Brie — Biometric Data Policy

Effective: September 29, 2026 Last updated: September 29, 2026

This policy explains how Brie Labs Inc. ("Brie", "we", "us") collects, uses, stores, and destroys biometric identifiers and biometric information. It is published under the Illinois Biometric Information Privacy Act, 740 ILCS 14 ("BIPA"), and applies to everyone who uses Brie, wherever they live.

It is a companion to our Privacy Policy and our Terms of Use.

---

1. Why Brie uses face mapping

Brie exists so that the person you connect with is really the person in the photos. To do that, every member verifies with a selfie, and we check that the selfie matches their profile photo.

We do not use face mapping for anything else. We do not use it to identify you in other people's photos, to estimate your age, to infer your emotions or state of mind, to profile you, or to serve advertising.

2. What we collect

When you take a verification selfie, we transmit the image to Amazon Web Services, Inc. ("AWS"), which uses Amazon Rekognition to detect the face in your selfie and compare it to your profile photo. That process generates a scan of face geometry — a "face map" — which is a biometric identifier, and information derived from it, which is biometric information.

We collect:

| Item | Is it biometric? | Do we store it? | | -------------------------------------------------------------------------- | ------------------------------------------------------------------------- | ----------------------------------------------------------------- | | Your verification selfie (a photograph) | Photographs are excluded from BIPA's definition of a biometric identifier | Yes — see Section 5 | | The face map (scan of face geometry) computed by AWS | Yes | No — it is computed at the moment of comparison and discarded | | The comparison result (a similarity score and whether verification passed) | No — it is a number, not a biometric identifier | Yes |

We do not retain face maps. Each time you change your profile photo, we run a fresh comparison against your stored selfie and discard the face map again.

3. Notice and consent

We will never collect your biometric information without telling you first and obtaining your consent.

Before your first verification selfie is taken, Brie displays a written notice stating that biometric information is being collected, the specific purpose, the length of term for which it is collected and stored, and that AWS processes it for us. You must affirmatively agree before the camera opens. We record the fact, date, and time of your consent, and the version of this policy in force.

If you do not consent, we do not collect it — but you will not be able to complete verification, and verification is required to use Brie.

4. Purpose

We collect and use biometric information for one purpose: to confirm that the person creating or updating a Brie profile is the same person shown in that profile's photo.

5. Retention schedule

| Data | How long we keep it | | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Face map (scan of face geometry) | Not retained. Computed during comparison and discarded immediately. | | Verification selfie | For as long as your account is active, so we can re-verify when you change your profile photo. Permanently destroyed within 30 days of account deletion, and in every case within 3 years of your last interaction with Brie, whichever occurs first. | | Comparison result | For as long as your account is active, then destroyed within 30 days of account deletion. | | Consent record | For as long as your account is active, and for 5 years afterwards, so we can evidence that consent was given. |

Where a valid warrant or subpoena requires us to retain data beyond these periods, we will.

6. Destruction

When a retention period ends, we permanently destroy the data. Destruction means deletion from our production systems and from our media storage, such that the data cannot be recovered or reconstructed. Backups containing deleted data are not used to restore deleted accounts and are overwritten on our ordinary backup rotation.

We log each destruction event.

7. Disclosure

We disclose biometric information only to Amazon Web Services, Inc., which performs the face comparison on our instructions under a written agreement and may not use it for its own purposes.

We will not otherwise disclose, redisclose, or disseminate your biometric identifiers or biometric information unless:

- you consent to the disclosure; - it completes a financial transaction you requested or authorised; - it is required by state or federal law or municipal ordinance; or - it is required by a valid warrant or subpoena.

We do not disclose biometric information to other members. Your selfie is never shown on your profile.

8. We never profit from biometric data

Brie does not and will not sell, lease, trade, or otherwise profit from your biometric identifiers or biometric information. This is an absolute commitment. Biometric data is never an input to any paid feature, any advertising product, or any data-sharing arrangement.

9. Security

We store, transmit, and protect biometric information using at least the reasonable standard of care within our industry, and in a manner at least as protective as we use for other confidential and sensitive information. This includes encryption in transit and at rest, strict access controls limiting access to personnel who need it, and logging of access.

10. Your choices

- Withdraw consent. Email hello@itsbrie.com. Because verification is required to use Brie, withdrawing consent means we will delete your selfie and close your account. - Delete everything. Deleting your account destroys your selfie within 30 days. See How to Delete Your Account. - Ask us anything. Email hello@itsbrie.com and a person will answer.

11. Changes

We may update this policy. We will post the updated version with a new effective date and, where the change is material, obtain fresh consent before collecting further biometric information under it.

12. Contact

Brie Labs Inc. 28 Geary St, Ste 650-1720 San Francisco, CA 94108, United States hello@itsbrie.com