Biometric Data Policy
Version 5.3, 22 October 2026. Effective 9 November 2026. Published at mirai.inc/legal/biometric-policy.
v5.3 change note: the required face checks and the optional video partner described; one signature rule for every channel; the US-person engine rule stated (R17).
This is the public written policy of Mirai Talent Inc. ("Mirai", "we") for biometric data: what we collect, why, how long we keep it and when we destroy it. It is our policy and retention schedule under the Illinois Biometric Information Privacy Act (section 15(a)), and it also covers Texas, Washington and Colorado law. It says the same as section 5 of our Privacy Notice and clause 10 of the Likeness Licence. If they ever seem to differ, we follow the rule that protects you more.
What we collect
Only from people who signed a Likeness Licence and ticked the face-data box. At launch, US persons and residents of Colombia and the Philippines cannot sign it or add their own face (Terms §1.4B); what this policy says about them applies when own-face sign-up opens in their market. We call it face data:
- Face templates and embeddings: numbers computed from your kit photos that describe your face.
- Adapters and model weights: a small AI model made from your kit so our engines can make content that looks like you. Together with the items below, this is your Private Likeness Model.
- Your character sheet, made from your kit.
- Likeness scores: how closely a photo or an output matches your kit.
- A face reference held by our optional video partner, only if you tick its own box (see "Our optional video partner" below).
Your kit (your selfie, head-turn, photos and, if you add it, voice) is what face data is made from. Some laws treat the kit itself as biometric data, so we protect and delete it in the same way.
What we never collect. We never receive iris data or any other biometric data our identity-verification partner collects for the Verified Human Check (Terms §0.1A). We never build a template of anyone who has not signed. To stop people using faces that have not signed, an uploaded photo that shows a face is refused unless it is part of your own kit. That check only detects that a face is present: it builds no template and compares the face with no one (Terms §6.2).
Why
Only to make the content of you that your Licence allows, and to check it looks like you, including that the face in your kit is yours.
The face checks are required. Two automated face checks are part of adding your face, and you cannot add it without them: when you add your kit, a check that your selfie, head turn and photos show the same person; and on content made of you, a check that it looks like you. Both compare only with your own kit and never search across other people.
We never use face data to identify, search for, track or classify anyone.
Your consent comes first
Before we collect anything, the signing screen has its own face-data block. It tells you what we collect, why, who processes it and how long we keep it. Ticking its unticked box and signing with your signature (Terms §0.1A: a wallet signature in a Partner App, or your typed name and tap on the web) is your written release. We record it with its own time (biometricConsent).
Nothing face-derived is computed before your signature and that box. Frames captured earlier are plain photos, deleted within 24 hours if you do not sign. You can say no and still create without your face.
Never sold
We never sell, lease or trade face data, or profit from it as such. We never give it as security, put it in a dataset, or use it to build identification or surveillance models. Face templates and adapters never go into a training set. Your kit and content of you are used for AI training only if you signed the separate AI Training Licence. Residents of Texas, Washington and Illinois are never trained on.
We disclose face data only:
- to the processors listed below, which your consent covers, under contract and on our written instructions; or
- where the law requires it, or under a valid warrant or subpoena.
How long we keep it
The first deadline to arrive applies.
