This Biometric Consent Form (the "Consent") describes how 1001454451 Ontario Inc., carrying on business as "PersonaOn" ("PersonaOn," "we," "us") collects, stores, uses, discloses, and retains biometric identifiers and biometric information when you build, configure, or operate an AI Persona on our platform as a Creator. This Consent is incorporated by reference into our Creator Terms of Use and is provided to you separately for your acknowledgment and consent. Capitalized terms not defined here have the meanings given in the Creator Terms.
Please read this Consent carefully. By providing audio recordings, photographs, or video of yourself for the purpose of creating a Persona, you are providing express consent to the collection and use of your biometric identifiers and biometric information as described below. Express consent is required because biometric data is treated as sensitive personal information under Canadian and applicable U.S. privacy law. If you do not consent, do not upload such Content, and do not proceed with Persona creation.
What This Consent Covers
When you build a Persona that resembles you — for example, a Persona that speaks with a synthetic voice modeled on your real voice, or that appears as an animated avatar modeled on your face — PersonaOn and certain of our service providers process audio, photo, and video Content you provide ("Creator Content") to derive data that is treated as biometric identifiers or biometric information under applicable law.
Definitions and Applicable Laws
Canadian law
Under the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and Quebec's Act respecting the protection of personal information in the private sector (commonly known as "Law 25"), biometric data — including voiceprints and facial geometry — is treated as sensitive personal information. Express consent is required for its collection, use, and disclosure. Quebec Law 25 imposes additional obligations, including (a) the requirement that an organization conduct a Privacy Impact Assessment before deploying technology that processes biometric data for verification or identification, and (b) prior notice to the Commission d'accès à l'information du Québec at least 60 days before the deployment of any system using biometric characteristics for verification or identification (Article 45 of the Act respecting the protection of personal information in the private sector).
Alberta's Personal Information Protection Act and British Columbia's Personal Information Protection Act similarly treat biometric data as sensitive and require meaningful consent.
U.S. state biometric privacy laws
The Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. ("BIPA"), the Texas Capture or Use of Biometric Identifier Act ("CUBI"), the Washington biometric privacy statute (RCW 19.375), the Washington My Health My Data Act, and similar laws in other U.S. states regulate the collection, storage, use, disclosure, and retention of biometric identifiers and biometric information.
Definitions
"Biometric identifier" generally means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include items such as photographs themselves, or physical descriptions like height, weight, hair colour, or eye colour.
"Biometric information" generally means any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier and used to identify the individual.
The terms above may carry different meanings in different jurisdictions. Where a stricter definition applies in your province or state, the stricter definition controls.
What Biometric Identifiers and Biometric Information We Collect
In connection with your creation and operation of a Persona, PersonaOn (directly and through subprocessors identified below) may derive the following from Creator Content you provide:
-
Voiceprints and voice models. From audio recordings of your voice, we (and our third-party voice synthesis provider) may extract voice features and train a synthetic voice model that captures the acoustic characteristics of your voice. The features and model may, in combination, be used to identify you as the speaker and therefore may constitute a "voiceprint" or biometric information under applicable law.
-
Facial geometry and avatar models. From photographs and videos of you, we (and our third-party avatar rendering provider) may extract a scan of facial geometry and other facial measurements used to render an avatar that resembles you. These derivations may constitute biometric identifiers or biometric information under applicable law.
-
Other physiological measures. Where we render a Persona that includes additional embodied features (for example, gait, posture, or expression mapping), we may derive additional measures intended to capture your likeness in a way that may qualify as biometric information.
We do not collect retina or iris scans or fingerprints, except as may incidentally appear in Creator Content (in which case we do not extract or use them as biometric identifiers).
Why We Collect This Information (Purpose)
We collect and use the biometric identifiers and biometric information described above for the following purposes only:
- To generate, render, and operate your Persona on the Services in a manner that resembles you to the extent you have configured;
- To enable the Persona to interact with End Users using your synthesized voice and avatar;
- To improve the technical quality and accuracy of your Persona's voice and likeness, including by retraining or refining the Persona-specific voice or avatar model when you provide additional Creator Content;
- To support, debug, secure, and audit the Services;
- To comply with applicable law (including responding to lawful requests from public authorities); and
- For any other purpose to which you subsequently consent in writing.
We do not use biometric identifiers or biometric information derived from your Creator Content to operate any other Creator's Persona, to populate a general-purpose voice or face library available to other Creators, or to train general-purpose AI models that imitate you outside of your Persona, unless you provide separate, express written consent.
Disclosure to Subprocessors
We may disclose biometric identifiers and biometric information to subprocessors that process information on our behalf to operate the Services, including:
- Cloud and infrastructure providers for hosting and storage. Storage may occur in Canada, the United States, or other jurisdictions;
- Voice synthesis providers for the generation of synthetic speech using a voice model based on your voice;
- Avatar rendering providers for the generation and rendering of an avatar based on your facial geometry;
- Speech recognition providers for transcription of audio (note: speech recognition is used for transcription only and does not generate voiceprints intended to identify the speaker);
- Real-time communication and meeting capture providers where Personas are deployed in such contexts; and
- Where applicable, identity-verification, security, fraud-prevention, and audit providers.
