Privacy Policy
Who we are
NPC Me operates npcme.ca from Canada. For questions about this policy or your data, email [email protected].
What we collect
Your photo
The photo you upload is stored in a private bucket, used to generate your card, and deleted within 24 hours. Deletion runs two ways — a background job on our side and a storage lifecycle rule — so one failing does not break the promise.
Your photo is sent to our AI providers to produce your card. It is never used to train any model, by us or by them, and we do not keep face data, embeddings or biometric templates of any kind after the job finishes.
Your card
The finished card is kept so the link you share keeps working. It contains the illustration and the fictional profile, not your original photo. Ask us and we will delete it.
A device identifier
We store a random id in your browser to enforce one free card per day. Before it reaches our database it is hashed with a secret key, so what we hold cannot be reversed to identify your browser. It is not an advertising identifier and is not shared.
Your IP address
Used only to limit abuse from a single network. It is hashed the same way and we never store it in readable form.
If you buy a pack
Payment is handled by Stripe. We never see or store your card details. We keep the Stripe session id, the amount, the pack, and the email you gave Stripe for the receipt — enough to honour your purchase and handle a refund.
What we do not collect
- No account, name or password for free use
- No advertising or cross-site tracking cookies
- No location beyond the country Stripe needs for tax
- No contacts, photo library access, or anything you did not upload
- No biometric template or face recognition profile
Who we share it with
We use a small number of processors, each for one job:
- Replicate — runs the image models. Receives your photo.
- Anthropic — screens uploads for safety and writes the profile text. Receives your photo for the safety check only; the text generator never sees it.
- Cloudflare — stores and serves cards, and fronts the site.
- Stripe — payments.
We do not sell your data. We do not share it for advertising. We will only disclose data if the law requires it.
How long we keep things
| Your uploaded photo | 24 hours |
| Your finished card | Until you ask us to delete it |
| Hashed device and IP identifiers | 30 days |
| Purchase records | 7 years (Canadian tax law) |
Your rights
Under Canada's PIPEDA, and under the GDPR if you are in the UK or EU, you can ask us to show you what we hold, correct it, delete it, or send it to you in a portable form. You can also withdraw consent and complain to a regulator.
Email [email protected] and we will respond within 30 days. Because free use requires no account, we may need the link to your card to find anything.
Our lawful basis under the GDPR is your consent for processing your photo, and legitimate interests for abuse prevention and keeping the service working.
Children
This service is for adults. We do not knowingly collect anything from anyone under 18, and we screen uploads to reject photos that appear to show a minor. If you believe a child has used the service, email us and we will delete the data.
Where your data goes
Our processors operate in Canada, the United States and the European Union, so your data may be processed outside your country and be subject to the laws there. We only use providers that commit to appropriate safeguards.
Security
Traffic is encrypted in transit. Photos sit in a private bucket reachable only through short-lived signed links. Identifiers are hashed with a secret key. No system is perfectly secure, and the strongest protection here is simply that we delete your photo quickly and hold very little else.
Changes
We will update the date above when this changes. Material changes will be announced on the site.