry-standard security measures to protect your information, including:

• TLS/HTTPS encryption for all data in transit
• Encrypted storage for authentication credentials
• Access controls and authentication requirements for platform infrastructure
• Regular security reviews of third-party service providers

While we take reasonable precautions, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

7. Your Rights and Choices

• Access and Correction: You may access and update your account information at any time through the platform settings.
• Account Deletion: You may delete your account directly in the PersonaWatch mobile app (Account → Delete Account) or by contacting us at the email address below. In-app deletion takes effect immediately; emailed requests are processed within 30 days. A minimal record is retained as described in Section 3.2. Deleting your account does not cancel subscriptions billed by third parties (such as Apple) — manage those through the respective provider.
• Data Portability: You may request a copy of your data in a commonly used format.
• Opt-Out of Communications: You may opt out of non-essential communications at any time by following the unsubscribe instructions in our emails or by contacting us.

If you are a resident of California, the European Economic Area, or another jurisdiction with applicable privacy laws, you may have additional rights. Please contact us to exercise those rights.

8. Cookies and Local Storage

The Service uses browser local storage to maintain your authentication session. We do not use third-party advertising or tracking cookies. Essential session data is stored locally on your device to keep you logged in and is cleared upon logout.

9. Children's Privacy

PersonaWatch is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete such information promptly.

10. International Data Transfers

PersonaWatch is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other jurisdictions where our service providers operate. By using the Service, you consent to such transfers.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Each revision is assigned a version identifier (the current version is 2026-07). We will notify you of any material changes by posting the updated policy on the platform with a revised "Last Updated" date and version identifier, and material changes may require you to re-accept the updated policy before continuing to use the Service. Your continued use of the Service after such changes constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at:

PersonaWatch, LLC
Website: personawatch.ai