PRIVACY NOTICE

Last updated: 13 October 2026

This Privacy Notice for Lizzie Kardon Consulting LLC, doing business as Naura ("we," "us," or "our"), describes how and why we access, collect, store, use, and share ("process") your personal information when you use our services ("Services"), including when you:

Visit our website at https://nauraphotoapp.com or any website of ours that links to this Privacy Notice
Create an account and use the Naura web application to take or upload photographs and generate images
Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you have any questions or concerns, contact us at privacy@nauraphotoapp.com.

SUMMARY OF KEY POINTS

What personal information do we process? We process the information you give us when you create an account and use the Services, including your email address, date of birth, the photographs of yourself that you take in the app or upload, the face model we generate from them, the images we generate for you, and your payment details, which are handled by Stripe. Learn more

Do we process any sensitive personal information? Yes. Naura processes biometric data. When you upload photographs, we generate and store a face model derived from them. Biometric data is treated as sensitive or special category personal information in many jurisdictions, and we process it only with your explicit, separately given consent. We do not process other categories of sensitive information such as racial or ethnic origin, sexual orientation, religious beliefs, or health data. Learn more

Do we collect any information from third parties? No. We do not collect information about you from third parties or data brokers.

How do we process your information? To build your face model, generate your images, take payment, keep the Services safe, communicate with you, and comply with the law. We do not use your photographs or your face model to train any AI model of our own. Section 4 explains how our providers treat your data. Learn more

In what situations and with which parties do we share personal information? We share it with the named service providers that operate the product for us, each processing it to deliver the Services under its contract or published terms with us, and, if our business is ever sold or merged, with the acquiring company. We do not sell your personal information. Learn more

How long do we keep your photographs and face model? Until you delete them, or three (3) years after your last interaction with Naura, whichever comes first. You can delete them at any time from your Profile. Learn more

What are your rights? Depending on where you live, you may have rights to access, correct, delete, and obtain a copy of your personal information, and to withdraw your consent. Learn more

How do you exercise your rights? Email privacy@nauraphotoapp.com, or delete your face model and account directly from your Profile.

WHAT INFORMATION DO WE COLLECT?
HOW DO WE PROCESS YOUR INFORMATION?
WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
BIOMETRIC DATA
DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?
INTERNATIONAL TRANSFERS OF YOUR INFORMATION
HOW LONG DO WE KEEP YOUR INFORMATION?
HOW DO WE KEEP YOUR INFORMATION SAFE?
DO WE COLLECT INFORMATION FROM MINORS?
WHAT ARE YOUR PRIVACY RIGHTS?
CONTROLS FOR DO-NOT-TRACK AND OPT-OUT PREFERENCE SIGNALS
DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
DO WE MAKE UPDATES TO THIS NOTICE?
HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In short: we collect the personal information you provide to us, including photographs of yourself and a face model generated from them.

We collect personal information that you voluntarily provide when you register for the Services, use them, or contact us. The personal information we collect includes:

email address
name or display name
password
date of birth
photographs of yourself that you take in the app or upload
a face model generated from those photographs (biometric information)
appearance attributes derived from your photographs, such as hair, build, and styling descriptors, used to improve image accuracy
images generated for you through the Services
mobile phone number, if you choose to receive notifications by text
billing address and payment card details, handled and stored by Stripe

Sensitive information. We process biometric information, described in the "BIOMETRIC DATA" section below, on the basis of your explicit consent. We do not process other categories of sensitive information.

Payment data. If you make a purchase, payment is processed by Stripe. Stripe collects and stores your payment instrument number and security code. We do not receive or store your full card number. Stripe's privacy notice is at https://stripe.com/privacy.

Account sign-in. You create an account with an email address and password, or with a third-party sign-in provider where we offer one. Where you use a third-party sign-in provider, we receive your name, email address, and profile image from that provider in order to create and authenticate your account. We do not receive your contacts or friends list, and we do not post anything on your behalf.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes.

Information automatically collected

In short: some information, such as your IP address and browser characteristics, is collected automatically when you use the Services.

