Privacy notice

This notice describes the data paths used by the open beta.

The workflow processes account identity, signed license revisions, source media, prompts, provider outputs, decisions, and release certificates. Account linking uses a verified immutable identity rather than email matching.

Inside a ChatGPT conversation, Licensed Studio asks for no identity document, selfie, voice recording or code; you sign in on Reflections’ own page. It works from images a talent approved under a license that talent signed, and from images a brand offers after confirming it holds the rights to them.

Before a talent issues a license or makes a twin or a voice, Stripe Identity checks a government ID and a live selfie that must match it. Stripe holds the legal name, the document and the selfie; Reflections stores only the check’s status and times. After the check, Reflections fetches the selfie through a short-lived link and has a vision model, through OpenRouter, compare it with the talent’s license-ready Vault images. It records whether each image shows the same person and keeps no copy of the selfie. When an account is erased, Reflections asks Stripe to erase the check’s images and data.

To make a twin, a talent records a video. HeyGen makes and stores the twin and reads the talent’s face and voice from the recording. Deleting a twin deletes every HeyGen copy Reflections can address; HeyGen keeps a record of its consent check, which cannot be deleted, and keeps face data after deletion for up to 60 days in the EEA, UK and Switzerland, up to 3 years in Illinois and up to 1 year in Texas, and otherwise until no longer needed. HeyGen’s terms give it a license to what Reflections uploads, including to train its models. Reflections keeps a still frame and the sample privately until the twin is deleted. The full disclosure is shown before a twin is made.

To make a voice, a talent records or uploads voice samples. ElevenLabs makes and stores the voice, and the talent can delete it at any time. Spoken conversations with a talent’s Reflection run on ElevenLabs.

Supabase supports web authentication. External clients such as ChatGPT are authorized by Reflections’ own authorization server (Ory Hydra at auth.reflections.ai), which signs you in with the same account. Image and evaluation requests use FAL and OpenRouter; Knowledge uses Zep. Source media, prompts, or documents may be sent to the provider needed for the requested operation.

Licensing storage is private. Temporary download URLs carry access and must not be shared or logged.

Exact abandoned-draft prompts are deleted 30 days after the terminal event; only the prompt digest and non-content metadata remain after that. Exact safety-refusal prompts are deleted after 90 days on the same basis. Released, licensed-refused, held, and withheld prompts remain as licensing evidence and are not deleted on this schedule.

Disconnecting revokes a client connection and its refresh grants. It does not delete issued licenses, approvals, certificates, or unresolved provider records. A deletion request requires a separate reviewed process that identifies what can be erased and what must be retained.

Contact support to request account or data deletion. Signed licenses, releases, certificates, unresolved provider records, and legal holds may require separate handling from removable drafts or source bytes.