Privacy & Data Policy.

Last updated: 16 August 2026

1. What We Collect

When you purchase a Forensic Phenotype Report, we collect:

• Email address — to deliver your report and send order confirmations.
• Photographs — a frontal and profile photograph that you voluntarily submit after purchase for the purpose of producing your report.
• Payment information — processed securely by Stripe. We never see or store your full card details.
• Order metadata — order ID, edition chosen, purchase timestamp, and currency.

2. How We Use Your Data

Your personal information is used solely to:

• Produce and deliver your Forensic Phenotype Report.
• Send transactional emails (order confirmation, photo receipt, report delivery).
• Respond to support requests you initiate.

We do not sell, rent, or share your data with third parties for marketing purposes. We do not use your photographs for any purpose other than producing your commissioned report.

3. Photograph Handling & Retention

Your photographs are stored in a private, encrypted storage bucket (Supabase Storage) and are accessible only to our analysts for the purpose of producing your report. Photographs are:

• Never published, shared, or used in marketing.
• Retained for up to 90 days after report delivery to allow for support queries and quality review.
• Permanently deleted after the 90-day retention period, unless you request earlier deletion.

You may request immediate deletion of your source photographs at any time by emailing hello@ancestrydecoded.com with your order reference.

4. Payment Security

All payments are processed through Stripe, a PCI DSS Level 1 certified payment processor. Your card details are transmitted directly to Stripe via encrypted connection and are never stored on our servers. We only receive confirmation of successful payment and basic transaction metadata.

5. Cookies & Analytics

This website uses only essential cookies required for the site to function (such as session management). We do not use advertising cookies or third-party tracking pixels. If we introduce analytics in the future, this policy will be updated accordingly.

6. Your Rights (GDPR / CCPA)

If you are located in the European Economic Area, United Kingdom, or California, you have the right to:

• Access — request a copy of any personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your personal data, including photographs.
• Portability — receive your data in a portable format.
• Objection — object to processing of your data.

To exercise any of these rights, contact us at hello@ancestrydecoded.com. We will respond within 30 days.

7. Data Security

We implement industry-standard security measures including encrypted storage, HTTPS-only transmission, and access controls limited to authorized personnel. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Contact

For any privacy-related queries, contact: hello@ancestrydecoded.com