We automatically collect certain information when you visit, use, or navigate the Services. This includes your IP address, browser and device characteristics, operating system, language preferences, referring URLs, country, and information about how and when you use the Services. This information is primarily needed to maintain the security and operation of the Services and for our internal analytics and reporting.

Approximate location. We use your IP address to determine your country and US state so we can check whether the Services are available where you are. We do not store your precise location.

Log and usage data. Service-related, diagnostic, usage, and performance information our servers automatically record in log files, including date and time stamps, pages and features used, actions taken, and error reports.

Consent records. When you accept our Legal Terms and give biometric consent before you take or upload any photograph, we record the date and time, the version of the documents you accepted, and the IP address from which you accepted them. We keep these records to demonstrate that valid consent was given.

2. HOW DO WE PROCESS YOUR INFORMATION?

In short: we process your information to deliver the product you bought, to take payment, to keep the Services safe, to communicate with you, and to comply with the law.

To provide the Services you purchased. We process your photographs and face model to build your personal face model and generate images at your request.
To facilitate account creation and authentication and otherwise manage user accounts.
To process payments. We use Stripe to take payment and manage subscriptions.
To keep the Services safe. We screen photographs automatically to detect public figures, photographs with no person or more than one person, and content that violates our Legal Terms.
To communicate with you about the Services. Delivery notifications, account status, and support responses.
To send marketing communications, where you have not opted out.
To improve the Services. We analyse aggregate, de-identified usage patterns. We do not use your photographs or face model to train any AI model of our own.
To comply with our legal obligations, and to establish, exercise, or defend legal claims.
To save or protect an individual's vital interests, such as to prevent harm.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In short: we only process your personal information when we have a valid legal reason to do so.

If you are located in the EU or UK, this section applies to you. The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on to process your personal information. We rely on the following:

Explicit consent for biometric data. We process your photographs and face model, which are special category data under Article 9 of the GDPR, only on the basis of your explicit consent given under Article 9(2)(a) before collection. You can withdraw that consent at any time by deleting your face model in the app or emailing privacy@nauraphotoapp.com. Withdrawal does not affect processing carried out before withdrawal.

Performance of a contract. We process your account, payment, and usage information to deliver the Services you have purchased and to fulfil our obligations to you.

Consent. We process your information for marketing communications and optional features where you have given permission. You can withdraw your consent at any time.

Legitimate interests. We process limited technical and usage data to secure the Services, prevent fraud and abuse, and understand how the Services are used, where doing so is not overridden by your rights and interests.

Legal obligations. We process your information where necessary for compliance with our legal obligations, including to cooperate with a law enforcement body or regulatory agency, or to exercise or defend our legal rights.

Vital interests. We process your information where necessary to protect your vital interests or those of a third party.

If you are located in Canada, this section applies to you. We process your information where you have given express consent, or in situations where your consent can be inferred. In limited exceptional cases we may be legally permitted to process your information without consent, for example where collection is clearly in your interests and consent cannot be obtained in a timely way, for fraud detection and prevention, or where disclosure is required to comply with a subpoena, warrant, or court order.

In short: we share your information with the service providers that run the product for us, and with an acquiring company if our business is sold. We do not sell your personal information.

Service providers. We share personal information with the following service providers, to deliver the Services. Each processes it under its contract or published terms with us:

Provider	What they do	What they receive
Base44	Application platform, database and file storage, and the model integrations we use for safety checks	Account data, photographs, generated images
Higgsfield	Face model training, storage of your face model, and image generation	Photographs, face model, generation prompts, generated images
OpenAI (directly and through Base44)	Safety screening of photographs and your instant preview image	Photographs, generated preview images
Anthropic (through Base44)	Writing shoot prompts from inspiration images you choose	Inspiration images you upload, never your photographs of yourself or your face model
Cloudinary	Adding a watermark to preview images in our emails	Generated images, by link
Stripe	Payments and subscriptions	Name, email, billing address, payment details
Resend	Email delivery	Name, email address, links to generated images in some emails
Netlify	Marketing website hosting	Technical and usage data only
Google	Waitlist form	Email address
Kit	Marketing email, if you opt in	Name, email address
ipinfo.io	Determining your approximate location to check service availability	IP address

How our providers treat your photographs. OpenAI does not use data sent through its API to train its models, and keeps it for up to 30 days for abuse monitoring. Higgsfield's standard terms of service permit it to use content processed through its service to train and improve its models, except for customers on an enterprise agreement. We have asked Higgsfield to put Naura on enterprise terms that exclude your data from training, and we will update this notice when that is in place. Until then, Higgsfield processes your photographs and face model on its standard terms, and we tell you this before you give biometric consent.

