Privacy Policy

Who we are

VisualEyes is operated by AQA, an early-stage venture. The operating company is being incorporated, with its intended seat in Ireland (EU); until incorporation completes, AQA's founding team is the data controller for the personal data described here. For anything in this policy, contact privacy@aqa.com.

What we collect

• Your email address — your account identifier and how we reach you about your login.
• The photos you enrol — encrypted at rest, never shown back to anyone as a list or gallery (not even to you), and used for exactly one purpose: to be recognised by you at login.
• Login and interaction records — which challenges were issued and how they were answered, with technical signals (IP address, approximate country, device and browser type) used to protect your account.
• Functional cookies only — a language preference and the session cookies a login needs. No advertising cookies, no third-party trackers, no analytics beacons: every resource on this site is served by us.

What we never do

We do not sell, rent, or trade your data. We do not use your photos or your email for marketing. We do not build advertising profiles. We do not run face recognition on you: VisualEyes works because you recognise your photos — we do not scan your face or body, and we do not create biometric templates. There is deliberately no bulk "export all users" path in our systems.

Why we process your data (legal bases)

Under the EU/UK GDPR our legal bases are: contract — providing the login service you signed up for; legitimate interests — keeping accounts secure, preventing fraud and abuse, and operating our infrastructure; and consent — your enrolment in the pilot itself, which you can withdraw at any time by asking us to delete your account.

How long we keep things

• Enrolled photos — during the pilot, each uploaded photo is automatically and permanently deleted no later than 90 days after upload; photos are also retired and replaced continuously as part of normal operation.
• Accounts — an account unused for 18 months is deleted in full, automatically, including its photos and history.
• Login records — kept only as long as needed for security and billing reconciliation, then deleted on schedule.

Who sees your data

VisualEyes runs on our own infrastructure — there are no third-party analytics, advertising, or cloud-AI processors involved in your login. A website you sign in to through VisualEyes learns only the outcome (pass or fail) and the identifier it needs to recognise you as its own user — never your photos. We disclose personal data to authorities only in response to valid legal process, as described on our Legal & Law Enforcement page. If data must cross borders, we apply GDPR-compliant safeguards such as the European Commission's Standard Contractual Clauses.

Your rights (EU/UK — GDPR)

You can ask us for a copy of your personal data, ask us to correct it, delete it, restrict or object to its processing, or hand it over in a portable form. Enrolment is consent-based, and you may withdraw at any time: email privacy@aqa.com from your account address and we will act on it — deletion requests are honoured in full, including photos. You also have the right to complain to your data-protection authority; in Ireland that is the Data Protection Commission (dataprotection.ie).

Your rights (United States — CCPA/CPRA and state laws)

If you are a US resident, this section is our notice at collection: the categories we collect are identifiers (email), visual data you choose to enrol (your photos), and internet activity related to your logins — used only for providing and securing the service, as described above. We do not sell or "share" personal information as those terms are defined in the CCPA/CPRA, and we do not use it for cross-context behavioural advertising or profiling. You have the rights to know, access, correct, and delete your personal information, and to not be discriminated against for exercising them. Exercise any of these by emailing privacy@aqa.com; we verify requests against the account email address.

Children

VisualEyes is not directed at children. You must be at least 16 to enrol in the pilot; we do not knowingly hold data on anyone younger, and we delete it if we learn we do.

How we protect it

Photos are encrypted at rest and served only inside your own login challenges. Each user's data is kept as a compartmentalised instance used only by that user's login and maintenance processes. Access is restricted, logged, and audited. If you find a security issue, please tell us: security@aqa.com (see also /.well-known/security.txt).

Changes to this policy

This is an interim policy for the live pilot. It will be reissued when incorporation completes, and we will announce any material change on this page and, for enrolled users, by email before it takes effect.