Legal · BIPA

Biometric
consent.

Illinois residents — and, by policy, everyone who uses Medusa — see this disclosure before we capture or process any biometric identifier. It describes what Medusa collects, how we use it, how long we keep it, and your rights.

What we collect

When you upload a reference photo or record a liveness frame, Medusa extracts a faceprint: a fixed-length vector of numbers (512 floating-point values) that encodes the geometry of the face detected in the image. The faceprint is a biometric identifier under the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14.

Why we collect it

• Identity verification. We match a selfie you record at sign-up against the reference photos you upload, to confirm that the person filing takedowns is the person depicted in the content we find.
• Content matching. We compare your faceprints against faceprints extracted from images our crawlers discover on the internet, so we can surface possible matches to you.
• Takedown evidence. Matched faceprints, similarity scores, and model versions are included in the evidence PDFs we send with takedown notices.

How long we keep it

We retain your faceprints for as long as your account is active and for the shorter of three years from your last interaction or the statutory minimum, per BIPA § 15(a). When you delete your account, Medusa purges all reference photos, liveness frames, and faceprints — including those referenced in matches — within 30 days. Evidence PDFs attached to already-filed takedowns may retain image excerpts for the duration legally required to maintain the DMCA record.

Who we share it with

Medusa does not sell, lease, trade, or otherwise profit from your biometric data. We share faceprints with third parties only where required by law (e.g. in response to a valid subpoena or search warrant), or as part of evidence in takedown notices you explicitly authorise us to file on your behalf.

Your rights

• You can revoke this consent at any time by deleting your account in the dashboard. We purge biometric data within 30 days.
• You can export a record of the biometric data we hold about you via the data export option on your profile page.
• You can contact privacy@mymedusa.org with questions, corrections, or legal requests.

Acknowledging consent

You explicitly acknowledge this consent from the Profile page in your dashboard before running your first liveness check. Medusa will not capture liveness frames or extract faceprints from your uploaded photos until that acknowledgement is recorded and timestamped on your account.