We keep this list current. If we add a provider that will process your photographs or face model, we will update this notice.

Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Legal requirements. We may disclose personal information where required by law, legal process, or a governmental request, or where we believe disclosure is necessary to protect our rights or the safety of any person.

We do not sell or share your personal information for cross-context behavioural advertising or targeted advertising, and we have not done so in the preceding twelve (12) months.

5. BIOMETRIC DATA

In short: your photographs and face model are biometric data. We collect them only with your written, standalone consent, we use them only to make your images, we never sell them, and we destroy them on the schedule below.

What we collect. When you take photographs in the app or upload them to Naura, we generate a face model from them. Under Illinois, Texas, Washington, Colorado, and similar laws, the photographs and the face model are a biometric identifier and biometric information.

Why. Solely to build your personal face model and to generate images at your request. We do not use your biometric data for identification, verification, surveillance, or advertising, and we do not use it to train any AI model of our own (see section 4 for our providers).

We never sell it. We do not sell, lease, trade, or otherwise profit from your biometric identifiers or biometric information.

Consent. We collect biometric data only after you have been informed in writing of the collection, its specific purpose, and the length of time it will be stored, and only after you have signed a written release. That release is presented as a separate, standalone consent step before you take or upload any photograph, distinct from your acceptance of our Legal Terms. We record the date, time, version, and IP address of that consent.

Retention and destruction schedule. We permanently destroy your photographs and face model at the earliest of: (a) the date you delete your face model or your account; (b) the date the purpose for collection has been satisfied, meaning you have stopped using the Services and requested deletion; or (c) three (3) years after your last interaction with Naura. When you delete your face model, we immediately remove your face model, your photographs and everything derived from them from your account and stop all processing of them. We then instruct Higgsfield to permanently delete your face model and source photographs and confirm when that is done, which we aim to complete within 30 days. Our storage provider does not yet offer automatic erasure of stored files. Files we remove from your account are no longer linked to it or used for any purpose, and we are working with that provider to erase them permanently.

Your control. You can permanently delete your face model and its source photographs at any time from your Profile. You can also delete your whole account from your Profile. You can also email privacy@nauraphotoapp.com to request deletion, a copy of your data, or withdrawal of your consent.

Security incidents. If a security incident may have compromised biometric data, we will contain it, investigate, notify affected individuals and regulators as required by law, including Colorado's data breach notification law, and record what happened and what we changed.

Annual review. At least once a year we review the biometric data we hold and delete any that has met the deletion criteria above.

6. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In short: yes. Image generation is the product.

Our Services are powered by artificial intelligence, machine learning, and similar technologies (collectively, "AI Products"). Our AI Products are designed for one function: generating images of you from photographs you upload.

How we process your data using AI. Your photographs and face model are processed by the AI providers named in section 4 to deliver the Services to you. Section 4 explains how each treats your data, including Higgsfield's standard terms on model training.

AI-generated content. Images produced by the Services are artificially generated. They are not photographs of real events, and they may not accurately depict your appearance. We may embed metadata or other provenance markers identifying an image as artificially generated. Where you are required by law to disclose that an image is AI-generated, that obligation is yours.

Automated decision-making. We use automated screening to detect prohibited uploads. If an upload is refused and you believe that is an error, email support@nauraphotoapp.com and a person will review it.

7. INTERNATIONAL TRANSFERS OF YOUR INFORMATION

In short: we are based in the United States and your information is processed there.

We are based in the United States and our service providers process personal information in the United States and other countries. If you are located in the European Economic Area, the United Kingdom, or Switzerland, your personal information is transferred outside your country.

We are putting Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum in place with each service provider that processes your information. You may ask about the safeguards that apply to your data by emailing privacy@nauraphotoapp.com.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In short: we keep your information only as long as necessary, and your biometric data is subject to a separate, stricter schedule.

