Data protection and security

What happens to a photo

1. You add a photo. Your browser looks for faces on your device and redraws the photo, which removes hidden information such as its GPS location and camera details. If your browser can't find faces itself, the photo is sent to a face-finding model run by Replicate instead.
2. It uploads to private storage. The photo uploads as soon as you add it, so it's ready when you press anonymise. Storage is private: nobody can reach a file without a link we create for your account, and those links expire within minutes.
3. It's checked. Before anything is anonymised, OpenAI's moderation service checks the photo for explicit or graphic content. Photos that fail are refused, and you aren't charged.
4. The faces you chose are replaced. Only the area around each face you chose is sent to Google's Gemini image model, run by Replicate, which draws a new face. We put only those faces back into your photo, so the rest of it is untouched.
5. You download it. Nothing is published or shared. You decide where the finished photo goes.
6. Everything is deleted. Each file we stored is deleted 48 hours after it was stored, or 7 days if you chose that in History. The clean-up runs every hour, so a file can last up to an hour longer.

Who handles the data

These are the only companies that handle personal data for us. We'll update this list before adding a provider that handles your photos.

For providers in the USA we rely on the UK–US data bridge where they're certified under it, or on the UK International Data Transfer Addendum to the EU standard contractual clauses. Our AI and moderation providers may keep what they receive for a limited period for security and abuse monitoring under their own terms (OpenAI: up to 30 days).

What we keep, and for how long

• Photos: 48 hours after each file is stored, or 7 days. This covers originals, anonymised photos and everything in between.
• A record of each job: the date, file name, how many faces were found and changed, the face positions as box coordinates, and the result. There are no images in it. It's kept while your account is open, so you can show what was done.
• Who confirmed the right to upload: when someone at your organisation agrees to our upload checklist, we record the wording, the time, their IP address and browser.
• Purchases: 6 years, as UK tax law requires.
• When an account is deleted, its photos go at the next hourly clean-up and its job records go with it.

How the photos are protected

• Photos are sent over HTTPS and stored in private storage that's encrypted at rest.
• The storage can't be read directly from the website. Every file is reached through a link we create for the account that owns it, and the link expires within minutes.
• Every request checks that the photo belongs to the account asking for it.
• Everyone who works on Safeguard Vision is bound by confidentiality, and we'll tell you without undue delay if we become aware of a breach affecting your photos.

For your DPIA

Anonymising photos before you publish them reduces risk: the published photo no longer shows a real child's face. A DPIA for Safeguard Vision usually covers:

• Roles: your organisation is the controller for the photos and we're the processor (terms, section 6).
• Lawful basis: yours to choose. Our GDPR for schools guide explains the state and independent school differences.
• Data minimisation: location data is removed before upload, and only the area around each chosen face goes to the image model.
• Retention: 48 hours or 7 days, set by you.
• Transfers: the USA, for content checks and anonymising, under the UK–US data bridge or the IDTA.
• Your rights requests: we'll help you answer requests from the people in your photos.

Our privacy policy has the full detail. For a signed data processing agreement or anything else your DPIA needs, email hello@safeguard-vision.com.