The Federal Trade Commission has reached a settlement with photo storage app Ever that it says used customers’ photos to develop facial recognition technology without telling them, the agency announced Monday.

Under the terms of the agreement, Everalbum Inc. is required to delete photos and videos of its users who deactivated their accounts, as well as any facial recognition algorithms developed with users’ photos or videos. The company also must delete all “face embeddings,” which it describes as “data reflecting facial features that can be used for facial recognition purposes” that were derived from users’ photos who didn’t give consent for their use.

Everalbum, which shut down Ever in August and rebranded itself as Paravision AI, is also prohibited from misrepresenting how it collects and uses personal information and how it protects users’ privacy. If it markets software to consumers for personal use, the company has to obtain express consent before using any biometric information it collects from users to create face embeddings or to develop facial recognition technology.

In a 2019 report, NBC News detailed how Ever launched as a cloud storage business in 2013, but then switched to be a facial recognition technology provider four years later because it realized its photo app “wasn’t going to be a venture-scale business.” The report found that the Ever app was using customer’s private photos to train its facial recognition algorithm, which it then sold to clients.

The company said at the time that it never shared personal user data. Its privacy policy said “Your files may be used to help improve and train our products and these technologies,” but with little detail.

Photo services often use facial recognition to classify photos — Google, Facebook, and Apple have all been criticized in the past for their systems over privacy concerns — and large photo databases are often used by companies to train their facial recognition algorithms. Still, those services request extensive permissions from the user, and it’s extremely rare for a photo service to pivot entirely into facial recognition without notifying users.

According to the FTC, Everalbum told users that it would delete photos and videos of users who deactivated their accounts, but the agency said the company had failed to do so through at least October 2019, instead retaining them indefinitely.

In an email to The Verge, a Paravision spokesperson said the FTC order “reflects a change that has already taken place,” and the company has “no plans to run a consumer business moving forward.” Paravision’s face recognition model does not use any Ever users’ data, the spokesperson added.

“Face recognition and computer vision technology have the potential to improve our lives in profound ways and we take the gravity of its impacts extremely seriously,” the spokesperson continued, adding that Paravision has been recognized as an “accurate provider” of face recognition technology. “We look forward to maintaining this position with our latest generation model, and are deeply committed to the ethical development and use of this technology.”