This Privacy Policy describes how Dermasift ("we," "us," or "our") collects, uses, and shares your personal information when you use our website, mobile applications, and related services (the "Service").
1. Information We Collect
1.1 Information You Provide
- Account information: email address, password (hashed), and display name when you create an account.
- Skin profile data: skin type, skin concerns, sensitivities, allergies, and other skin-related preferences you voluntarily provide.
- Skin photos: if you use the skin snapshot feature, photos you upload for tracking purposes.
- Product submissions: product names, brands, and ingredient lists you submit through the community submission feature.
- Reports: inaccuracy reports you submit about product or ingredient data.
- Reviews and ratings: text and scores you submit on product pages, which may be visible to other users.
- Routines, saved items, and history: skincare routines you build, products you save, and related timeline or snapshot history stored with your account to personalize the Service.
1.2 Mobile applications and device data
If you use our mobile apps:
- Camera and photo library: with your permission, you may capture or choose images for ingredient label scanning or skin snapshots. You can deny access; optional features that require images will not be available.
- Push notifications: if you opt in, we collect a device push token so we can send notifications (for example, reminders or account-related messages). You can turn off notifications in your device settings or in-app where available.
- On-device storage: we store authentication tokens using your device's secure storage (e.g., iOS Keychain) where supported, and may store non-sensitive preferences (such as UI state or recent searches) in local app storage.
1.3 Information Collected Automatically
- Usage data: pages viewed, features used, search queries, and interaction patterns.
- Device information: device type, operating system, browser type, and screen resolution.
- Log data: IP address, access times, and referring URLs.
2. How We Use Your Information
We use your information to:
- Provide, maintain, and improve the Service.
- Generate personalized ingredient analyses and product recommendations based on your skin profile.
- Process AI-powered analyses of ingredients, products, and skin concerns.
- Process subscription payments through Stripe.
- Send transactional emails (account creation, password resets, account deletion).
- Respond to support requests and inaccuracy reports.
- Detect and prevent fraud, abuse, and security incidents.
- Conduct aggregated, anonymized analytics to improve the Service.
- Send optional push notifications when you have enabled them on your device.
3. AI Processing
We use artificial intelligence (currently Google Gemini) to process and enrich cosmetic ingredient data, generate product analyses, and provide personalized insights. When you use AI-powered features:
- Your skin profile data may be sent to AI services to generate personalized analyses. This data is not stored by the AI provider beyond the duration of the API request.
- Ingredient lists and product information are processed by AI to generate descriptions, interaction analyses, and concern scores.
- AI-generated results are stored in our database and may be displayed to other users as general information (without your personal data).
4. How Photos and Images Are Handled
4.1 Skin snapshots
If you use the skin snapshot feature:
- Photos are uploaded to and stored in Firebase Cloud Storage with encryption at rest.
- Photos are accessible only to you through your authenticated account.
- We do not share your skin photos with third parties, use them for advertising, or use them to train AI models.
- Photos are permanently deleted when you delete your account.
4.2 Ingredient label images (mobile)
When you photograph or upload a product label so we can read the ingredient list, the image is transmitted to our servers for optical character recognition (OCR) and related processing. Extracted text and analysis results may be stored with your account or in our systems to provide the feature. We do not sell label images or use them for third-party advertising. We do not use them to train public AI models. Images may be retained for a limited period as needed for security, abuse prevention, and service quality, consistent with our retention practices.
5. Data Sharing
We share your personal information only in the following circumstances:
5.1 Service Providers
- Stripe: payment processing for subscriptions. Stripe receives your email and payment information. See Stripe's Privacy Policy.
- Resend: transactional email delivery (including welcome, password reset, and account notices). Resend receives your email address. See Resend's Privacy Policy.
- Google (Gemini API): AI processing of ingredient and product data. Personal skin profile data sent for personalized analyses is not retained by Google. See Google's Privacy Policy.
- Firebase (Google Cloud): storage of skin photos. See Firebase Privacy.
- Push delivery (e.g., Apple Push Notification service / Google FCM): when you enable notifications, push infrastructure providers process device tokens to deliver messages. See your platform provider's privacy documentation.
5.2 Legal Requirements
We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect our rights, privacy, safety, or property.
6. Data Retention
- Active accounts: we retain your data for as long as your account is active.
- Deleted accounts: upon account deletion, personal data (profile, skin data, photos) is permanently removed. Anonymized, aggregated analytics data may be retained.
- Product submissions: product data you submit may be retained (without association to your account) even after account deletion, as it contributes to our public database.
7. Your Rights
Depending on your location, you may have the following rights:
7.1 Access and Portability
You can view and export your personal data through your account dashboard at any time.
7.2 Correction
You can update your profile and skin data at any time through the Service.
7.3 Deletion
You can delete your account at any time through the account settings page (web) or the profile screen (mobile app). Account deletion is permanent and includes removal of all personal data, skin profiles, and uploaded photos.
7.4 Opt-Out
You can opt out of marketing communications at any time. Transactional emails (account actions) cannot be opted out of while your account is active.
8. Cookies, Local Storage, and Mobile Storage
On our website, we use the following types of cookies and local storage:
- Essential cookies: authentication tokens required for the Service to function.
- Preference storage: UI preferences (e.g., dismissed consent banners) stored in localStorage.
- Analytics: anonymized usage analytics to understand how the Service is used and to improve it.
We do not use third-party advertising cookies or tracking pixels.
On mobile, session credentials are stored using platform secure storage where available, and lightweight preferences may be stored in the app's sandboxed local storage. See also section 1.2 above.
9. Children's Privacy
The Service is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us.
10. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from your jurisdiction. By using the Service, you consent to such transfers.
Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for international data transfers.
11. GDPR (European Economic Area)
If you are in the EEA, you have additional rights under the GDPR:
- Right to access your personal data.
- Right to rectification of inaccurate data.
- Right to erasure ("right to be forgotten").
- Right to restriction of processing.
- Right to data portability.
- Right to object to processing.
- Right to lodge a complaint with a supervisory authority.
Our legal bases for processing your data include: performance of a contract (providing the Service), legitimate interests (improving the Service, fraud prevention), and consent (where specifically requested).
12. CCPA (California)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, and disclose.
- Request deletion of your personal information.
- Opt-out of the "sale" of personal information (we do not sell your data).
- Non-discrimination for exercising your privacy rights.
13. Data Security
We implement industry-standard security measures to protect your personal information, including:
- Encryption in transit (TLS/HTTPS) and at rest.
- Secure password hashing (bcrypt).
- Access controls and authentication for all data access.
- Regular security reviews.
However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date and, where appropriate, providing additional notice (such as email notification).
15. Contact Us
If you have questions about this Privacy Policy or your data, please contact us at privacy@dermasift.com.