Privacy Policy

Last updated: 24 July 2026

Your privacy matters. Dermaglow never sells your personal data, never uses your photos for advertising, and never shares your data with third parties except as required to provide the service.

1. Who We Are

Dermaglow ("we", "us", or "our") is an AI-powered skincare application. For the purposes of GDPR and applicable EU data protection law, we act as the data controller for the personal data described in this policy.

Contact: privacy@dermaglow.app

2. What Data We Collect

Category	Data	Why
Account data	Email address, display name	To create and manage your account
Facial photos	Photos of your face/skin you capture with your camera or select from your photo library, for scans and for images you choose to attach in AI chat	To perform AI skin analysis and answer your questions about attached photos
Skin profile	Skin type, concerns, age range, lifestyle answers from onboarding questionnaire	To personalise your routines and AI advice
Scan results	AI-generated skin analysis results and recommendations	To show you your history and track progress
Usage data	App feature usage, crash reports (anonymised)	To improve the app (only with your consent)
Purchase data	Subscription status (not payment card details)	To manage your subscription tier

We do not collect precise location data, contact lists, browsing history, or any data unrelated to skincare.

3. Special Category Data

Facial photographs and health-related skin data are classified as special category data under GDPR Article 9. We only process this data:

With your explicit consent, obtained during onboarding before any photo is taken or processed
For the specific purposes you consented to
You may withdraw consent at any time in Settings → Privacy Controls

4. Legal Basis for Processing (GDPR Article 6 & 9)

Processing activity	Legal basis
Account creation and management	Contract performance (Art. 6(1)(b))
Facial photo analysis	Explicit consent (Art. 9(2)(a))
Skin profile and personalisation	Explicit consent (Art. 9(2)(a))
Subscription management	Contract performance (Art. 6(1)(b))
Crash reports and app improvement	Legitimate interests / consent (Art. 6(1)(a/f))
Legal compliance	Legal obligation (Art. 6(1)(c))

5. How We Use Your Data

To perform AI skin analysis on photos you submit
To generate personalised skincare routines and recommendations
To power the AI skin coach chat feature
To track your skin progress over time
To manage your account and subscription
To send service-related notifications (not marketing, unless you opt in)

6. Who We Share Data With

We share data only with the following sub-processors, all of whom are bound by data processing agreements. None of them may use your facial photos to train their own models:

Provider	Purpose	Facial photos?	Location
Supabase	Database, authentication, and encrypted file storage for your photos and account data	Yes — stores the photo files	EU (AWS Frankfurt) / US
OpenRouter	AI routing gateway — receives your photo from Supabase via a short-lived (60 second–5 minute) link and forwards it to the vision model below to generate your scan/chat result	Yes — routes the photo, does not retain it	US (SCCs apply)
Google (Gemini models)	Performs the visual skin analysis on your photos (spots, texture, tone, concerns) via OpenRouter	Yes — analyses the photo	US (SCCs apply)
OpenAI	Powers the text-based AI chat coach (routines, product advice, follow-up questions). Only receives photos if you directly attach one in chat for discussion	Only if you attach a photo in chat	US (SCCs apply)
Apple (RevenueCat)	Subscription and payment processing	No	US (SCCs apply)
Firebase (Google)	Push notifications only	No	US (SCCs apply)

We do not sell your data to any third party. We do not use your data for advertising purposes. No sub-processor uses your facial photos to train its models.

7. International Data Transfers

Some of our sub-processors are based in the United States. Where data is transferred outside the UK or EU, we ensure adequate protection through Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent safeguards.

8. Data Retention

Facial photos: Kept in your private, access-controlled storage folder for as long as your account is active, so you can view your scan history and track progress over time. Permanently deleted from storage when you delete your account (Settings → Delete Account), or sooner on request to privacy@dermaglow.app.
Scan results (AI-generated text analysis): Retained for as long as your account is active. Deleted when you delete your account.
OpenRouter / Google Gemini / OpenAI (AI processing): These providers receive your photo via a short-lived link or API call solely to generate your result. Per their API terms, they do not use this content to train their models. They may retain it briefly (typically up to 30 days) for abuse and safety monitoring under their own standard API data-retention policies, separate from and in addition to Dermaglow's retention above.
Account data: Deleted within 30 days of your account deletion request.
Anonymised usage data: May be retained indefinitely as it cannot be linked to you.

9. Your Rights Under GDPR

If you are in the UK or EU, you have the following rights:

Right of access (Art. 15): Request a copy of all data we hold about you.
Right to rectification (Art. 16): Correct inaccurate personal data.
Right to erasure (Art. 17): Delete your account and all associated data via Settings → Delete Account.
Right to data portability (Art. 20): Export your data via Settings → Export My Data.
Right to withdraw consent: Withdraw any consent at any time via Settings → Privacy Controls.
Right to object (Art. 21): Object to processing based on legitimate interests.
Right to lodge a complaint: You can complain to your national supervisory authority (e.g. ICO in the UK at ico.org.uk).

To exercise any right, email us at privacy@dermaglow.app. We will respond within 30 days.

10. Security

All data is transmitted over encrypted HTTPS connections
Facial photos are stored in encrypted, access-controlled storage buckets separate from account data
Authentication tokens are stored in the device's secure keychain
We do not store payment card details — all payments are handled by Apple

11. Children's Privacy

Dermaglow is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us at privacy@dermaglow.app and we will delete it promptly.

12. Medical Disclaimer

Dermaglow is not a medical device and does not provide medical diagnoses. All AI-generated skin analysis results are informational only and do not constitute medical advice. Always consult a licensed dermatologist for any skin health concerns, particularly unusual spots, moles, or lesions.

13. AI and Automated Decision-Making

Dermaglow uses AI to analyse your skin photos and generate recommendations. These results are generated automatically but are intended as informational guidance, not binding decisions. You are not subject to decisions based solely on automated processing that produce significant legal or similarly significant effects (GDPR Art. 22).

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the app or by email. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of Dermaglow after changes constitutes acceptance of the updated policy.

15. Contact Us

For any privacy-related queries, requests, or complaints:

Email: privacy@dermaglow.app
Support: dermaglow support page