Privacy policy

Version 2026-10-05

Who we are

DERMOMASK is provided by [Company legal name], [registered address], [country] (“we”). Contact: [support email]. [If required: Data Protection Officer / EU representative contact.]

What we collect, and why

Account data — your email and a securely hashed password, to give you an account. Legal basis: contract.
Profile — name, age, gender, skin type, allergies, concerns and notes you enter, to personalise masks and routines and to avoid ingredients you react to. Legal basis: your explicit consent, given at sign-up.
Face photos and skin analysis — during a scan, a cropped photo of your face is sent over an encrypted connection to our server, analysed by our skin models in memory, and not kept by that step. The resulting scores are health-related data. Legal basis: your explicit consent, given at sign-up.
Saved scan photos — if “Save scan photos” is on (default; you can turn it off in Profile), the photos from each scan are stored encrypted in a private folder for your account, so you can follow your progress. Legal basis: your explicit consent.
Model improvement — only if you turn on “Help improve the skin models”, your saved scan photos and scores may be used, without your name or email, to train and test better models. This is optional and off unless you choose it. You can withdraw at any time; photos are then no longer used for future training.
Routine and settings — your daily checklist, mask plan progress, reminders and display settings, to sync them across your devices.
Messages — what you send through the contact form, to answer you.
Technical data — IP address and device information in short-lived server logs and rate limits, to keep the service secure.

We do not sell your data, show third-party advertising, or use your photos to identify you.

Where it is stored and who processes it

Data is stored by our hosting provider [Hostinger International Ltd., data-centre location]. Emails are sent through [email provider]. If payments are introduced, they are handled by Stripe; we never see your card number. [List any other processors.]

How long we keep it

For as long as you have an account. When you delete your account, your profile, scans, photos and routine data are deleted immediately from the live system, and from backups within [35] days. Contact messages are kept for [24] months.

Your rights

You can download all your data (Privacy & data → Download my data), correct it in Profile, turn photo saving and model improvement on or off, and delete your account (Privacy & data → Delete my account). You can also contact us to exercise your rights of access, rectification, erasure, restriction, portability and objection, and you may complain to your data-protection authority [name the lead authority].

Children

DERMOMASK is not intended for anyone under [16].

Security

Connections are encrypted (HTTPS). Passwords are stored only as salted hashes. Saved photos are encrypted at rest (AES-256-GCM). Access to production systems is restricted.

Not medical advice

DERMOMASK gives cosmetic guidance only. It is not a medical device and does not diagnose skin or hair conditions.

Changes

If we change this policy in a way that matters, we will tell you in the app and ask you to accept the new version.