Privacy Policy

Introduction

This Privacy Policy describes how Nalumi (“we”, “us”) handles personal data when you use the Nalumi service, the website nalumi.app and the web application (the “Service”). We act as the controller of your personal data.

In short: we collect only what we need to personalise your skincare and beauty experience, we use it for that purpose, we never sell your personal data or face photos, and you can delete it yourself at any time.

Information We Collect

Information you give us:

• Account data — your email address and, if you choose, your name.
• Beauty profile — your skin type, skincare and beauty goals, preferences (for example, texture, fragrance-free or vegan products), budget and, if you decide to tell us, any sensitivities or allergies.
• Face photos and scan results — if you use the face scan: the photos you take and the scores and highlighted areas we produce from them. See Face Photos and Scans.
• Product photos — photos of product packaging you take so we can recognise the product.
• Your Content — messages you send to the Nala assistant, your product shelf and favourites, routine entries and your self-reported check-ins and diary notes on how your skin feels.
• Support requests — messages you send to our support team.

Information collected automatically:

• Activity in the Service — routines viewed and completed, tracker streaks, check-in history, features used and reminder interactions.
• Device and usage data — IP address and the approximate location derived from it (country, city), browser and device type, language, time zone and in-app events.
• Marketing attribution — how you found us (for example, campaign parameters in the link you followed).

Payment information: payments are handled by our checkout and payment providers. We receive details such as your plan, price, currency, transaction status and a limited payment reference, but never your full card number.

Sensitivities and Allergies You Share

Nalumi is a cosmetic service, and we treat your beauty profile answers as cosmetic preferences rather than medical records. Some answers, however — such as sensitive skin or allergies to certain ingredients — are personal, so we handle them with extra care.

• Sharing sensitivities or allergies is entirely voluntary. You can skip these questions and still use the Service.
• Where you do share them, we use them only to tailor your routine and product suggestions (for example, to avoid ingredients you told us to avoid), and where the law requires it, on the basis of your consent.
• We do not use this information for advertising, do not share it with advertising networks and never sell it.
• You can change or remove this information, or withdraw your consent, at any time by updating your answers or deleting your account. This does not affect processing carried out before you withdrew consent.

Face Photos and Scans

The face scan is optional, and we treat face photos with the highest level of care. Some laws (for example, in Illinois, Texas and Washington, and the GDPR in Europe) treat face images, facial geometry or information about the condition of your skin as biometric or health-related data. Our Biometric Data Policy and Consumer Health Data Policy explain this in more detail and form part of this Privacy Policy.

Consent first. Before your first scan we show you what we collect, why and for how long, and ask for your explicit consent. Without it, the scan feature does not work. We record when you gave or withdrew consent.

What we collect: the photos you take for a scan (a front photo and, optionally, side photos), and the results we produce from them — skin scores (such as tone evenness, redness, spots and texture), highlighted areas and a heat map.

How it works:

• While you take a scan, the face position guides (face landmark points) are calculated on your device only and are never sent to us.
• The photo is sent over an encrypted connection to our own servers, where our analysis service looks at the skin areas of the face. The facial geometry used during this analysis exists only in memory and is discarded immediately; we store only the photo, the heat map and the scores.
• We do not send your face photos to any third party for analysis.

What we never do: we do not sell, rent or trade your face photos or scan results; we do not use them to identify you or to recognise or match faces across accounts or people; we do not use them to train AI models; and we do not use them for advertising.

Retention and deletion: we keep your scans until you delete them, withdraw your consent or close your account, and in any case no longer than 1 year after your last activity in the Service. You can delete any scan in the app at any time; withdrawing your consent deletes all your scans; deleting your account deletes all your photos and scans. Deleted photos are removed from our servers promptly and from backups within 30 days.

How We Use Your Data

We use personal data to:

• create and protect your account and send you sign-in links (performance of a contract);
• analyse your face photos and show your scan results and progress, only with your explicit consent (consent);
• recognise products from photos of their packaging and find product details, prices and shops (performance of a contract);
• build your personal routine and product suggestions and save your tracker and check-in history (performance of a contract);
• reply to your messages through the beauty assistant (performance of a contract);
• process subscriptions, prevent fraud and handle refunds (performance of a contract, legal obligation);
• send service emails and, if you have agreed, occasional tips and updates you can unsubscribe from at any time (contract, consent);
• study aggregated usage to improve the Service and fix errors (legitimate interests);
• meet our legal, tax and accounting obligations (legal obligation).

Nala Assistant

When you chat with Nala, your message and the relevant parts of your profile (such as skin type, goals, any sensitivities you shared, a short text summary of your latest scan scores, your routine and shelf) are sent to our AI service provider so it can generate a reply. Your face photos are never sent to the chat provider. The provider processes this data on our behalf under a data processing agreement. We do not use your conversations to build advertising profiles. Please avoid sharing names, contact details or information about other people in the chat.

Who We Share Data With

We share personal data only with trusted service providers that help us run the Service and are bound by confidentiality and data protection obligations. They process data on our behalf and may not use it for their own purposes:

• OpenAI — replies of the Nala assistant and short texts in the Service (text only, never face photos);
• WaveSpeed — recognising products from photos of their packaging (product photos only, never face photos);
• Google, via Serper — searching for product details, prices and shops (product names only, no personal data);
• FunnelFox and its payment partners — checkout, subscriptions and payments;
• Brevo — sending service emails such as sign-in links and receipts;
• PostHog — product analytics (how features are used), without face photos or scan images;
• hosting, infrastructure and error monitoring providers.

Face photos and scan results are processed only on our own servers and are not shared with any of these providers.

We do not share your data with cosmetic brands or retailers. If you follow a link to a third-party shop, that shop’s own privacy policy applies to anything you do there.

We may also disclose data where the law requires it, to protect our rights, our users or the public, or to a successor in the event of a merger or acquisition. We do not sell or “share” personal data for cross-context behavioural advertising.

International Transfers

Our providers may process data outside your country, including outside the EEA and the UK. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Storage, Security and Retention

We protect your data with industry-standard measures, including encryption in transit and access controls. Your chat messages and check-ins are visible only to you and, when strictly necessary to help you at your request, to a small number of authorised staff.

We keep your data for as long as your account is active; face photos and scans are kept as described in Face Photos and Scans. You can delete your account at any time in Settings → Privacy: this immediately deletes your profile, face and product photos, scans, routine, shelf and chat, and signs you out. Remaining copies (for example, in backups) are deleted within 30 days, except for records we are legally required to keep (for example, payment and tax records). Deleting your account does not cancel an active subscription — cancel it first in Settings → Subscription.

Your Rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data or have your data deleted;
• restrict or object to certain processing, and withdraw consent at any time;
• data portability;
• opt out of the sale or sharing of personal data (California and other U.S. states — we do not sell or share it);
• complain to your local data protection authority.

To use any of these rights, email [email protected] from the address linked to your account. We reply within 30 days.

Cookies and Similar Technologies

We use essential cookies and local storage to keep you signed in and remember your settings, and analytics technologies to understand how the Service is used. You can manage cookies in your browser settings; turning off essential cookies may stop you from signing in.

Children

The Service is intended only for adults aged 18 and over, and we do not knowingly collect personal data of anyone under 18. Please do not scan anyone else, including children. If you believe a child has given us personal data, please contact us and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be on this page with an updated date at the top, and for significant changes we will also notify you by email or in the Service.

Contact

For any privacy question or request, contact us: