Privacy Policy

1. Who we are

The Multiverse AI is a service operated by The Omniverse LLC, which is the data controller for the personal data described in this policy.

The Omniverse LLC
1990 E Lohman Ave, Las Cruces, NM 88001, United States
support@themultiverse.ai

2. What we collect

Information you give us

• Account details — your name and email address.
• Photographs — the selfies you upload so we can create your headshots.
• Payment information — your card details are entered directly with our payment processor, Stripe, and never pass through or get stored on our systems. We keep a record of the transaction itself: amount, currency, date, and what you bought.
• Your consent record — when you agree to our upload terms, we record that you agreed, when, and to which version of the wording.
• Anything you send us — support requests, survey responses, and messages sent through the chat on our site.

Information we collect automatically

• Usage and device information — the pages you visit, your IP address and the approximate location it indicates, your browser and device type, the site you arrived from, and how you move through our pages.
• Identifiers set by cookies and similar technologies — see section 6.

Information we receive from others

• If you reach us through one of our affiliate partners, we receive a referral identifier from our affiliate network so that partner is credited.
• The advertising platforms we use report which of our campaigns led to visits and purchases.

3. Why we process your data, and our legal basis

Providing your email address and your photographs is necessary to use the service. Without them we cannot create your account or your headshots. Everything else is optional.

Where we rely on consent you can withdraw it at any time. Withdrawing consent does not affect anything we did before you withdrew it. If you withdraw consent for us to process your facial images, we can no longer create headshots for you, because that consent is what allows the core service to work.

Where we rely on legitimate interests you have the right to object, and you can ask us to explain how we weighed our interests against yours.

We do not make automated decisions about you that produce legal or similarly significant effects. Creating your headshots is automated, but it produces images at your request rather than decisions about you.

4. Your photographs, and what you agree to

This is the most sensitive information we handle, so we want to be direct about it.

Before you upload anything, we ask you to confirm two things, and we record your answer. You cannot upload photographs until you have.

What we commit to

• We do not use your photographs to train or improve any general-purpose AI model. We train a private model from your photographs, and it is used only to create your own images.
• The model trained from your photographs is private and never publicly accessible.
• We do not use facial recognition to identify you, match you against any database, or link you to other people.
• We do not sell, license or share your photographs or your trained model with anyone for their own purposes.
• You keep full rights to every image we create for you, for any use.
• We delete your photographs and your trained model on the schedule in section 10.

What you are responsible for

• Only upload photographs of yourself, or photographs of someone who has given you their explicit permission. You should keep your own record of that permission.
• Do not upload photographs of anyone who has not agreed — including friends, family, colleagues, public figures you do not represent, and anyone under 18.
• If you are buying for a team, each person agrees for themselves. You cannot accept our upload terms on behalf of your colleagues. Every team member completes the same step at their own upload.
• Do not use our service to impersonate anyone or to create images intended to mislead.
• Do not upload photographs you do not have the rights to, including photographs taken by a photographer who retains copyright, unless you have their permission.

If you believe a photograph of you has been uploaded by someone else, contact us at support@themultiverse.ai and we will remove it. We may remove content and suspend accounts where we believe these terms have been breached.

5. How your headshots are made, and how they are marked

Your headshots are created by artificial intelligence. We train a private model from the photographs you upload, and generate new images from it. They are built to look like you — your face, your features, your expression — but they are not photographs of a moment that happened.

Every image we produce carries machine-readable AI provenance metadata. Each file we deliver is marked, in an industry-standard format, as having been generated by AI. Specifically, we write the IPTC DigitalSourceType property with the value trainedAlgorithmicMedia, which is the standard vocabulary term for content produced by a generative AI model, together with our identity as creator.

This satisfies the marking requirement in Article 50(2) of the EU AI Act, which requires providers of AI systems generating synthetic image content to ensure their outputs are marked in a machine-readable format and detectable as artificially generated. The marking is invisible: it does not appear on the image, does not affect image quality, and does not alter a single pixel.

Please note that many websites and social platforms strip metadata from images when they are uploaded. That is outside our control, and it does not affect the images as we deliver them to you.

6. Cookies and similar technologies

We use cookies and similar storage for three purposes.

Strictly necessary cookies are always active.

If you are visiting from the United Kingdom, the European Economic Area or Switzerland, analytics and advertising technologies stay off until you allow them: a consent banner appears on your first visit, and nothing in those two categories is loaded in your browser unless you accept. You can accept all, reject all, or choose per category. We remember your choice for twelve months in a cookie named mv_consent, and we keep a record of the decision and when it was made.

Everywhere else, analytics and advertising technologies load by default. An explicit choice always overrides the default: if you switch a category off, we honour that wherever you are.

You can review or change your choices at any time using:

• the Cookie settings link in the footer of every page, which opens the cookie preferences dialog;
• your browser's own cookie controls, which let you block or delete cookies;
• your Facebook or Instagram ad preferences, for Meta;
• Google's Ads Settings and the Google Analytics Opt-out Browser Add-on, for Google;
• your LinkedIn advertising preferences, for LinkedIn.

Blocking cookies may affect how parts of our site work.

7. Advertising

We advertise on Meta (Facebook and Instagram), Google and LinkedIn. To know whether that advertising is working, we need to connect a visit or a purchase back to the advertisement that led to it.

On every page you visit, the Meta pixel, the LinkedIn Insight Tag and Google Analytics send those platforms your IP address, your browser and device information, the page address, the page you arrived from, and cookie identifiers that let them recognise your browser across visits. This happens whether or not you buy anything.

When you complete a purchase, we additionally send the value and currency of the order, an order reference, and the page you bought from.

A purchase confirmation sent from our servers. When you complete a purchase we also send a record of it to Meta directly from our servers, so that our measurement still works when a browser blocks the pixel. That record contains the order value and currency, an order reference, the page you bought from, and your email address in pseudonymised form.

Before your email address leaves our servers it is converted, using a one-way process called SHA-256 hashing, into a fixed string of characters that cannot be read or turned back into your address. Meta compares that string against the equivalent string generated from accounts in its own systems. Where they match, Meta can tell us that a purchase followed one of our advertisements, without either of us transmitting your email address in readable form.

This is pseudonymisation, not anonymisation, and we will not describe it as anonymous. The purpose of the hash is to allow a match, so the data remains personal data and we treat it that way: it is covered by this policy, by your rights in section 11, and by the safeguards in section 9.

We do not send the advertising platforms your name, your photographs, your generated images, your payment details, or the contents of your support messages.

8. Who we share your data with

We share personal data only with the organisations below, only for the purposes stated, and only as far as necessary.

We may also disclose data where the law requires it, or to establish or defend legal claims. If our business is ever sold or reorganised, personal data may transfer to the new owner, and we will tell you before that happens.

An earlier version of this policy said that data shared with third parties was “always fully anonymized prior to sharing.” That was not an accurate description of how advertising measurement works, and we have corrected it.

9. Where your data is processed

Your data is stored in the European Union and processed in the United States and the European Union.

Where we transfer personal data out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, along with additional safeguards where they are needed. Where an organisation we work with is separately certified under the EU–US Data Privacy Framework or its UK extension, we may also rely on that certification.

You can ask us for a copy of the safeguards that apply to a particular transfer by emailing support@themultiverse.ai.

10. How long we keep your data

If you ask us to delete your data, we will do so within one month of your request. Your photographs and generated images are normally removed within a few days. The model trained from them is removed in our next deletion cycle, which can take up to four weeks. We will confirm when it is done.

You can make that request at any time by emailing support@themultiverse.ai.

11. Your rights

You have the following rights over your personal data. All of them are free to exercise.

