SKINMAP PRIVACY POLICY

Effective Date: August 7, 2026
Last Updated: August 7, 2026

This Privacy Policy explains how SkinMap ("SkinMap," "we," "us," or "our") collects, uses, stores, shares, retains, and deletes personal information when you use the SkinMap mobile application, website, and related services (collectively, the "Service").

SkinMap is an AI-powered skincare application that allows users to create an account, capture or upload a facial photograph, receive AI-powered skin analysis, view previous scan history, receive personalized skincare recommendations, purchase subscriptions through Apple In-App Purchase, and book consultations with skincare professionals.

By creating an account, accessing, or using SkinMap, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, you must not use the Service.

This Privacy Policy is intended to satisfy Apple App Store Review Guideline 5.1.1 (Data Collection and Storage), including disclosures related to face data and other sensitive personal information.

1. Who We Are

SkinMap operates the Service and is responsible for the personal information described in this Privacy Policy. For privacy questions or requests, contact us using the details in Section 14.

2. Information We Collect

Depending on how you use the Service, we may collect the following categories of information:

2.1 Account Information

2.2 Face Data and Skin Analysis Data

SkinMap collects facial photographs that you capture with your device camera or upload from your photo library. These photographs are used solely to provide AI-powered skin analysis and related skincare features that you request.

What face data we collect:

  • Facial photographs (still images) captured or uploaded by you
  • Scan metadata associated with those photographs (for example, scan date/time and scan identifiers)
  • AI-generated skin analysis results derived from those photographs

What face data we do NOT collect:

  • Face geometry
  • Face mesh data
  • Face landmarks
  • Face templates
  • Biometric identifiers
  • Face recognition data
  • Identity verification data
  • Depth maps or facial mapping data used for facial recognition or identity matching

SkinMap does not use facial photographs for facial recognition, identity verification, biometric profiling, or to identify you across other services. Facial photographs are processed as images for skin condition analysis only.

2.3 Purchase and Subscription Information

2.4 Consultation Information

2.5 Device and Usage Information

2.6 Support Communications

3. Face Data: Collection, Processing, Storage, Sharing, Retention, and Deletion

This section provides the specific face-data disclosures required for App Store Review and for users who upload facial photographs to SkinMap.

3.1 Why We Collect Face Data

We collect facial photographs only to:

We do not collect facial photographs for advertising, marketing, facial recognition, identity verification, or building biometric profiles.

3.2 How Face Data Is Processed

When you capture or upload a facial photograph, the processing flow is as follows:

  1. You capture a facial photograph with your camera or upload an image from your device.
  2. The image is transmitted securely over HTTPS and uploaded to Cloudflare R2 Object Storage.
  3. Cloudflare returns a secure object URL for the stored image.
  4. Our PostgreSQL database stores the Cloudflare object URL, scan metadata, and related account association. The raw image file itself is not stored inside the database.
  5. The image is processed by our AI analysis providers to generate skin analysis results and related recommendations:
    • Perfect Corp processes the facial photograph to perform skin analysis for the Service you request.
    • Google Gemini processes the facial photograph and/or related analysis inputs to generate or refine personalized skincare insights and recommendations for the Service you request.
  6. Analysis results are stored with your account so you can review them and receive recommendations.
  7. The facial photograph remains associated with your account until you delete the scan or delete your account, subject to the retention and deletion practices described below.

Perfect Corp and Google Gemini act as service providers / data processors on our behalf. Their processing is limited to providing the skin analysis and recommendation features you request. Facial photographs are not processed by Perfect Corp or Google Gemini for facial recognition, identity verification, advertising, marketing, or to build biometric profiles. We do not permit Perfect Corp or Google Gemini to use your facial photographs to train AI models for their own independent purposes.

The AI analysis is performed to evaluate skin-related characteristics for skincare purposes only. It is not used to recognize your identity, match your face against other faces, or create a biometric template.

3.3 Where Face Data Is Stored

3.4 Whether Face Data Is Shared

Facial photographs are:

Facial photographs may be processed only by infrastructure providers that supply storage and AI analysis necessary to perform the Service you request. These providers act as service providers / data processors on our behalf and are permitted to process face data only to provide the requested Service functions, not for their own independent purposes such as advertising or model training on your images.

Current third parties involved in face-image handling are:

Perfect Corp and Google Gemini process face data solely to generate the skin analysis results and recommendations you request. They are not permitted to sell your facial photographs, use them for advertising, use them for facial recognition, or use them to train AI models for their own independent purposes.

If you book a consultation with a skincare professional, we may share analysis results and other information you choose to provide for that consultation. Facial photographs are shared with a professional only if needed to deliver the consultation you request.

