Privacy Policy

Last Updated: 29 Aug, 2025

1) Who we are (Data Fiduciary) & how to contact us

2) What data we collect

Account Data: name, email, login credentials.
Face Photo (mandatory): the photo you upload so the Service can function.
Derived Measurements: outputs computed from your photo (e.g., skin tone, undertone, lip pigmentation) used to power features.
Usage & Device Data: interactions, device type, OS/browser, IP-based coarse location, diagnostics, crash logs.
Support Communications: messages you send us (email/forms).
Cookies/Similar Tech: necessary cookies to run the Service; limited analytics as described below.
We do not use your photo for face recognition/identity verification, and we do not use photos to train AI models or sell your photos
Generate digital makeup simulations
Store your past results, preferences, and matched data
Communicate with you regarding your account or support requests
Generate digital makeup simulations

3) Why we process your data (purpose & notice)

We process your data to.
Provide the core Service (tone/undertone analysis, virtual try-on previews, recommendations);
Store your photo in your account to deliver ongoing previews and results;
Run, secure, and improve the Service (diagnostics, abuse/fraud prevention);
Communicate with you about your account and support.

4) Consent, withdrawal & consequences

Consent: By tapping Use My Photo, you consent to uploading and storing your photo in your TrueHue account so we can analyze your tone/undertone and show previews.
Withdrawal / replacement: You can replace your stored photo anytime in your account.
Deletion route: We delete your stored photo and related previews when you delete your account. Consequence of withdrawal: The Service will not function without a face photo. If you withdraw by deleting your account, we erase your stored photo as above.
(If you later choose to offer a “Delete my photo” button without closing the account, you can add it here.)

5) Children

The Service is for 18 years and older only. We do not knowingly collect children’s data.

6) Sharing with service providers (Processors)

We do not sell or rent personal data. We share limited data with service providers who operate infrastructure for us (e.g., secure cloud hosting/storage, logging, email). They act under contracts that require confidentiality and security and may only process data to provide services to TrueHue. We may disclose data if required by law or to protect rights, safety, or the integrity of the Service.

7) Where we process & transfers

We primarily store and process data in India (for example, on cloud infrastructure located in ap-south-1). If we ever transfer personal data outside India, we will do so in accordance with the DPDP Act and any notified restrictions, and we will update this Policy accordingly

8) Retention

Account & Photo: kept while your account is active; deleted on account deletion.
Derived Measurements & Previews: deleted with account deletion. Security/diagnostic logs: typically ~90 days, unless needed longer to investigate abuse/security incidents. Support communications: up to 24 months after resolution (for audit/compliance). We may retain minimal records if required by law (e.g., fraud prevention, legal claims).

9) Security safeguards

We use reasonable technical and organizational measures appropriate to the risk, including encryption in transit, strict access controls, least-privilege IAM, network isolation, monitoring, and secure key management. No system is 100% secure; please keep your credentials confidential.

10) Cookies & similar technologies

We use necessary cookies to operate the Service. If we use analytics cookies, we will display a banner to obtain your consent and provide controls to manage preferences.

11) Your rights under the DPDP Act

Subject to applicable conditions, you can:
Access your personal data and know how we process it;
Correct inaccurate or misleading data;
Erase personal data in accordance with law (see the deletion route above);
Grievance redressal: contact the Grievance Officer (details in Section 1);
Nominate: designate another person to exercise your rights in the event of your death or incapacity (write to us to set this up).
To exercise rights, email privacy@truehue.ai (or the Grievance Officer). We may request information to verify your identity.

12) Automated processing

We analyze images to generate cosmetic previews and tone/undertone outputs. We do not use automated decision-making that has legal or similarly significant effects on you.

13) Changes to this Policy

We may update this Policy. We’ll post the new date above and, if changes are material, notify you via the Service or email.

14) Contact