The key point
The photos taken for analysis never leave your device.
MediaPipe Face Mesh processes them directly in your browser, extracts the coordinates of 468 points and measures the sharpness of the face in each photo. Only those numbers, calculated on your device, are sent to the server, never the image: the coordinates are used to calculate the result, the sharpness to observe the quality of the captures. The photos taken for analysis are neither transmitted nor stored by LooksLadder.
The photos you choose to post to Votes are a different matter: they are sent to the server to be shown to voters, and a duel puts two of those photos side by side. A duel compares no measurement: the votes decide it.
1. Data controller
The data controller is Paco GOMEZ, established at 360 route du Piraud, 38870 Saint-Pierre-de-Bressieux, France.
Privacy contact: [email protected]Data Protection Officer, if appointed: no data protection officer has been appointed
2. How analysis works
- You allow camera access and take two or three photos in the app.
- The model running in your browser locates 468 points and produces their coordinates. It also measures the sharpness of the face in each photo, as a single number per photo.
- The working photo is discarded locally after extraction. LooksLadder does not receive the image file.
- The server receives those numbers and calculates geometric measurements, a score, a report and a percentile. Without a subscription, the score is calculated as soon as they are sent, but it is only shown to you after you subscribe.
- The coordinates are deleted as soon as the score is calculated. Results required for history or a ranking are retained according to your choices and the periods below.
Your browser controls camera permission. You can remove permission in the browser settings. Doing so stops new analyses but does not automatically erase stored results; use the deletion feature in section 10 for that.
3. Data, purposes, legal bases and retention
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Photos taken for analysis | Extract the useful points locally. | Local processing initiated at your request and camera permission given to the browser. | No server-side retention. The working image is discarded on the device when extraction ends or the page is closed. |
| Account: email, password hash, date of birth, username, language, country or region | Create and secure the account, enforce age rules, personalise the service and communicate with you. | Performance of a contract (GDPR Article 6(1)(b)) and, for some checks, a legal obligation (Article 6(1)(c)). | For the life of the account. An account inactive for two years may be deleted after notice, except where retention is required. |
| Coordinates of 468 points, geometric measurements, results, reports and progress history | Calculate and display the score, percentile, report and progress. | Performance of a contract (Article 6(1)(b)). | Coordinates: deleted as soon as the score is calculated. Measurements, results and history: for the life of the account or until the analysis is deleted. Removal from active systems within 72 hours of the request and from backups within 30 days. |
| Score calculated before the subscription: score, tier, criteria and measurements of a scan sent without a subscription | Prepare your result as soon as you scan, to show it to you when you subscribe with no new calculation. It is shown to no one, not even you, before the subscription. | Steps taken at your request before entering into a contract (Article 6(1)(b)). | 30 days without a subscription, then deleted automatically. A new scan replaces and deletes the previous one. After you subscribe, it joins your results and follows their retention. |
| Face sharpness: one number per photo, calculated on your device | Observe the real quality of captures, in order to set a blur check later. It rejects no photo and is part of no score. | Legitimate interest in making measurements reliable (Article 6(1)(f)). | 90 days, then deleted automatically. Deleted earlier with the account. |
| Email address verification: six-digit code, kept only as an encrypted fingerprint, sending dates, number of attempts and “address verified” status | Check that the account’s address is yours before opening the public features (photos in Votes, duels, rankings), and limit sending and attempts. | Performance of a contract (Article 6(1)(b)) and legitimate interest in preventing abuse (Article 6(1)(f)). | Code: valid for 30 minutes, fingerprint deleted within 24 hours. Status: for the life of the account; it is reset if the account’s address changes. |
| Duels: the two players, the photo each chose among those posted to Votes, the invitation link, the votes received, the result, the status, the season and the Elo | Run the duel, have it judged by voters, show the result to both players and keep the duel ranking. | Performance of a contract (Article 6(1)(b)). | For the life of the account. User-deleted items are removed from active systems within 72 hours and backups within 30 days, unless a dispute or legal duty remains. |
| Public profile: username, country, age band and, from age 18, profile photo | Show this profile to anyone who knows your username, from age 16 and from your first scan. It shows no score, rank or percentile. | Performance of a contract (Article 6(1)(b)). | Until the account is deleted, or until you close it from Profile (open by default, reopenable at any time); the profile photo, until you remove it. Removal from active systems and internal caches within 72 hours. |
| Rankings: username, score given by voters or Elo and duel record, rank | Publish, to users aged 16 or older, the top half of each ranking, for people aged 16 or older who ticked the box for it; people aged 16–17 have their own ranking. | Consent (Article 6(1)(a)): the box is unticked at first and can be unticked at any time. | Until the box is unticked, the Votes agreement is withdrawn or the account is deleted; removal from active systems and internal caches within 72 hours. |
| Payment: plan, amount, fees, refunds and disputes (amount, reason, deadline), status, dates, transaction references and invoices | Collect payment, manage the subscription or pass, handle unpaid amounts and disputes, calculate what creators are owed and meet accounting duties. | Performance of a contract and legal obligation (Article 6(1)(b) and (c)). | Current data for the contract term. Invoices and accounting records: ten years. When the account is deleted, accounting amounts are kept without the account. Full card details are processed by Stripe Payments Europe, Limited (Ireland) and are not stored by LooksLadder. |
| Technical logs: IP address, dates, device, browser, security events and session identifiers | Secure the service, diagnose incidents, prevent abuse and establish or defend legal claims. | Legitimate interest in protecting the service and its users (Article 6(1)(f)). | Twelve months, except for targeted longer retention required for an incident or proceedings. |
| Support requests, rights requests and reports | Respond, moderate, notify decisions and demonstrate that requests were handled. | Legal obligation (Article 6(1)(c)) and legitimate interest in retaining evidence of a decision (Article 6(1)(f)). | Rights requests: five years after closure. Reports and decisions: five years after the decision, unless proceedings last longer. |
| App usage measurement: pages viewed and a few steps of the journey (questions completed, account created, photos submitted, checkout opened, payment succeeded), device and browser type; only with your consent, a visitor identifier kept on your device and a recording of your journey on screen, in which photos, images, video and everything you type are masked | Find the screens that block people and improve the service. No score, no face and no photo is part of this measurement. | Without your consent: legitimate interest in measuring the app's audience (Article 6(1)(f)), without reading or storing anything on your device. With your consent ("Allow" in the banner): consent (GDPR Article 6(1)(a) and Article 82 of the French Data Protection Act), which you can withdraw at any time from Profile. | Measurement data: one year at most. Journey recordings: 30 days at most. Identifier on the device: twelve months. Your banner answer: kept on your device until you change it. Details in the Cookie Policy. |
| Server-side visit measurement: the page requested (the address pattern, never an identifier it may contain) and, in the app, the name of the screen viewed; the site you came from (its name, never its full address); link markers (u, ref, utm_*); country as provided by our network provider; device type; the app the page opens in; browser language; a daily fingerprint computed from the IP address and browser with a key drawn at random each day and deleted the next day. The IP address is never stored, no cookie is set, and two days cannot be linked | Count visits and where they come from, learn which content brings visitors, and find the screens where people drop off. | Legitimate interest in measuring the audience of our own service, without tracking across sites or from one day to the next (Article 6(1)(f)). | Detail: thirteen months, then daily totals only, with no fingerprint. |
| Account origin: the same information at sign-up, the creator who brought you (through their link or the code you typed), the date of your first vote or scan, and a few signals used to detect accounts created in bulk (daily fingerprint, email domain) | Know where sign-ups come from and pay the creator who introduced you to LooksLadder, without paying for fake accounts: a sign-up only counts for them if the email address is verified, a vote or scan happens within 7 days, and the account still exists 30 days later. | Legitimate interest in measuring our acquisition channels and correctly performing our agreements with creators (Article 6(1)(f)). | For the life of the account; the technical fingerprint is deleted 30 days after sign-up. |
| Bonus points: 50 points added to an account brought by a creator | Grant the benefit announced at sign-up, once the email address is verified. | Performance of a contract (Article 6(1)(b)). | For the life of the account. |
| Partner creators and contacted creators: username, public social media accounts and their public figures (followers, views), audience country, contact details, confirmation of adult age and follow-up notes; for a partner, the agreement, earnings, payouts and their bank transfer references. This data comes from the creator's public profile or from our exchanges with them | Propose a collaboration, follow up without contacting someone who declined again, perform the agreement and pay what is owed. | Contacted creator: legitimate interest in proposing a professional collaboration based on a public profile (Article 6(1)(f)). Partner: performance of a contract and legal obligation for payouts (Article 6(1)(b) and (c)). | Contacted creator: three years after the last exchange, then automatic deletion, or earlier on simple request. Partner: for the duration of the partnership and while amounts remain owed; earnings and payouts: ten years (accounting records). |
Photos in Votes, the voting feed, duels and rankings show your photos or your username to other people: they only open with a verified email address. Until it is verified, nothing of yours is shown there, and your data is kept for the periods above.
The technical alerts the publisher receives in a messaging app (outage, payment, dispute, report) contain no data that identifies an account: no email address, no username, no account number; only figures, amounts and a link to the administration tool.
4. No biometric processing
LooksLadder creates no biometric template and never tries to recognise who you are from your face. The coordinates of the 468 points are used to calculate a score, then they are deleted.
Duels compare no measurement: voters decide them. No biometric consent is therefore requested, and there is none to withdraw. The Biometric data page gives the details.