These subprocessors are contractually restricted to processing biometric identifiers and biometric information solely on our behalf for the purposes described above, and to maintaining reasonable safeguards.
Cross-Border Transfers
Many of our subprocessors are located in the United States or other jurisdictions outside Canada. By providing this Consent, you understand that your biometric identifiers and biometric information may be transferred to, stored, and processed in the United States and other countries, and that the laws of those countries may provide different protections than the laws of Canada. We use contractual and technical safeguards intended to protect your information consistent with PIPEDA and Quebec Law 25, including conducting Privacy Impact Assessments where required.
We do not sell or lease biometric identifiers or biometric information, and we do not disclose them for any third party's independent commercial purposes. We may disclose them as required by law, in response to lawful requests from public authorities, in connection with the protection of legal rights or safety, or in connection with a corporate transaction (such as a merger or acquisition) subject to appropriate confidentiality protections.
Storage and Safeguards
We store biometric identifiers and biometric information using a reasonable standard of care that is at least as protective as the manner in which we protect other confidential and sensitive information of similar nature, and in any event no less than the reasonable standard of care within our industry. Storage is encrypted in transit and at rest where technically feasible, and access is restricted to authorized personnel and subprocessors with a need to know.
Retention and Destruction
We retain biometric identifiers and biometric information only for as long as needed to provide the Services to you. Specifically:
- All Creators (default rule). Biometric identifiers and biometric information will be permanently deleted when the initial purpose for collecting or obtaining them has been satisfied (for example, when your Persona is deleted, when your account is closed, or when you withdraw your consent).
- Illinois residents (BIPA). Biometric identifiers and biometric information will, in any event, be permanently and irretrievably deleted no later than three (3) years following your last interaction with PersonaOn, regardless of whether the initial purpose has been satisfied earlier.
- Texas residents (CUBI). Biometric identifiers will, in any event, be permanently destroyed within a reasonable time and no later than the first anniversary of the date the purpose for which the biometric identifier was collected expires, unless retention beyond that period is required or permitted by other applicable law.
- Washington residents. Biometric identifiers will be retained no longer than is reasonably necessary for the original enrollment purpose, after which they will be permanently destroyed.
- Quebec residents (Law 25). Biometric identifiers and biometric information will be destroyed when the purpose for which they were collected has been achieved, in accordance with our retention schedule and as required by Article 23 of the Act respecting the protection of personal information in the private sector.
- Canadian residents generally. Biometric identifiers and biometric information will be destroyed in accordance with our retention schedule and PIPEDA Principle 4.5.3, no longer than necessary for the identified purposes.
We may retain backups, archives, and audit logs containing biometric identifiers or biometric information for additional limited periods consistent with our reasonable backup and audit policies, after which such data will be deleted in the ordinary course.
If a different retention period is required by applicable law (for example, in connection with active litigation, an investigation, or a regulatory hold), we will retain the data only for so long as such requirement applies and will destroy it promptly thereafter.
Your Rights
You may withdraw this Consent and request deletion of your biometric identifiers and biometric information at any time by emailing admin@personaon.com or using the deletion controls provided in the PersonaOn Studio. Withdrawal will result in deletion of the affected data and may render your Persona non-functional, in whole or in part.
You also retain all rights of access, correction, deletion, portability, opt-out, and appeal that apply to your Personal Information under our Privacy Policy and applicable law, including under PIPEDA, Quebec Law 25, Alberta PIPA, BC PIPA, and applicable U.S. state laws.
Acknowledgment and Consent
By accepting this Consent (whether by clicking "I agree," "I consent," or a similar affirmation, or by uploading audio, photo, or video Content of yourself for the purpose of creating a Persona):
- You acknowledge that you have read and understood this Consent.
- You provide your express consent to PersonaOn's collection, capture, storage, use, disclosure, retention, and destruction of your biometric identifiers and biometric information as described in this Consent and in our Privacy Policy.
- You consent to cross-border transfers of your biometric data to the United States and other jurisdictions as described above.
- You represent and warrant that any biometric identifiers or biometric information processed are derived from Content depicting you (or, where you have authority to provide such Content for another individual, that you have obtained that individual's separate, prior, written consent that meets the requirements of all applicable biometric privacy laws, including BIPA, PIPEDA, and Quebec Law 25).
- You acknowledge that this Consent is provided to you in writing, that you are accepting it voluntarily, and that you may withdraw it at any time.
If you have any questions about this Consent, please contact our Privacy Officer at admin@personaon.com before accepting.
See also: Terms of Use · Creator Terms · Privacy Policy