We keep your personal information for as long as necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law, such as for tax or accounting purposes. Account information is kept for the life of your account.

Biometric data is subject to the separate retention and destruction schedule set out in the "BIOMETRIC DATA" section above, which applies regardless of whether your account remains open.

When we have no ongoing legitimate business need to process your personal information, we will delete or anonymise it, or, where that is not immediately possible because the information is held in backup archives, we will securely store it and isolate it from further processing until deletion is possible.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In short: we use appropriate technical and organizational security measures, but no system is perfectly secure.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the personal information we process, including encryption in transit, access controls, and contractual security obligations on our service providers. However, no electronic transmission over the internet and no information storage technology can be guaranteed to be one hundred percent secure, so we cannot promise or guarantee that unauthorized third parties will not defeat our security and improperly collect, access, steal, or modify your information. You should only access the Services within a secure environment.

If a breach affecting your personal information occurs, we will notify you and the relevant regulators where required by law and within the timeframes the law sets.

10. DO WE COLLECT INFORMATION FROM MINORS?

In short: no. The Services are for adults only.

We do not knowingly collect, solicit data from, or market to anyone under 18 years of age, and we do not sell such personal information. By using the Services, you represent that you are at least 18 years of age. We do not permit use of the Services by minors under any circumstances, including with parental or guardian consent.

If we learn that personal information from a user under 18 has been collected, we will deactivate the account and permanently delete the photographs, face model, and generated images from our records and from our service providers' systems. If you become aware of any data we may have collected from a person under 18, please contact us at privacy@nauraphotoapp.com.

Where the Services are available. The Services are currently not offered to residents of the European Economic Area, the United Kingdom, Switzerland, or the US states of Illinois and Washington. We may restrict access based on your location.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In short: depending on where you live, you may review, change, or terminate your account at any time, and you have rights over the information we hold about you.

In some regions, including the European Economic Area, the United Kingdom, Switzerland, and Canada, you have rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure, (iii) to restrict the processing of your personal information, (iv) where applicable, to data portability, and (v) not to be subject to automated decision-making. In certain circumstances you may also have the right to object to processing. You can make a request by emailing privacy@nauraphotoapp.com.

We will consider and act upon any request in accordance with applicable data protection laws.

Withdrawing your consent. Where we rely on your consent, you have the right to withdraw it at any time. You can withdraw your biometric consent by deleting your face model from your Profile, or by emailing privacy@nauraphotoapp.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, nor processing conducted in reliance on a lawful basis other than consent.

Opting out of marketing. You can unsubscribe from our marketing communications at any time by clicking the unsubscribe link in any marketing email, by emailing privacy@nauraphotoapp.com. We may still send you service-related messages necessary for the administration of your account.

Account information. If you want to review or change the information in your account, or terminate your account, you can do so from your account settings or by contacting us. On termination we will deactivate or delete your account and information from our active databases, subject to the retention rules above. We may retain limited information to prevent fraud, resolve disputes, enforce our Legal Terms, or comply with legal requirements.

Complaints. If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you have the right to complain to your Member State data protection authority or to the UK Information Commissioner's Office. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

We will acknowledge a complaint made directly to us within 30 days of receiving it, investigate without unjustifiable delay, keep you informed of progress, and explain the outcome.

Information Commissioner's Office: ico.org.uk/make-a-complaint, helpline 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

12. CONTROLS FOR DO-NOT-TRACK AND OPT-OUT PREFERENCE SIGNALS

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized, and we do not currently respond to DNT browser signals.

We do not sell or share personal information for targeted advertising, so there is no sale or sharing to opt out of. Where an opt-out preference signal such as Global Privacy Control is received from a California resident, we treat it as a valid request to opt out of sale and sharing, which our practices already satisfy.

13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In short: yes. If you are a resident of a state with a comprehensive privacy law, you have rights to access, correct, delete, and obtain a copy of your personal information, and to limit the use of your sensitive personal information.

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing. These rights may be limited in some circumstances by applicable law.

