Skip to content

Biometric Data Policy

Version 2026-10-29 · Last updated: October 30, 2026

1. What this policy covers

Personas is an optional dosya feature that groups the photos in a workspace by the people in them, so you can give a person a name once and then find their photos by searching for that name. To do that, Personas reads faces in photos and keeps a numeric description of each face. Some laws treat that description as biometric data. This policy explains what Personas collects, why, where it is kept, who can see it, how long it is kept, and how anyone can have it removed. It applies in addition to our Privacy Policy.

Personas is off in every workspace until the workspace owner turns it on and agrees to this policy. Nothing described here happens in a workspace where it is off.

2. What Personas collects

  • Face signatures. For each face found in a photo, Personas computes a face signature: a list of numbers derived from the face. A face signature is not a picture. It is used only to tell whether two faces in the same workspace belong to the same person.
  • Face positions. Where in the photo each face is, so the app can show a small crop of the face as a person's picture.
  • Groups and names. Which faces belong together (a "persona"), any name a workspace member gives a persona, the chosen cover picture, and corrections members make, such as merging two personas or marking a photo as "not this person".
  • The consent record. Who turned Personas on, when, that they confirmed they are not in a region where Personas is not offered, and which version of this policy they agreed to.

Personas does not read or keep anything else about a face. It never guesses or stores age, gender, ethnicity, mood, health or any other trait.

3. Why we collect it

The only purpose is the feature the workspace owner turned on: grouping photos of the same person within that one workspace, letting members name those groups, and letting members search the workspace's photos by those names. Face signatures are never compared across workspaces or with any other user, never used to identify a person outside the workspace, and never used for any other purpose.

4. What Personas never reads

  • Vault files. Files in an end-to-end encrypted Vault Space are never read. Personas cannot be turned on in a workspace that is entirely end-to-end encrypted.
  • Hidden or locked photos. Hidden files, and password-locked files and folders, are never read. If a photo is hidden or locked after it was read, its face data is deleted.
  • Skipped folders. Photos in folders the workspace chooses to skip are never read.
  • Videos. Personas reads still photos only.

5. Where it is processed and kept

Photos are read, and face data is kept, on dosya's servers in the workspace's own storage region. The region is named in the app, on the screen where Personas is turned on and in the workspace's Personas settings. Face data does not leave that region. Our infrastructure providers are listed as sub-processors in Section 5 of our Privacy Policy.

6. Who can see it

  • Personas and their names are shown only to members of the workspace who can already see the photos. A member who can see only one folder does not see Personas.
  • Face signatures themselves are never shown to anyone, are never returned by our API, and are never written to logs or error reports.
  • dosya staff do not browse face data. Like the rest of your workspace, it is accessed only where needed to run the service or where the law requires it.

We never sell or share face data with anyone, never use it for advertising, and never use it to train machine-learning models, ours or anyone else's.

7. How long it is kept

  • Personas turned off: every persona, name and face record in the workspace is deleted immediately. The photos themselves are not touched.
  • Workspace deleted: all face data of the workspace is deleted immediately, along with its consent records.
  • Plan or add-on no longer includes Personas: face data is kept for 30 days, so it is not lost if the plan is renewed, and is then deleted. The workspace owner is emailed before that happens.
  • Workspace owner inactive for 12 months: face data is deleted after the owner has been emailed and given 30 days' notice.
  • A photo is moved to the trash or deleted: its faces are deleted at once. If the photo is restored from the trash, it is read again.
  • A persona is hidden: its face records are deleted. New photos of the same person may form a new group.

Backups. Our database keeps point-in-time recovery data for up to 30 days to protect against failures. Deleted face data can remain in that recovery data for up to 30 days, after which it is gone. We never restore deleted face data from it.

8. Consent and how to withdraw it

Only the workspace owner can turn Personas on. Before it starts, the owner is shown what Personas will do and never do, where the data is kept, and a note that the people in the photos have not agreed to this processing, and must confirm that they agree to this policy and are not located in a region where Personas is not offered. The owner should turn Personas on only if they are allowed to process the photos of the people in them.

Consent can be withdrawn at any time by turning Personas off in the workspace's settings (Settings → Personas → Turn off Personas). Turning it off deletes all face data of the workspace immediately, as described above.

9. People who appear in photos

You do not need a dosya account to ask us about your face. If you believe your face is in photos in a dosya workspace that uses Personas, you can ask us to remove your face data by writing to privacy@dosya.dev. Please include enough information for us to find the workspace, such as the workspace owner's email address or a shared link. We may need to confirm that the request comes from you. Members of a workspace can also remove a person themselves at any time by hiding that persona.

10. Where Personas is not offered

At launch, Personas cannot be turned on from Illinois, Texas or Washington in the United States, and owners located there are asked not to turn it on.

11. Security

Face data is protected by the same measures as the rest of your workspace, described in Section 4.2 of our Privacy Policy, including encryption in transit and at rest and strict access controls.

12. Changes to this policy

If we change this policy in a way that matters to how face data is handled, we will publish a new version on this page and ask every workspace owner who uses Personas to agree to it again before the change applies to their workspace.

13. Contact

Questions about this policy or about face data: privacy@dosya.dev. DOSYA PTY LTD (ABN 27 700 842 235), 4/54 Cintra Road, Bowen Hills, Brisbane, Queensland, Australia 4006.