3.5 Face Data Retention Period

Facial photographs remain stored only while they are associated with your account and are needed to provide scan history and related Service features.

After a valid deletion request or account deletion is completed, we aim to permanently delete associated facial photographs and related personal data from active systems within 30 days, except where a limited copy must be retained temporarily for security, fraud prevention, legal compliance, dispute resolution, or backup integrity. Any such limited retention is restricted to those purposes and is deleted when no longer required.

3.6 Face Data Deletion Process

You may delete face data as follows:

When a deletion is processed, we delete the corresponding object from Cloudflare R2 and remove or de-associate the related database records (image URL, scan metadata, and analysis results). Cached or backup copies, if any, are cleared or overwritten according to our backup rotation and deletion process.

3.7 Security Protections for Face Data

We apply the following protections to facial photographs and related data:

No method of transmission or storage is 100% secure. We work to protect face data using industry-standard safeguards appropriate to the sensitivity of the data.

4. How We Use Personal Information

We use personal information to:

Important clarification: facial photographs and face data are not used to train AI models, build biometric profiles, or improve unrelated products. Aggregate or non-face product analytics may be used to improve app functionality, reliability, and user experience.

5. Legal Bases and Consent

Where required by applicable law, we process personal information based on your consent, performance of a contract (to provide the Service you request), legitimate interests that are not overridden by your rights, and/or legal obligations.

Camera and photo library access are requested only to enable capture or upload of images for skin analysis. You may withdraw consent for future collection by declining device permissions, deleting scans, deleting your account, or contacting us. Withdrawal of consent does not affect the lawfulness of processing performed before withdrawal.

Paid functionality is not conditioned on granting access to data that is not needed for that functionality. Face data is collected only when you choose to use features that require a facial photograph.

6. How We Share Information

We may share personal information only as described below:

6.1 Service Providers / Processors

These providers — including Cloudflare, Perfect Corp, and Google Gemini — are authorized to process personal information only to perform services for SkinMap and are required to provide equal or greater protection of user data as described in this Privacy Policy and required by Apple App Store Review Guidelines. They are not authorized to sell face data, use face data for advertising or marketing, use face data for facial recognition or identity verification, or use your facial photographs to train AI models for their own independent purposes.

6.2 Apple

If you purchase a subscription through Apple In-App Purchase, Apple processes the payment transaction. Apple’s handling of payment information is governed by Apple’s privacy policy and terms.

6.3 Skincare Professionals

If you book a consultation, we may share information necessary to fulfill that consultation, which may include analysis results and information you choose to provide. Facial photographs are shared only if needed to deliver the consultation.

6.4 Legal and Safety Disclosures

We may disclose information if required by law, legal process, or governmental request, or when we believe disclosure is necessary to protect the rights, safety, or security of SkinMap, our users, or the public.

6.5 Business Transfers

If SkinMap is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to continuing confidentiality and privacy protections consistent with this Privacy Policy.

6.6 What We Do Not Do

7. Data Retention

We retain personal information only for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

8. Your Privacy Rights and Choices

Depending on your location and applicable law, you may have the right to:

You can exercise many of these choices directly in the app by:

You may also email skinmapapk@gmail.com to revoke consent, request access, or request deletion. We will respond within a reasonable time and as required by applicable law.

If your app account supports account creation, SkinMap provides an in-app mechanism to initiate account deletion, consistent with Apple App Store Review Guideline 5.1.1(v).

9. Children’s Privacy

SkinMap is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Users must be at least 13 years old to use SkinMap. Users under 18 may use the Service only with the consent and supervision of a parent or legal guardian.

If we learn that we have collected personal information from a child under 13 without appropriate consent, we will delete that information. Contact us at skinmapapk@gmail.com if you believe a child has provided personal information.

10. International Data Transfers

Personal information may be processed and stored in countries other than the country where you live, including by our infrastructure providers such as Cloudflare. When we transfer personal information internationally, we take steps designed to ensure appropriate safeguards consistent with this Privacy Policy and applicable law.

11. Security

We implement administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. These measures include HTTPS transmission, restricted access to backend systems, and secure storage of facial photographs in Cloudflare R2.

Please protect your account credentials and notify us promptly of any suspected unauthorized access.

12. Third-Party Links and Services

The Service may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies before providing personal information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the Effective Date and/or Last Updated date above. If changes are material, we will provide additional notice as required by applicable law (for example, in-app notice or email).

Continued use of the Service after an update becomes effective constitutes acknowledgment of the revised Privacy Policy.

14. Contact Information

For questions, privacy requests, consent withdrawal, or deletion requests, contact:

SkinMap Support

Email: skinmapapk@gmail.com

By using SkinMap, you acknowledge that you have read and understood this Privacy Policy, including the face data practices described in Section 3.