If LooksLadder were ever to use processing that can identify a person from their face, that processing would fall under Article 9 of the GDPR. It would only be switched on after explicit consent, requested on a separate page, unchecked by default and as easy to withdraw as to give.
5. Automated calculations
The score and percentile are calculated automatically from geometric measurements and the reference population. A duel result, however, comes from voters: the calculation only counts their votes and moves the Elo of a ranked duel.
These calculations do not have a legal effect. If you believe data is incorrect or a restriction was imposed in error, request human review at [email protected].
6. Who receives the data?
Depending on the need, data is available to:
- authorised staff of Paco GOMEZ, limited to their duties;
- the hosting provider Contabo GmbH (Germany);
- the payment provider Stripe Payments Europe, Limited (Ireland);
- the following technical or support providers: Brevo (Sendinblue SAS) — transactional email delivery, France; Cloudflare, Inc. — DNS resolution, site protection and inbound email routing, United States and Ireland; PostHog Inc. — app usage measurement, data hosted in the European Union (Germany), company established in the United States;
- authorities or courts where the law requires disclosure;
- creators paid by LooksLadder, only as totals (visits, sign-ups and payments that came through their link, amounts owed to them): a creator never sees who signed up, nor any username, age or individual country;
- other users, within the limits described above: your photos in Votes, without your username; your username in a ranking, if you ticked the box; your username to the other player, at the end of a duel; and your public profile, from age 16, to anyone who knows your username.
Processors act on documented instructions and are bound by confidentiality, security and deletion obligations.
7. International transfers
Main hosting location: Germany. Some providers may process data outside the European Economic Area. The current list and country of each provider must be completed above before launch.
Where data is sent to a country without an adequacy decision, LooksLadder uses a mechanism recognised by the GDPR, such as the European Commission's Standard Contractual Clauses, and assesses any additional safeguards required. You may request a copy of the safeguards from the privacy contact.
8. Protecting children
LooksLadder does not accept anyone under 15. Seeing the rankings and appearing in them is blocked below age 16; after that, someone aged 16 or 17 only appears in the 16–17 ranking, and only if they ticked the box. The public profile is blocked below age 16, and the profile photo does not appear in it below age 18. The subscription is available from age 18. A duel never brings together someone under 18 and someone aged 18 or older, and starting one requires the subscription: no duel is therefore possible below age 18. In Votes, voting is open from age 15 and posting photos from age 16; photos of anyone under 18 are shown, once checked, only to voters under 18, and a photo not yet checked is never shown to a voter under 18.
In France, where processing for an online service offered directly to a child is based on consent, a user may consent independently from age 15. Below that age, that consent must be given or authorised by a holder of parental responsibility. A more protective local rule still applies.
A parent or guardian who believes a child under 15 opened an account may contact [email protected] to request verification and deletion.
9. Security
LooksLadder applies technical and organisational measures appropriate to the risk, including access controls, environment separation, logs of sensitive administrative access, secret protection, backups and deletion procedures.
No online service removes every risk. If a personal data breach is likely to create a risk to your rights, LooksLadder documents it, notifies the competent authority where required and informs you where the risk is high.
10. Delete your data or account
You do not need to contact support to delete your account:
- open Profile > Delete my scans and my account;
- read the summary and confirm deletion.
The profile becomes unavailable when you confirm. Account data, coordinates and results are removed from active systems within 72 hours. Backup copies disappear through rotation within 30 days and are not put back into production except for an essential security restoration.
Invoices, consent evidence, reports or material needed for a legal duty or dispute may be placed in restricted archives until their own retention period ends. They are no longer used to provide the service.
Without closing the account, you may also withdraw your photos from Votes and your agreement through My votes, untick the rankings box, close your public profile or remove your profile photo.
11. Your rights
Depending on the circumstances, you may:
- access your data and receive a copy;
- correct inaccurate data;
- request erasure or restriction;
- object to processing based on legitimate interest;
- receive data you provided in a portable format where the right applies;
- withdraw consent as easily as you gave it;
- set instructions about your data after death where French law applies;
- request human involvement and challenge an automated restriction.
Use Settings or email [email protected]. We normally respond within one month. If there is reasonable doubt about identity, we may request only the information needed to avoid disclosing data to the wrong person.
You may complain to the French data protection authority, CNIL, or the data protection authority where you live.
12. Cookies
A strictly necessary session cookie may be used without consent to sign you in and secure the account. Every audience-measurement tracker remains blocked until your prior consent. Without your consent, usage measurement reads and stores nothing on your device. See the Cookie Policy for choices and retention periods.
13. Changes to this policy
The version date appears at the top. A material change is announced in the app or by email before it takes effect where necessary. New processing based on consent is not enabled without a new valid choice.