Privacy Policy
Last updated: 24 July 2026
Your privacy matters. Dermaglow never sells your personal data, never uses your photos for advertising, and never shares your data with third parties except as required to provide the service.
1. Who We Are
Dermaglow ("we", "us", or "our") is an AI-powered skincare application. For the purposes of GDPR and applicable EU data protection law, we act as the data controller for the personal data described in this policy.
Contact: privacy@dermaglowbeauty.com
2. What Data We Collect
| Category | Data | Why |
|---|---|---|
| Account data | Email address, display name | To create and manage your account |
| Facial photos | Photos of your face/skin you capture with your camera or select from your photo library, for scans and for images you choose to attach in AI chat | To perform AI skin analysis and answer your questions about attached photos |
| Skin profile | Skin type, concerns, age range, lifestyle answers from onboarding questionnaire | To personalise your routines and AI advice |
| Scan results | AI-generated skin analysis results and recommendations | To show you your history and track progress |
| Usage data | App feature usage, crash reports (anonymised) | To improve the app (only with your consent) |
| Purchase data | Subscription status (not payment card details) | To manage your subscription tier |
We do not collect precise location data, contact lists, browsing history, or any data unrelated to skincare.
3. Special Category Data
Facial photographs and health-related skin data are classified as special category data under GDPR Article 9. We only process this data:
- With your explicit consent, obtained during onboarding before any photo is taken or processed
- For the specific purposes you consented to
- You may withdraw consent at any time in Settings → Privacy Controls
4. Legal Basis for Processing (GDPR Article 6 & 9)
| Processing activity | Legal basis |
|---|---|
| Account creation and management | Contract performance (Art. 6(1)(b)) |
| Facial photo analysis | Explicit consent (Art. 9(2)(a)) |
| Skin profile and personalisation | Explicit consent (Art. 9(2)(a)) |
| Subscription management | Contract performance (Art. 6(1)(b)) |
| Crash reports and app improvement | Legitimate interests / consent (Art. 6(1)(a/f)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
5. How We Use Your Data
- To perform AI skin analysis on photos you submit
- To generate personalised skincare routines and recommendations
- To power the AI skin coach chat feature
- To track your skin progress over time
- To manage your account and subscription
- To send service-related notifications (not marketing, unless you opt in)
6. Who We Share Data With
We share data only with the following sub-processors, all of whom are bound by data processing agreements. None of them may use your facial photos to train their own models:
| Provider | Purpose | Facial photos? | Location |
|---|---|---|---|
| Supabase | Database, authentication, and encrypted file storage for your photos and account data | Yes — stores the photo files | EU (AWS Frankfurt) / US |
| OpenRouter | AI routing gateway — receives your photo from Supabase via a short-lived (60 second–5 minute) link and forwards it to the vision model below to generate your scan/chat result | Yes — routes the photo, does not retain it | US (SCCs apply) |
| Google (Gemini models) | Performs the visual skin analysis on your photos (spots, texture, tone, concerns) via OpenRouter | Yes — analyses the photo | US (SCCs apply) |
| OpenAI | Powers the text-based AI chat coach (routines, product advice, follow-up questions). Only receives photos if you directly attach one in chat for discussion | Only if you attach a photo in chat | US (SCCs apply) |
| Apple (RevenueCat) | Subscription and payment processing | No | US (SCCs apply) |
| Firebase (Google) | Push notifications only | No | US (SCCs apply) |
We do not sell your data to any third party. We do not use your data for advertising purposes. No sub-processor uses your facial photos to train its models.
7. International Data Transfers
Some of our sub-processors are based in the United States. Where data is transferred outside the UK or EU, we ensure adequate protection through Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent safeguards.
8. Data Retention
- Facial photos: Kept in your private, access-controlled storage folder for as long as your account is active, so you can view your scan history and track progress over time. Permanently deleted from storage when you delete your account (Settings → Delete Account), or sooner on request to privacy@dermaglowbeauty.com.
- Scan results (AI-generated text analysis): Retained for as long as your account is active. Deleted when you delete your account.
- OpenRouter / Google Gemini / OpenAI (AI processing): These providers receive your photo via a short-lived link or API call solely to generate your result. Per their API terms, they do not use this content to train their models. They may retain it briefly (typically up to 30 days) for abuse and safety monitoring under their own standard API data-retention policies, separate from and in addition to Dermaglow's retention above.
- Account data: Deleted within 30 days of your account deletion request.
- Anonymised usage data: May be retained indefinitely as it cannot be linked to you.
9. Your Rights Under GDPR
If you are in the UK or EU, you have the following rights:
- Right of access (Art. 15): Request a copy of all data we hold about you.
- Right to rectification (Art. 16): Correct inaccurate personal data.
- Right to erasure (Art. 17): Delete your account and all associated data via Settings → Delete Account.
- Right to data portability (Art. 20): Export your data via Settings → Export My Data.
- Right to withdraw consent: Withdraw any consent at any time via Settings → Privacy Controls.
- Right to object (Art. 21): Object to processing based on legitimate interests.
- Right to lodge a complaint: You can complain to your national supervisory authority (e.g. ICO in the UK at ico.org.uk).
To exercise any right, email us at privacy@dermaglowbeauty.com. We will respond within 30 days.
10. Security
- All data is transmitted over encrypted HTTPS connections
- Facial photos are stored in encrypted, access-controlled storage buckets separate from account data
- Authentication tokens are stored in the device's secure keychain
- We do not store payment card details — all payments are handled by Apple
11. Children's Privacy
Dermaglow is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us at privacy@dermaglowbeauty.com and we will delete it promptly.
12. Medical Disclaimer
Dermaglow is not a medical device and does not provide medical diagnoses. All AI-generated skin analysis results are informational only and do not constitute medical advice. Always consult a licensed dermatologist for any skin health concerns, particularly unusual spots, moles, or lesions.
13. AI and Automated Decision-Making
Dermaglow uses AI to analyse your skin photos and generate recommendations. These results are generated automatically but are intended as informational guidance, not binding decisions. You are not subject to decisions based solely on automated processing that produce significant legal or similarly significant effects (GDPR Art. 22).
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes through the app or by email. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of Dermaglow after changes constitutes acceptance of the updated policy.
15. Contact Us
For any privacy-related queries, requests, or complaints:
- Email: privacy@dermaglowbeauty.com
- Support: dermaglow support page