| What | Destroyed |
|---|---|
| Frames captured before you sign | Within 24 hours, if you do not sign |
| Your kit, face data, Private Likeness Model and every adapter copy | Within 30 days of a Stop, of withdrawing your face-data consent, or of closing your account |
| The same, if you never stop | Within 2 years of your last activity on Mirai (a licence of you sold to a buyer counts as activity), and never more than 3 years after your own last interaction with Mirai |
| Colorado residents | Also never more than 24 months after your own last interaction |
| Texas and Washington residents | Also within 1 year after the purpose ends or your Licence ends, if that is sooner |
| Argentina residents | We store no template, embedding, adapter or private model. Your kit is read each time content of you is made, and anything face-derived is deleted when that generation ends (faceDataMode: perGeneration). Your kit still goes to the engines that make each generation, some outside Argentina, on your express consent and the AAIP's model clauses (Licence 10.3A) |
| An adapter held by a hosted-model partner | Use stops within 72 hours of a Stop; deleted with a certificate |
| A face reference held by our optional video partner | Within 30 days of withdrawing that consent, of your face sign-up not being approved, or of closing your account; and in any case by the deadlines above |
| A person found to be under the minimum age | Within 30 days, with all use stopped at once |
| Illinois residents | None is collected (see below) |
"Your own interaction" means you open Mirai, sign, change a setting or approve a licence.
We keep face data longer only if a valid warrant or subpoena requires it, and then only what it covers, for as long as it requires.
How we destroy it
- We delete it from live systems, partner copies and backups within the same deadline. Backups are covered by destroying their encryption key.
- Each deletion is a dated entry in our ledger. Afterwards the ledger keeps hashes and dates, never images or templates.
- Content already made of you is not face data. It follows your Licence.
Who can access it
- Mirai staff and systems that run the service, with role-limited, logged access.
- Processors, by category:
- cloud hosting and storage, which keep it encrypted;
- a cloud face-comparison service, which compares your photos with your selfie and outputs with your kit;
- an AI vision model, which scores how closely content made of you looks like your own kit, and may not train on it;
- a voice service, only if you add your voice, which makes your voice for content of you from your sample;
- image-safety services, which check for unsafe content and whether a face is present, and compare no faces;
- generation engines and the hosts that run them, which receive kit references for each generation, use them only for that job, and may not train on them;
- safety vendors that check content; and
- a hosted-model partner, which may hold your adapter only as Mirai's property and processor (never for Texas or Washington residents, whose face data stays on systems Mirai controls); and
- our optional video partner, only for people who tick its box (below).
- The face data of a US person never goes to an engine, face check or partner developed or run by a company based in, or controlled from, China (including Hong Kong) or another country of concern.
The named list, with countries, is at mirai.inc/legal/recipients. Analytics, email, advertising and payment providers never receive face data.
Our optional video partner
Only if you tick its own box on the signing screen, Mirai shares your kit photos with our optional video partner. It runs a short live face check and keeps a reference of your face so it can make video of you for Mirai. It uses it only for that, never to train models or for anything else. It is our processor, acts on our written instructions and processes outside your country, where the recipients list shows. When you withdraw in Settings, if your face sign-up is not approved, or if you close your account, we instruct it to delete the reference within 30 days. It keeps only the records the law requires it to keep, under its own privacy notice. It is never offered to US persons or Argentine residents. Saying no changes nothing else.
How we protect it
Encrypted in transit and at rest, stored apart from other data, with role-limited and logged access: at least the care we give our most sensitive data. We keep a written plan for security incidents and treat any incident touching face data as high risk. We tell you without undue delay.
Illinois
At launch, Illinois residents can create and remix but cannot add their own face. Nobody can add or upload a face while connecting from Illinois, or on an account whose declared or connection state is Illinois, on any Mirai surface, including business and partner tools (Licence 23.6). We collect no kit or face data from them, make no content of them, and do not license or train on them. If we learn that someone with face data lives in Illinois, we stop generation at once and destroy their kit and face data within 30 days. Before we ever open own-face features in Illinois, we will update this policy and the signing screen first.
Your choices
- Withdraw your face-data consent in Settings, one tap. It works as a Stop, and deletion follows the table above.
- Ask what face data we hold, in Settings or at legal@mirai.inc.
- We never keep face data longer than this policy says without your fresh signature.
Contact
Privacy and biometric questions: legal@mirai.inc. Mirai Talent Inc., 2810 North Church Street, Wilmington, DE 19802, USA. Earlier versions: mirai.inc/legal/versions.