Categories of personal information we collect

The table below shows the categories of personal information we have collected in the past twelve (12) months.

Category	Examples	Collected
A. Identifiers	Real name, alias, postal address, telephone or mobile number, unique personal identifier, online identifier, IP address, email address, account name	YES
B. Personal information as defined in the California Customer Records statute	Name, contact information, financial information	YES
C. Protected classification characteristics under state or federal law	Age, date of birth	YES
D. Commercial information	Transaction information, purchase history, payment information	YES
E. Biometric information	Face model and facial geometry derived from uploaded photographs	YES
F. Internet or other similar network activity	Interactions with our website and application, usage and log data	YES
G. Geolocation data	Device location	NO
H. Audio, electronic, sensory, or similar information	Images created in connection with our business activities, including uploaded photographs and generated images	YES
I. Professional or employment-related information	Business contact details, job title, work history	NO
J. Education information	Student records and directory information	NO
K. Inferences drawn from collected personal information	Appearance and styling attributes derived from your photographs, and preferences drawn from your use of the Services	YES
L. Sensitive personal information	Biometric information processed for the purpose of uniquely identifying an individual's likeness in generated images	YES

We will use and retain the collected personal information as follows:

Categories A through D, F, and K: for as long as you have an account with us, and thereafter only as required by law.
Categories E, H, and L (photographs, face model, and generated images): under the retention and destruction schedule in the "BIOMETRIC DATA" section above.

Sensitive personal information. We use your sensitive personal information only to perform the Services you requested. We do not use or disclose it for the purpose of inferring characteristics about you, and we do not sell or share it.

Sources of personal information. Directly from you, and automatically from your device when you use the Services. We do not collect personal information about you from third parties or data brokers.

Will your information be shared with anyone else? We disclose personal information to the service providers named in section 4 under written contracts. We may use your personal information for our own business purposes, such as internal research for technological development. This is not considered a "sale" of your personal information.

We have not sold or shared personal information in the preceding twelve (12) months, and we will not sell or share it in the future.

Your rights

Right to know whether or not we are processing your personal data
Right to access your personal data
Right to correct inaccuracies in your personal data
Right to request the deletion of your personal data
Right to obtain a copy of the personal data you previously shared with us
Right to non-discrimination for exercising your rights
Right to opt out of the processing of your personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects
Right to limit the use and disclosure of sensitive personal data, as permitted by applicable law including California's privacy law
Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature, as permitted by applicable law including Florida's privacy law

Depending on the state where you live, you may also have the right to obtain a list of the categories of third parties or specific third parties to which we have disclosed personal data, and the right to review, understand, question, and correct how personal data has been profiled.

How to exercise your rights. Email privacy@nauraphotoapp.com, or use the delete controls in your Profile. You can also refer to the contact details at the bottom of this notice.

Under certain US state data protection laws you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof of valid authorization.

Request verification. On receiving your request we will verify your identity to confirm you are the person about whom we hold the information. We will only use personal information provided in your request to verify your identity or authority.

Appeals. If we decline to act on your request, you may appeal by emailing privacy@nauraphotoapp.com. We will inform you in writing of any action taken or not taken in response to the appeal, with reasons. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" law. California Civil Code Section 1798.83 permits our users who are California residents to request, once a year and free of charge, information about categories of personal information we disclosed to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. If you are a California resident and would like to make such a request, contact us using the details below.

14. DO WE MAKE UPDATES TO THIS NOTICE?

In short: yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top. If we make material changes, we will notify you either by prominently posting a notice of the changes or by sending you a notification directly. Where a change materially affects how we process your biometric data, we will ask for your consent again before that change applies to you.

15. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, email us at privacy@nauraphotoapp.com or contact us by post at:

Lizzie Kardon Consulting LLC 8116 Flourtown Avenue Wyndmoor, PA 19038 United States

16. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You have the right to request access to the personal information we collect from you, details about how we have processed it, correction of inaccuracies, or deletion of your personal information. You may also have the right to withdraw your consent.

The fastest route is your Profile: you can delete your face model and its source photographs at any time, and you can delete your account. For anything else, email privacy@nauraphotoapp.com and we will respond within the timeframe required by the law that applies to you.