Biometric Data Retention and Destruction Schedule
Effective date: August 8, 2026
Last reviewed: August 8, 2026
1. Scope
This schedule applies to face data that Memrico, Inc. ("Memrico," "we") creates from photos and videos uploaded to the Memrico service, and explains when that data is destroyed and how.
It does not apply to the photos and videos themselves, to names or labels you assign, or to any other personal information. Those are governed by our Privacy Notice.
2. What "face data" means
When face-recognition features are enabled, we analyze uploaded photos and videos to detect faces and derive face geometry — a numerical representation of the measurable features of a face, sometimes called a face template or face vector. We refer to this collectively as face data.
Face data may be considered biometric data under the laws of some jurisdictions. We treat it as biometric data everywhere, regardless of where you live.
Face data is derived from images. It is not the image itself: deleting face data does not delete your photos, and deleting a photo does not by itself delete every face template derived from other photos of the same person.
3. Why we keep it
Face data exists to provide features to you and the members of your spaces: grouping photos of the same person together under People, letting you find photos by person, and resurfacing memories.
We do not sell face data. We do not use it for advertising. We do not use it to train our own or any third party's artificial-intelligence models. Face recognition runs once, at upload — we do not re-scan your library.
4. When we destroy face data
We destroy face data on the earliest of the following triggers:
| # | Trigger | What is destroyed |
|---|---|---|
| 1 | You ask us to delete a person's face data | All face data for that person in your library |
| 2 | You turn off face recognition | All face data derived from content you uploaded |
| 3 | Your account is deleted | All face data derived from content you uploaded |
| 4 | A person whose face appears in your photos asks us to delete their face data, and we verify the request | All face data for that person |
| 5 | Feature inactivity — face-recognition features have not been used for 18 months | All face data in your library |
| 6 | Account inactivity — you have not used Memrico for 24 months | All face data in your library |
| 7 | Purpose satisfied — we no longer need the face data for the purpose in Section 3, as determined by the annual review in Section 5 | The affected face data |
Trigger 7 also protects people who are not Memrico users. A relative, guest, or child who appears in a member's photos never interacts with Memrico directly, so their face data is governed by purpose-satisfaction and the annual review in Section 5, in addition to the deletion rights in trigger 4.
5. Annual review
At least once every twelve months we review the face data we hold and determine whether storing it remains necessary, adequate, and relevant to the purpose described in Section 3.
Where the review determines that storage is no longer justified, we destroy the affected face data within 45 days of that determination. Where the volume or complexity of the deletion reasonably requires more time, we may extend that period by up to 45 additional days, and no further.
6. How quickly we destroy it
| Where the data lives | Destroyed within |
|---|---|
| Live systems — face templates in the recognition index, person records, cluster associations | 30 days |
| Search and cache layers | 30 days |
| Backups and disaster-recovery copies | 90 days, and in no event more than 180 days |
If a backup is ever restored — after a disaster, data-loss event, or software error — any face data that was previously destroyed is destroyed again as part of restoring service, and does not silently return.
7. How we destroy it
Destruction means the face template and its associations are deleted from the systems that store them, including deletion of the face vectors from the face-recognition service we use, so that the data cannot be used to recognize a person again. It is not merely hidden, disabled, or flagged.
Where a service provider processes face data on our behalf, we instruct that provider to delete it on the same schedule.
Deleting face data is the only removal action Memrico offers. There is no separate "hide" or "remove from view" action that keeps the underlying face data. When you remove someone, their face data is destroyed on the schedule above. Because the data is genuinely gone, a person you have deleted may be detected again as a new, unrecognized face if they appear in a photo you upload later — we tell you this at the point of deletion.
8. What we do not destroy on these triggers
- Your photos and videos. Deleting face data does not delete images. Photos are retained per our Privacy Notice and deleted when you delete them or close your account.
- Names and labels you created, unless deleting them is part of your request.
- Records of the request itself. We keep a minimal record that a deletion request was made and honored — who asked, when, and what was destroyed — because we need to be able to demonstrate compliance. These records contain no face data.
- Records of the annual review described in Section 5, for the same reason.
9. Legal hold
We may retain face data past these deadlines only where retention is required by law, regulation, court order, or a legal-preservation obligation such as pending litigation. Where that happens, retention is limited to what the obligation requires, and the data is destroyed within 30 days after the obligation ends.
10. Security of face data
We store, transmit, and protect face data from disclosure using the standard of care within our industry, and we maintain a protocol for responding to a security incident affecting face data, including notifying affected people as required by law.
11. Service providers
Face data is processed on our behalf by service providers under written contracts that limit their use of it to providing the service to us, currently including Amazon Web Services. Those contracts require deletion on our instruction, and we have directed our providers not to use content processed for Memrico to develop or improve their own services.
12. Changes
If we change this schedule we will post the updated version here with a new effective date. Material changes are communicated as described in our Privacy Notice.
13. Contact
Questions about this schedule, or requests to delete face data — including from people who do not have a Memrico account but believe they appear in photos uploaded by a member — go to privacy@memrico.com.