Privacy Policy

Introduction

This Privacy Policy describes how Nalumi (“we”, “us”) handles personal data when you use the Nalumi service, the website nalumi.app and the web application (the “Service”). We act as the controller of your personal data.

In short: we collect only what we need to personalise your skincare and beauty experience, we use it for that purpose, we never sell your personal data, and you can ask us to delete it at any time.

Information We Collect

Information you give us:

• Account data — your email address and, if you choose, your name.
• Beauty profile — your skin type, skincare and beauty goals, preferences (for example, texture, fragrance-free or vegan products), budget and, if you decide to tell us, any sensitivities or allergies.
• Your Content — messages you send to the beauty assistant, routine entries and your self-reported check-ins on how your skin feels.
• Support requests — messages you send to our support team.

We do not ask you to upload photos of your face or skin, and the Service does not perform any skin scans or diagnostics.

Information collected automatically:

• Activity in the Service — routines viewed and completed, tracker streaks, check-in history, features used and reminder interactions.
• Device and usage data — IP address and the approximate location derived from it (country, city), browser and device type, language, time zone and in-app events.
• Marketing attribution — how you found us (for example, campaign parameters in the link you followed).

Payment information: payments are handled by our checkout and payment providers. We receive details such as your plan, price, currency, transaction status and a limited payment reference, but never your full card number.

Sensitivities and Allergies You Share

Nalumi is a cosmetic service, and we treat your beauty profile answers as cosmetic preferences rather than medical records. Some answers, however — such as sensitive skin or allergies to certain ingredients — are personal, so we handle them with extra care.

• Sharing sensitivities or allergies is entirely voluntary. You can skip these questions and still use the Service.
• Where you do share them, we use them only to tailor your routine and product suggestions (for example, to avoid ingredients you told us to avoid), and where the law requires it, on the basis of your consent.
• We do not use this information for advertising, do not share it with advertising networks and never sell it.
• You can change or remove this information, or withdraw your consent, at any time by updating your answers or deleting your account. This does not affect processing carried out before you withdrew consent.

How We Use Your Data

We use personal data to:

• create and protect your account and send you sign-in links (performance of a contract);
• build your personal routine and product suggestions and save your tracker and check-in history (performance of a contract);
• reply to your messages through the beauty assistant (performance of a contract);
• process subscriptions, prevent fraud and handle refunds (performance of a contract, legal obligation);
• send service emails and, if you have agreed, occasional tips and updates you can unsubscribe from at any time (contract, consent);
• study aggregated usage to improve the Service and fix errors (legitimate interests);
• meet our legal, tax and accounting obligations (legal obligation).

Beauty Assistant

When you chat with the beauty assistant, your message and the relevant parts of your profile (such as skin type, goals and any sensitivities you shared) are sent to our AI service provider so it can generate a reply. The provider processes this data on our behalf under a data processing agreement. We do not use your conversations to build advertising profiles. Please avoid sharing names, contact details or information about other people in the chat.

Who We Share Data With

We share personal data only with trusted service providers that help us run the Service and are bound by confidentiality and data protection obligations:

• hosting and infrastructure providers;
• checkout, subscription management and payment processors (for example, Stripe or PayPal);
• email delivery providers;
• product analytics and error monitoring providers;
• AI service providers (for the beauty assistant only).

We do not share your data with cosmetic brands or retailers. If you follow a link to a third-party shop, that shop’s own privacy policy applies to anything you do there.

We may also disclose data where the law requires it, to protect our rights, our users or the public, or to a successor in the event of a merger or acquisition. We do not sell or “share” personal data for cross-context behavioural advertising.

International Transfers

Our providers may process data outside your country, including outside the EEA and the UK. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Storage, Security and Retention

We protect your data with industry-standard measures, including encryption in transit and access controls. Your chat messages and check-ins are visible only to you and, when strictly necessary to help you at your request, to a small number of authorised staff.

We keep your data for as long as your account is active. When you delete your account or ask us to delete your data, we delete or anonymise it within 30 days, except for records we are legally required to keep (for example, payment and tax records).

Your Rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data or have your data deleted;
• restrict or object to certain processing, and withdraw consent at any time;
• data portability;
• opt out of the sale or sharing of personal data (California and other U.S. states — we do not sell or share it);
• complain to your local data protection authority.

To use any of these rights, email [email protected] from the address linked to your account. We reply within 30 days.

Cookies and Similar Technologies

We use essential cookies and local storage to keep you signed in and remember your settings, and analytics technologies to understand how the Service is used. You can manage cookies in your browser settings; turning off essential cookies may stop you from signing in.

Children

The Service is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, please contact us and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be on this page with an updated date at the top, and for significant changes we will also notify you by email or in the Service.

Contact

For any privacy question or request, contact us: