Jump to a section
AvatarFeed privacy policy
Effective date: October 12, 2026
1. Who we are and what this notice covers
SaaS Experts, Inc. ("Company," "we," "us," or "our"), based in North Carolina, operates AvatarFeed at https://avatarfeed.com. Contact us at [email protected] or 136 Arthurs Road, Troutman, North Carolina, United States.
This notice covers visitors, account holders, contributors, people depicted or identified in contributions, and people who contact us or submit reports. AvatarFeed provides a community directory of images for software agents. Public browsing does not require an account. Account functions and intentional image or ZIP downloads require a verified account and express acceptance of the current service terms. Viewing previews remains public. Other SaaS Experts products have their own notices. Accepting AvatarFeed terms or allowing its analytics does not authorize optional processing for another product.
Where applicable European or UK data protection law applies, Company is the controller for the processing described here.
This policy describes processing; using the website or accepting service terms is not blanket consent to it. Optional analytics choices are separate. Applicable legal rights take priority over inconsistent service terms.
2. Information, sources and purposes
We obtain information directly from you, from sign-in and infrastructure providers, through your use of AvatarFeed, and from other people who submit images or reports.
| Information | Sources | Uses |
|---|---|---|
| Email, account identifier, verification and account status, display name and profile image | You and your selected sign-in provider | Account creation, sign-in, support and public profile choices |
| Password authentication records when you choose password sign-in; provider identifiers and tokens when applicable; passkey public keys, credential identifiers and device-related registration records | You, your identity provider and your passkey device | Authentication, session management and account security |
| IP address, browser/user-agent, session and delivery-context identifiers, device and request information, logs and rate-limit records | Browser, server and infrastructure | Deliver pages and images, prevent abuse, diagnose failures and protect accounts |
| Directory images, titles, descriptions, roles, illustration types, visual-presentation labels, moderation results and generated descriptions | You, other contributors, automated review and administrators | Process, review, publish, classify, distribute and remove contributions |
| Votes, favorites, download activity, role suggestions and account preferences | Your activity | Requested features, aggregate directory counts and abuse prevention |
| Agreement version, content hash, acceptance time and related audit evidence | Acceptance actions and server records | Document agreement, enforce terms and resolve disputes |
| Report text, identity or contact information, supporting evidence, copyright notices, counter-notices and support messages | Reporters, contributors, rights holders and correspondents | Investigate complaints, respond, handle legal procedures and defend claims |
| Intimate-image removal requests, signatures, authority and contact information, affected URLs and restricted safety evidence | Depicted people, their authorized representatives, reports and service records | Locate and remove affected material, address known identical copies, meet safety obligations and preserve legally required evidence |
| Consented pageviews, product-action events, campaign/referrer information, browser identifiers, device data and approximate location derived from IP where the provider supplies it | Browser and analytics providers | Measure service use and campaign attribution after analytics permission |
Passwords and provider tokens are not public. Passkey authentication normally supplies a verification result and credential data; it does not require AvatarFeed to receive your device's fingerprint or facial template.
Images may contain faces or other personal information even after metadata is removed. Do not submit sensitive personal information, confidential records, or identifiable children's images. Visual labels are descriptions of appearance, not verified facts about a person's identity.
Some account information is required for authentication and requested functions. Without an email or other required account information, we cannot provide those account functions. Public profile fields and analytics permission are optional. We do not collect payment card information for the current free service. Any paid offering requires updated disclosures before collection.
3. Public information and people depicted in images
Published directory images, titles, descriptions, roles and labels, aggregate activity counts, and an enabled public contributor profile are visible to other people and may be indexed by search engines or downloaded. A public profile may link your chosen name and profile image to your contributions. Account email addresses, private favorites, acceptance evidence and private report records are not intentionally published.
Public availability does not mean information loses all legal protection. You can ask us to remove your contribution or personal information. We can restrict future distribution by AvatarFeed, but cannot directly erase independent third-party copies or guarantee removal from search-engine caches. Where law requires further reasonable steps or recipient notification, we take those steps.
If someone else submits information about you, we may receive it without contacting you first. Contact [email protected] with the relevant URL to request access, correction or removal. We assess applicable notice obligations, lawful grounds and any legal exception for information obtained indirectly. We do not treat a contributor's assurance of consent as a substitute for our own legal obligations.
4. Automated processing and review
Directory and profile uploads undergo malware scanning, decoding, re-encoding and metadata removal. Directory submissions may also undergo automated content classification and human review. Directory automated review may reject or flag a contribution, assign visual labels and generate descriptions. Errors are possible. Request human reconsideration at [email protected] with the affected submission or URL.
5. Recipients and disclosures
We disclose information to the extent needed for the purposes above:
- Infrastructure, hosting, database, storage, email and security providers receive the information needed to operate the service. DigitalOcean hosts the application and database infrastructure. Microsoft Azure stores processed directory images; SendGrid delivers account messages.
- OpenAI receives a processed image derivative and relevant submitted metadata for directory moderation and classification. Metadata can include role, title, illustration type and visual-presentation labels. Sending a derivative does not anonymize a depicted person. The application requests that response objects not be stored; that request alone does not eliminate service or abuse-monitoring retention.
- The configured malware scanner processes raw files. Production uses ClamAV within our hosting infrastructure.
- Google receives sign-in requests when you choose Google sign-in and provides the authorized account information. Google's independent account processing is described in its policy.
- Gravatar, an Automattic service, can receive a hash derived from your email address and browser network information when a fallback profile image is requested. A hash can still be personal information.
- Plausible, Google Analytics and PostHog receive the consented analytics information described in section 6 when enabled.
- Other users and the public receive information you publish as described in section 3.
- Professional advisers, authorities, opposing parties in legal notice procedures and other recipients may receive information reasonably needed to comply with law, investigate a complaint, protect rights or resolve disputes. Copyright notices and counter-notices can be forwarded with their required identifying information. We assess requests and disclose only what the applicable purpose or law requires.
- When required or permitted by child-safety law, we may disclose relevant account, request, upload and restricted evidence information to the National Center for Missing & Exploited Children or competent authorities. A safety request is not automatically treated as a copyright notice or forwarded in full to the uploader. We limit disclosure according to the applicable process and do not promise absolute confidentiality where law requires disclosure.
- A prospective or actual buyer or successor may receive relevant information in a business transaction, subject to lawful confidentiality, use restrictions and required notices. A transaction does not automatically authorize incompatible uses.
Providers acting as processors or service providers must be subject to the contracts and restrictions required by applicable law. Some services act independently for parts of their processing. Their own policies do not excuse our responsibility for our disclosures.
6. Cookies, local storage and analytics choices
Necessary technologies support sessions, authentication, confirmation, delivery context, security and requested features. Browser storage can also retain your display and cookie preferences. Blocking necessary technologies may prevent affected functions from working.
Optional analytics requires your affirmative choice through the cookie notice. You can decline and continue browsing, or change the choice using Cookie preferences. Global Privacy Control and the browser Do Not Track value supported by our implementation keep optional analytics off. Withdrawing permission stops future optional collection; it does not automatically erase earlier lawfully collected data.
When allowed, analytics can record public-directory pageviews and actions such as saving, voting, submitting an upload or role suggestion, requesting an export and starting a download. Saved avatars, upload and suggestion screens may generate these events even though they are used by signed-in people. Events are designed to exclude submitted form contents, emails, uploaded image bytes, delivery grants, URL query strings and fragments. Campaign attribution can include filtered campaign labels, landing page and referring host. Providers still receive network and device information; this data is not necessarily anonymous.
The attribution cookie is configured for 30 days and can renew when initialized on a later permitted visit. The analytics preference is stored in browser local storage until removed or replaced.
The current analytics configuration is intended to disable advertising personalization, session replay and automatic form capture. We do not intentionally use behavioral advertising.
7. Legal grounds where European or UK law applies
| Processing | Intended legal ground, subject to applicable law |
|---|---|
| Account administration and functions you request | Contract necessity for your account agreement |
| Public visitor delivery, security, fraud prevention, complaint investigation and legal defense | Legitimate interests in operating and protecting the service and resolving disputes, balanced against your rights |
| Optional analytics and nonessential browser storage | Consent, which you may withdraw |
| Disclosures or records required by a specific law | Compliance with the applicable legal obligation |
| Publishing identifiable contributions and public profiles | Consent where required for the person concerned; legitimate interests in operating the directory where lawful and balanced against that person's rights. An uploader's contract is not a contract with a depicted third party. |
We assess lawful grounds before using information for a materially different purpose. We do not rely on broad acceptance of this policy as consent. If special-category information is processed, an additional valid condition and safeguards are required.
8. Retention and deletion
We retain information for the period needed for its specific purpose, required legal records or a documented legal hold. The following criteria distinguish public availability from physical deletion:
| Records | Retention rule or criterion |
|---|---|
| Accounts, credentials, sessions and preferences | While needed to provide the account; after closure, remove or de-identify information no longer needed, except justified legal/security records. |
| Published contributions and public profiles | While published or enabled; after removal, disable delivery and delete operational copies through the applicable cleanup process. Existing lawful downloader copies may persist. |
| Normal raw staging files | Queued for cleanup after completed or terminal processing; cleanup can retry after outages. |
| Suspected malware or incomplete-scan quarantine | Separate restricted storage pending security investigation and operator cleanup; this storage has no automatic expiration, so deletion requires operator action. |
| Temporary ZIP exports | Delivery expires five minutes after readiness; files are queued for deletion. Expiry is not a guarantee of immediate physical erasure. |
| Image cache | The application renews a seven-day expiration on retrieval. Removed entries are queued for cleanup. |
| Recoverable Azure objects and database/server backups | Recovery copies may remain after operational deletion until the applicable provider retention or backup rotation ends. Access is restricted. Contact us for retention information concerning your request. |
| Reports, support, moderation, agreement and security evidence | Only as reasonably needed for the matter, abuse prevention, legal obligations and relevant limitation periods, with restricted access. |
| Statutorily preserved child-safety evidence | Keep the material and context required for the applicable legal preservation period, with restricted access and separate security controls. |
| Analytics | Attribution storage as described above; provider event and aggregate records remain according to the configured retention and any applicable deletion request. Contact us for information about the provider records relevant to your request. |
Deleting an account does not automatically recall images downloaded by others or require erasure of evidence that law permits or requires us to retain. We assess statutory deletion requests independently of surviving copyright licenses. Backups and retained evidence are restricted and must not be used to republish removed personal information without a lawful basis.
Requests to remove nonconsensual intimate images follow the safety process in section 8 of the Terms at https://avatarfeed.com/legal. That process is available to non-users and authorized representatives and has its own applicable removal deadline. Ordinary privacy-request response periods do not extend a safety-removal deadline. Provide a URL or location rather than attaching the image to a request.
9. Security and incidents
We use measures designed to protect information, including access restrictions and secure network transport. Report contact addresses are encrypted in the application database where collected in that field. This does not mean that every report field, support email, credential, backup or provider record has the same protection.
No system can guarantee complete security. If an incident triggers a legal notification duty, we notify affected people and authorities using the required content and within the applicable deadlines. Service disclaimers do not remove those duties.
10. Requests and privacy rights
Email [email protected] or write to our address above. You may request account closure or removal without accepting new service terms. Include enough information to locate the account or content; do not email a password, full identification document or unnecessary sensitive information. We may ask for proportionate verification, subject to rules for the type of request. Authorized agents may submit requests with evidence of authority where required. An account is not required merely to ask about personal information.
Depending on applicable law, rights may include access, information about sources and recipients, correction, deletion, portability, restriction, objection, withdrawal of consent, and opting out of sale, targeted advertising or certain profiling. We do not discriminate for exercising protected rights. Some requests have lawful exceptions; we explain a denial and available review or appeal rights.
Where EU GDPR applies, we respond without undue delay and normally within one month. If a lawful extension is necessary, we explain it within the initial period. You may complain to the competent supervisory authority. UK requests follow the applicable UK rules and may be raised with the Information Commissioner's Office.
