Biometric Information Retention & Destruction Policy

This Biometric Information Retention & Destruction Policy (the "Policy") describes how Melochora LLC ("Company," "we," "us," or "our") retains and destroys biometric information and biometric identifiers that may be collected or derived in connection with the Faxie platform and our website, mobile applications, and related services (collectively, the "Services").

This Policy is intended to satisfy applicable biometric privacy laws, including the Illinois Biometric Information Privacy Act ("BIPA"), and similar laws in other jurisdictions, to the extent they apply.

This Policy should be read together with our Privacy Policy and Terms of Service. In the event of a conflict between this Policy and the Privacy Policy regarding the handling of biometric data, this Policy governs.

1. Scope

This Policy applies to biometric information, biometric identifiers, and biometric data derived from voice recordings that we collect or process to provide the Services, including our voice-cloning functionality — the feature that lets a Faxie video speak in your own voice.

It does not apply to your selfie image. As described in our Terms of Service and Privacy Policy, we process your selfie solely to render your appearance in the videos you generate; we do not create a persistent faceprint or other facial biometric template, and we never use your face to identify, verify, match, or surveil you or anyone else.

2. What We Collect / What Counts as "Biometric"

To provide the voice-cloning feature, we may collect or create:

• A voice recording you provide during onboarding (a short sample of you reading a fixed on-screen script aloud); and
• Biometric identifiers or biometric information derived from that voice recording, such as a voiceprint or similar voice model/embedding used to generate a synthetic ("cloned") version of your voice ("Cloned Voice Data").

When you create a Faxie video, your Cloned Voice is used to generate spoken audio — words you type but did not personally record — in your own voice.

We do not use biometric data for identity verification, authentication, surveillance, or law enforcement purposes. We never use your voiceprint or Cloned Voice Data to identify, verify, match, or recognize you or anyone else.

3. Purpose of Collection and Use

We collect and use biometric data solely to:

• Create, operate, and maintain your Cloned Voice so that the videos you generate can speak in your own voice; and
• Provide and improve the functionality, safety, and reliability of the Services (for example, debugging, security, and performance improvements).

4. Consent

We collect and process biometric data only after obtaining explicit, affirmative consent. Consent is captured through an in-product confirmation (a required checkbox) when you record your voice sample during onboarding. We maintain logs evidencing consent, including timestamp and consent version.

5. Retention Schedule

We retain biometric data only for as long as reasonably necessary to fulfill the purposes described above, unless a longer period is required or permitted by law.

5.1 Active Account

We retain your voice recording and Cloned Voice Data while your account remains active and the voice-cloning feature is enabled/available. Re-recording your voice sample replaces the prior recording.

5.2 Account Deletion / Termination

When you delete your account, we delete biometric data from our active systems and schedule it for deletion from backup systems. Deleting your account is how you withdraw consent to voice cloning.

5.3 Backups and Residual Copies

Residual copies may persist in encrypted backups, disaster recovery systems, or logs for up to thirty (30) days after deletion/termination, after which they are automatically overwritten or deleted in the ordinary course.

6. Destruction (How We Delete)

Upon account deletion/termination (subject to the exceptions below), we destroy biometric data by deleting it from our active production systems and ensuring it is removed from backups pursuant to the backup retention schedule described above. Destruction may include deletion of:

• Stored voice recordings associated with voice cloning;
• Stored Cloned Voice Data (e.g., voiceprints/embeddings/models used for synthesis); and
• Related identifiers used to access or operate your Cloned Voice.

7. Limited Exceptions (Legal, Security, and Disputes)

We may retain certain records for longer than the periods described above only to the extent necessary for:

• Compliance with law or valid legal process;
• Fraud prevention, security investigations, and abuse prevention; or
• Establishing, exercising, or defending legal claims (including litigation holds).

When an exception applies, we will limit access and retention to what is reasonably necessary for the applicable purpose.

8. Service Providers ("Vendors") and Flowdown Requirements

We use third-party service providers to perform voice cloning and support related Services. When you generate a video, your voice recording and/or Cloned Voice Data are processed by those providers on our behalf so they can create your Cloned Voice and synthesize speech in it. When biometric data is processed by service providers on our behalf, we require contractual protections appropriate to the sensitivity of the data, which may include:

• Restrictions that the provider may process biometric data only to provide services to us and not for unrelated purposes;
• Confidentiality and security obligations;
• Appropriate retention limits and deletion obligations; and
• Access controls and incident notification obligations.

However, some third-party providers may, under their own terms, retain or use data processed through their services to improve their own systems or models. We disclose this in our Privacy Policy, and we encourage you to review those providers' own terms and privacy policies. Where possible, we seek to minimize this risk through vendor selection, configuration, and contractual terms.

9. Updates to This Policy

We may update this Policy from time to time. If we make material changes, we will update the effective date and provide notice as required by law.