Privacy Policy
Version 2.0 · Draft for legal review · Effective: 7 October 2026
This policy explains what personal data Suits My Skin collects, why, who it is shared with, how long it is kept, and what rights you have. It applies to the Suits My Skin iOS app and to suitsmyskin.com.
1. Who we are
Suits My Skin is operated by Ruslan Zhafiarov, an individual based in Kazakhstan (Seyfullina 574/6, Almaty 050013, Kazakhstan) — "we", "us". We are the controller of your personal data.
- Privacy questions and requests: privacy@suitsmyskin.com
- Everything else: support@suitsmyskin.com
2. The short version
- We use your data to tell you whether a product suits your skin, to build your routine and to remind you about it. We do not sell it, we do not show ads, and we do not track you across other apps or websites.
- Some features use artificial intelligence from OpenAI. Before any of your personal data goes to OpenAI, the app asks for your separate permission. You can withdraw it at any time.
- Health information (such as pregnancy or allergies) and face photos are used only with your explicit consent.
- Face photos are deleted 30 days after the analysis; packaging photos 30 days after the scan.
- You can export everything we hold about you, and delete your account, from the app.
3. What we collect
Information you give us
- Account: your email address. If you sign in with Apple, we receive the email Apple shares with us (which may be a private relay address) and an identifier for your Apple ID; we also store, encrypted, a token Apple issues so that we can disconnect Suits My Skin from your Apple ID when you delete your account. If you sign in with Google, we receive your email address and an identifier for your Google account. We do not receive your password for either service.
- Skin profile: skin type, sensitivity, breakouts, pore visibility, skin phototype, sun-protection habits, goals, preferred textures, ethical preferences, ingredients you dislike, routine length, budget, hair type, sex and date of birth.
- Health information: pregnancy or breastfeeding, chronic conditions, diagnosed skin conditions, retinoid use and allergies (cosmetic, food, severe reactions). If you upload blood-test results, the document and the values read from it.
- Photos: face photos you take for skin analysis, and photos of product packaging you scan.
- Your products and routine: your shelf, wishlist, routine steps, reminders and the days you mark them done.
- Support emails you send us.
Information collected as you use the app
- Scans and searches: barcodes you scan and text you search for. If a product is not in our catalog, we look it up with our data providers (see section 6) and keep a record linking the request to your account for 30 days, to apply fair-use limits.
- Device information: a push-notification token, app version, language and time zone. If you use the app without an account, a random device token protected by Apple's App Attest.
- Subscription information: which plan you bought, when it renews or ends, and refunds. Apple processes your payment; we never see your card details.
- Security records: the IP address and device type when you sign in, give or withdraw a consent, or request a data export.
We do not collect your name, phone number, location, contacts or browsing history. We do not use advertising identifiers.
4. Why we use it, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account, sign you in | account, device, security records | performance of a contract |
| Check products against your profile, build routines, reminders | skin profile, products and routine | performance of a contract |
| Take health information into account | health information | your explicit consent |
| Skin analysis from photos | face photos | your explicit consent |
| Send your data to OpenAI for AI features (section 5) | the data listed in section 5 | your consent |
| Recognise products from packaging photos | packaging photos | performance of a contract |
| Subscriptions | subscription information | performance of a contract |
| Fair-use limits, security, preventing abuse | scans and searches, security records, device token | our legitimate interest in keeping the service safe and affordable |
| Proving that you gave or withdrew a consent | consent records with IP address and device type | legal obligation and legitimate interest |
| Answering your emails | email and its content | legitimate interest |
Where we rely on consent, you can withdraw it at any time in Settings → Privacy. Withdrawing does not affect processing that happened before. Some features cannot work without the data they need: for example, without consent to the transfer to OpenAI the app still shows product information and rule-based ingredient warnings, but not the personal fit score or the skin analysis.
5. Artificial intelligence and OpenAI
Some features send data to OpenAI, L.L.C. (USA), whose models generate the text you see. We ask for your separate permission before your personal data is first sent to OpenAI, and the app lists what is sent. Packaging scans and product descriptions do not need this permission: they send a photo of the product or product data, not information about you.
| Feature | What is sent to OpenAI |
|---|---|
| Personal fit score ("Suits you by N %") | the parts of your profile that affect whether a product suits you: skin type and conditions, sensitivity, phototype, sun-protection habits, pregnancy or breastfeeding, chronic conditions, retinoid use, allergies, goals and preferences, your age as a range (for example 25–34), not your date of birth; for hair products, your hair profile. Plus the product's ingredients |
| Skin analysis | your face photos |
| Packaging scan | the photo of the packaging (please keep people out of the frame) |
| Blood-test reading (when available) | the image of the document |
| Weekly routine plan and product suggestions | your profile and your shelf |
| Product description | product data only — nothing about you |
We do not send your email, your account identifier, your sex, lifestyle answers or free-text medical notes. Under OpenAI's API terms, the data is not used to train their models; OpenAI may keep it for up to 30 days to detect abuse and then deletes it. [Legal to confirm against OpenAI's terms on the date of publication.]