• Access — get a copy of the personal data we hold about you, and find out where we got it and how we use it.
• Rectification — correct anything inaccurate or incomplete.
• Erasure — have your personal data deleted.
• Restriction — ask us to pause processing while something is being resolved.
• Portability — receive the data you gave us in a machine-readable format, or have it sent to another provider.
• Object — object to processing we carry out on the basis of our legitimate interests. You can object to direct marketing at any time and we will stop.
• Withdraw consent — withdraw any consent you have given, at any time.
• Complain — raise a complaint with a data protection authority: in the country where you live, where you work, or where you think the problem happened. In the UK that is the Information Commissioner's Office at ico.org.uk. In the EEA, the authorities are listed at edpb.europa.eu.

We extend these rights to all of our customers, wherever you live, not only to those in the UK and Europe.

To exercise any of them, email support@themultiverse.ai. We will respond within one month, and will let you know if a request is complicated enough that we need longer. Because we hold photographs of your face, we may ask you to confirm your identity before acting on a request — this is to protect you from someone else obtaining your images.

If you are in California, you also have rights under the CCPA and CPRA, including the right to know what personal information we collect about you and to opt out of its sharing for cross-context behavioural advertising. The opt-out routes in section 6 apply.

12. Using your headshots in the EU

This section is guidance for our customers, and it reflects our own considered view. We are not lawyers and this is not legal advice. If you need certainty for your organisation, please confirm it with your own advisers.

Our position

Our headshots are a faithful representation of the actual person. They preserve your real facial geometry, your identity and your expression — you genuinely look like that. The medium is different, but the depiction is truthful.

That matters, because Article 50(4) of the EU AI Act applies to content “constituting a deep fake”, which the Act defines as content that resembles an existing person and would falsely appear to a person to be authentic or truthful. In our view a consented, accurate portrait of a real, identified person is not deceptive content of that kind. It is a truthful representation of the person, simply created through a different medium.

We take a transparent approach regardless: every image we produce carries machine-readable AI provenance metadata, as described in section 5.

If you are an individual using your headshot personally

Article 50(4) applies to “deployers” of AI systems, and expressly excludes activity that is purely personal and non-professional. If you are using your headshot for your own personal purposes — a social profile, a personal website, a messaging avatar — that obligation is not directed at you, and you do not need to label your photo.

If you are using it in a clearly professional or commercial context — as a company representative, in marketing materials, in published media — the guidance below is worth reading.

If you are a business publishing team headshots

The simplest way to be transparent with your audience, without labelling every individual image, is a single line on your About Us page or in your website footer:

“Some visual content on this site has been professionally enhanced using AI technology to ensure consistent quality.”

That gives your visitors a clear, honest signal about how the imagery was produced. Combined with the fact that the portraits are accurate likenesses of real people who consented to them, we consider this a reasonable and transparent approach.

Some customers prefer to be more explicit, which we also support:

“Our team portraits were created using AI from photographs of each person, with their consent. They are accurate likenesses, produced without a studio session.”

Whichever you choose, please make sure each person pictured has agreed to their photographs being used this way.

13. Security

We protect your data by:

• using TLS to encrypt all traffic between our servers and your device;
• limiting which of our staff can reach personal data, on a need-to-know basis;
• keeping the model trained from your photographs private and never publicly accessible;
• deleting your photographs and trained model on the schedule in section 10, so that we hold them no longer than we need to;
• using DKIM, SPF and DMARC to protect our email against spoofing and phishing.

No system is perfectly secure. If a breach affecting your personal data happens, we will notify you and the relevant authority as the law requires.

14. Children

The Multiverse AI is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

15. Changes to this policy

We will post any changes on this page and update the effective date at the top. Where a change materially affects how we use your data, we will tell you directly and, where the law requires it, ask for your consent again. Previous versions are available on request.

16. Contact

For any question, request or complaint about this policy:

support@themultiverse.ai

The Omniverse LLC
1990 E Lohman Ave, Las Cruces, NM 88001, United States