Biometric Data Notice

Facial analysis involves processing of special-category data under GDPR Article 9 and KVKK Article 6, and biometric-specific laws exist in several US states (including Illinois BIPA and Texas CUBI). This notice provides the disclosures such laws call for, in plain language.

When you perform a skin scan:

• You upload a photo of your face.
• The image is analyzed by our AI provider (AILab — see the Privacy Policy) to detect facial regions and compute skin metrics.
• The derived metrics (acne, redness, pores, texture, hydration, oil, wrinkles, dark circles, melanin, skin type) are stored in your account.

We do not use facial data to identify you — there is no face-matching or identification. Because the image is analyzed for facial characteristics, we nevertheless treat it with special-category safeguards out of caution.

Facial data is processed solely to:

• Generate your personal skin scores and trends.
• Provide personalized skincare recommendations.
• Show you progress visualizations and overlays.

We do not use facial data for advertising, do not sell it, and do not use it to train AI models.

Face scanning is strictly opt-in. Before your first scan, the app asks for your explicit consent; the consent type, version, and timestamp are recorded. You may withdraw consent at any time in the app or by emailing privacy@skinora.io — the feature then stays off. Withdrawal does not affect processing that already occurred.

Facial images (scan photos and generated overlays) are deleted automatically 90 days after your last scan, and in any case when you delete your account or request deletion. Derived skin scores remain with your account so your history and trends keep working; they are deleted with your account.

Facial images are shared only with the processors needed to run the feature: AILab (performs the analysis) and Google Firebase (encrypted storage). They are not sold, leased, or disclosed for advertising. Disclosure to authorities happens only under a valid legal request.

You can: know what facial data we hold, receive a copy of your skin scores, request deletion at any time, and withdraw consent. Contact privacy@skinora.io. If you reside in a US state with a biometric privacy law (e.g., Illinois, Texas, Washington), we honor the rights and retention limits those laws provide; our electronic consent records serve as the written record those laws contemplate.