Text written by AI is marked "AI" in the app. It can be wrong. It is not medical advice. See the AI Notice.
The fit score is calculated automatically, but it only informs your own shopping choice: it does not decide anything about you that has legal or similarly significant effects.
6. Who we share data with
We share personal data only with service providers who process it for us, under contracts that limit how they use it:
| Provider | What | Why | Where |
|---|---|---|---|
| Railway Corporation | all stored data | hosting of our servers, database and file storage | USA |
| OpenAI, L.L.C. | see section 5 | AI features | USA |
| Apple Inc. | Sign in with Apple; push tokens and notification text; payments | sign-in, notifications, purchases | USA |
| Google LLC | Sign in with Google | sign-in | USA |
| Postmark (ActiveCampaign, LLC) | your email and the message | sign-in codes and service emails | USA |
| RevenueCat, Inc. | your account identifier, App Store purchases and receipts, device and app information | subscriptions | USA |
| The Beauty API | a barcode or search text, nothing about you | product information | Singapore |
| INCI Beauty | a barcode, nothing about you | product ingredients | France |
We may also disclose data if the law requires it, to protect the rights and safety of users or others, or to a successor if the app is transferred — in which case this policy continues to apply to your data.
When you open a store link ("Where to buy"), you leave the app; the store and its affiliate network see your visit under their own privacy policies. We record the click without your account (see the Affiliate Disclosure).
We do not sell your personal data and do not share it for cross-context behavioural advertising.
7. International transfers
Our servers and most of our providers are in the United States, so your data is transferred there and processed under the safeguards in our contracts with those providers [legal to confirm per provider and per country of release]. Suits My Skin is not offered in the European Union, the European Economic Area, the United Kingdom or Switzerland.
8. How long we keep data
| Data | How long |
|---|---|
| Account, profile, products, routine | while your account exists |
| Face photos | 30 days after the analysis; the results (metrics and advice) stay with your account |
| Packaging photos | 30 days after the scan |
| Link between your account and a catalog lookup | 30 days |
| Logs of requests to our providers, including requests to OpenAI | 14 days |
| Cached AI answers | up to 30 days |
| Sign-in sessions | 30 days after last use |
| Consent records | while your account exists, as proof of consent |
| Data export file | 7 days |
| After you delete your account | 30 days, during which signing in again restores the account; then everything is erased, except an anonymised record that the deletion happened |
| Backups | up to 30 days after erasure, until the backup is overwritten |
9. Your rights
Depending on where you live, you have the right to:
- access your data and get a copy (Settings → Account → Export my data);
- correct it (edit your profile at any time);
- delete it (Settings → Account → Delete account);
- restrict or object to processing based on our legitimate interests;
- data portability — the export is a ZIP of JSON files;
- withdraw consent at any time (Settings → Privacy);
- complain to a data protection authority in your country.
California residents. We collect the categories described in section 3, including sensitive personal information (health information, photos), only to provide the service you ask for. We do not sell or share personal information and do not use sensitive personal information to infer characteristics about you. You have the rights to know, delete, correct and not be discriminated against for exercising your rights.
To use a right that is not available in the app, write to privacy@suitsmyskin.com from the email of your account. We answer within one month (45 days for California requests).
10. Security
Data travels encrypted (HTTPS). Face photos, documents and exports are kept in a private storage bucket and are reachable only through short-lived links. Sign-in tokens on your phone are kept in the iOS Keychain. Apple tokens are stored encrypted. Access to production systems is limited to the operator.
11. Age
Suits My Skin is for adults. You must be 18 or older to use it. We do not knowingly collect data from anyone under 18; if you believe a minor has created an account, write to privacy@suitsmyskin.com and we will delete it.
12. Changes
We will update this policy when we change how we handle data. If a change needs a new consent from you, the app will ask for it before the change takes effect. The version and date are at the top of this page.
13. Contact
privacy@suitsmyskin.com · Ruslan Zhafiarov, Seyfullina 574/6, Almaty 050013, Kazakhstan.