Biometric data retention policy
AIpplied Labs, LLC. Effective October 10, 2026.
This policy explains how AIpplied Labs, LLC ("AIpplied Labs") collects, uses, keeps, and destroys biometric data, as the Illinois Biometric Information Privacy Act (740 ILCS 14) requires.
What AIpplied Labs collects
When a client asks AIpplied Labs to create a digital avatar and synthetic voice of a person (the "avatar and voice"), AIpplied Labs and its vendor HeyGen (HeyGen Technology, Inc.) collect a scan of that person's face geometry and a voiceprint, taken from video and audio recordings the person provides. This policy calls that "biometric data." The term covers both biometric identifiers and biometric information.
When AIpplied Labs collects it
Only after the person receives a written notice and signs a written release. The person signs the release personally; a company, team, or brokerage can't sign for them. Electronic signatures count.
Why AIpplied Labs uses it
Only to create and operate that person's avatar and voice, for the marketing uses the person approved in writing.
Who receives it
AIpplied Labs shares biometric data only with HeyGen and HeyGen's subprocessors to provide the service, or when the law requires it. When possible, AIpplied Labs creates the avatar and voice in a HeyGen account the person owns. Before uploading anything, AIpplied Labs asks HeyGen, through [email protected], to opt every account that will receive the recordings out of using uploads to train its AI models. It uploads nothing until HeyGen confirms the opt-out in writing, and it gives the person HeyGen's reply. AIpplied Labs can't guarantee that HeyGen honors the opt-out.
AIpplied Labs never sells, leases, trades, or otherwise profits from biometric data.
How long AIpplied Labs keeps it
AIpplied Labs keeps biometric data, and directs HeyGen to keep it, only until the earliest of:
- 30 days after AIpplied Labs's agreement with the client ends,
- 30 days after the person withdraws consent, or
- 3 years after the person's last interaction with AIpplied Labs.
By that date, AIpplied Labs permanently destroys the biometric data it holds, deletes the avatar and voice from HeyGen, and asks HeyGen to destroy its copies and send its certificate of deletion. AIpplied Labs then confirms the deletion to the person in writing. If AIpplied Labs no longer has access to the person's own HeyGen account, it tells the person how to delete the avatar and voice there.
AIpplied Labs deletes raw video and audio recordings from its own devices and storage within 7 days after the avatar and voice are created.
How AIpplied Labs protects it
AIpplied Labs stores, transmits, and protects biometric data with a reasonable standard of care for its industry, and at least as carefully as it protects its other confidential information.
Withdrawing consent or asking for deletion
Email [email protected]. Within 5 business days, AIpplied Labs stops making new content with the person's avatar and voice, and takes down any such content it hosts, has posted, or controls. AIpplied Labs then destroys the biometric data on the schedule above, within 30 days. Content the person posted on their own accounts stays under their control.
Recordings that aren't biometric data
AIpplied Labs records onboarding interviews with Wave, which runs on OpenAI's API and doesn't identify speakers by their voice. AIpplied Labs doesn't use interview or call recordings to identify anyone by voice or to clone a voice.
Changes to this policy
AIpplied Labs posts any change on this page with a new effective date. Before using a new vendor for biometric data, AIpplied Labs gets a new signed release from each person affected.