Where the CCPA applies, California residents have the applicable rights to know/access, delete, correct, opt out of sale or sharing, limit certain sensitive-information uses, and non-discrimination. We ordinarily acknowledge applicable know/delete/correct requests within 10 business days and respond within 45 calendar days, with a permitted extension and notice if needed. Opt-outs follow their separate legal deadlines and do not require identity verification intended for access requests.
Residents of other states or countries may have additional rights, including an appeal. Email [email protected] with "Privacy appeal" to ask us to reconsider a denial. We respond within the deadline applicable to your jurisdiction and explain further complaint options when required.
11. California categories and sensitive information
The following table describes the categories collected and disclosed for business purposes by the service described in this notice. Sources, purposes, recipients and retention criteria are detailed above.
| Category | Examples | Business-purpose recipient categories |
|---|---|---|
| Identifiers and applicable California customer-record information | Email, account ID, display name, IP address and report contact details | Authentication, hosting, delivery, support and security providers; public recipients for chosen public fields |
| Internet/network activity and approximate geolocation | Requests, browser data, interactions and approximate IP-based location where collected | Infrastructure/security providers; analytics providers after permission |
| Visual information | Directory and profile images | Storage/delivery providers, moderation provider for directory derivatives, and public recipients for published content |
| Inferences or classifications where linked to a person | Moderation results and visual-presentation labels | Moderation and infrastructure providers; public recipients for published labels |
| Sensitive personal information where legally classified as such | Login information in combination with credentials; sensitive details incidentally supplied in images or reports | Necessary authentication/security providers; narrowly necessary recipients for the relevant request or legal process |
We use login credentials to provide and secure accounts. We do not request sensitive personal information for advertising or profiling. Applicable opt-out preference signals are honored as legally required; our optional analytics is also disabled by the privacy signals described in section 6.
12. International processing
Information may be processed in the United States and other countries where our hosting, moderation, authentication, email and analytics providers operate. Those countries may have different privacy laws.
European or UK law may require safeguards for transfers outside the applicable region, such as an adequacy decision or valid contractual safeguards. This notice does not claim a particular certification or contractual mechanism.
Contact [email protected] for information about relevant safeguards and how to obtain a copy, subject to lawful redaction. Agreement to these Terms or publication of an image is not blanket consent to international transfers.
13. Children and third-party services
Accounts and contributions are for adults aged 18 or older. AvatarFeed is intended for an adult general audience, not children. Public pages may nevertheless be viewed by minors and generate necessary technical requests. An age restriction alone does not establish that we never receive a minor's information.
Do not submit an identifiable child's image or personal information. If we learn that an ineligible minor has an account or that children's information was improperly collected or published, we investigate, restrict the affected functionality or material, and delete information unless lawful retention is required. Contact [email protected] with the relevant URL or account information. Where children's privacy laws apply, we follow their required procedures.
Links and independently chosen third-party services have their own policies. This notice covers Company's processing and disclosures to providers; it does not disclaim our legal responsibility for them.
14. Policy updates and contact
We update this notice when verified practices or legal requirements change, show the effective date and retain prior versions, which you may request from us. Material changes receive the notice required by law. If new consent is required, we obtain it before that processing begins. Continued use alone does not supply consent or waive existing rights. A policy revision does not retroactively authorize incompatible use of previously collected information.
Contact [email protected] or our postal address in section 1 for questions, requests or complaints. Contact us for information about any representative or data-protection contact applicable to your request.
15. Browser storage details
The analytics preference is stored as avatarfeed_analytics_v1 in local storage until removed or changed. Consented campaign attribution uses avatarfeed_attribution with a renewable 30-day lifetime. The af-context cookie supports controlled image delivery. Authentication cookies support sessions that expire after 30 days; temporary confirmation and security cookies may expire sooner. Google Analytics, when allowed, may set _ga and measurement-specific ga cookies to distinguish visits according to its configured expiry. PostHog is configured to use memory rather than persistent browser identifiers. Plausible is configured for consented measurement. Your browser controls let you inspect and remove stored entries; removal may end your session or reset preferences.