Last Biometric / Face-Reference Consent and Retention & Destruction Schedule

This schedule explains Last's face/photo-verification processing, retention, and destruction lifecycle. It does not expand the purposes stated in the Privacy Policy or verification consent.

1. Separate affirmative consent

Before the applicable face/photo-verification process runs, Last presents a standalone consent screen separate from general Terms acceptance. The consent records the exact text/version hash, user/account, timestamp, app version, jurisdiction, and affirmative act.

The consent explains:

1. Stripe Identity verifies the user's identity/document/selfie on the ordinary path.
2. Last retains the Stripe admission selfie as the account's encrypted verification reference; if the applicable Stripe-outage manual path is used, the approved fresh in-app camera capture becomes the reference instead.
3. Required and optional member profile photos are compared 1:1 against the current encrypted reference on Last-controlled infrastructure before publication as applicable.
4. Face measurements/embeddings used for comparison are computed only in memory and discarded; Last does not persist an embedding/template/landmark set/face crop/raw similarity score.
5. Authorized human review may occur for unresolved verification, applicable recovery, or report/photo-authenticity review. If you report an intimate image as depicting you, an authorized reviewer may, with your agreement in the report flow, visually compare your verification reference with that image to confirm the report.
6. The reference is not peer-visible and is not used for 1:N face search, cross-account face matching, demographic/emotion/attractiveness inference, or a Last liveness claim. The intimate-image review in item 5 is a one-to-one human check, not automated face matching.
7. The lifecycle/destruction rules below apply.

A material new biometric/face-processing purpose requires updated consent where required.

2. Required participation / no consent-decliner alternative

Ordinary active membership requires the applicable verification process. A user who declines the required consent cannot activate ordinary member-facing dating access. Support may help with accessibility, errors, or retries but cannot waive the verification requirement. The provider-outage manual path is a verification continuity process, not an alternative for refusal.

3. Reference custody

Exactly one current verification reference is authorized per verified identity. It is stored only as ciphertext in a service-only namespace. A per-user AES-256-GCM data-encryption key is wrapped by a separate key-encryption key under the applicable custody pattern outside the primary database.

Reference plaintext/unwrapped key exists only in memory for an in-flight 1:1 comparison or a logged, authorized emergency-access view. Clients cannot access the reference or authoritative matcher/receipt controls.

4. Data not retained

Last does not persist face embeddings, templates, landmark sets, face crops, bounding boxes, raw similarity values, or image-bearing trace/crash/profiling output from the face-comparison job. Transient sensitive buffers are handled under the applicable memory-spill controls.

5. Ordinary reference lifecycle

• Enrollment: ordinary reference comes from the applicable Stripe admission selfie after required consent/verification.
• Provider redaction: after the encrypted admission verification reference has been durably stored and the permitted identity fields have been copied, Last requests redaction of the applicable Stripe Identity verification material without waiting for account deletion; Stripe completes the redaction under its own process. Fresh recovery-verification material is requested for redaction after its authorized transient use (Section 8).
• Binding: two camera-only required profile photos must become accepted/bound for activation; subsequent required/optional photos use the same 1:1 architecture.
• Re-verification/reference replacement: a fresh applicable reference supersedes the old one and existing photos are re-bound under the technical process. The old reference is destroyed under the replacement lifecycle.
• Reset Account: Reset deletes the reference and photo/binding state and requires fresh verification before profile photos are published again.
• Delete Account: account deletion invokes Stripe redaction/deletion where applicable and destroys or severs the Last reference, pending submissions, photo-binding records, and consent and emergency-access records under the account-deletion lifecycle in the User Data Retention and Deletion Policy.

6. Incomplete signup / pending reference

A signup that is still waiting for its verification reference has one 60-day clock, starting at the first pending capture. If the verification reference is established and both required profile photos are accepted and bound before day 60, the clock stops. If the signup is still incomplete at day 60, the incomplete account and its pending material are deleted through Last's ordinary account-deletion process.

7. Manual/outage review material

During a governed Stripe-outage manual identity review, the government identity document is view-only/transient and is not stored by Last. The approved fresh camera capture may become the encrypted reference if the manual identity review passes.

Manual-review working copies used for unresolved checks are deleted immediately at adjudication unless a narrow legal-preservation hold specifically requires otherwise.

8. Recovery

A fresh Stripe recovery selfie may be transiently compared to the stored reference under the applicable recovery process. Last does not create a second persistent recovery-selfie reference/template solely for recovery. Minimum recovery decision/audit receipts may be retained as applicable.

9. Research prohibition

Verification reference/source/canonical hashes, face-reference material, consent records, binding receipts/pins, emergency-access records, embeddings/templates/landmarks/crops and other biometric/reference artifacts do not enter the research plane.

10. Jurisdiction

Last enables this verification process only in jurisdictions where its consent and legal requirements are met. A jurisdiction with an unresolved legal conflict stays disabled until that conflict is resolved.

11. Contact

Privacy: [email protected]
Legal: [email protected]
Elysian Studios LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States