Privacy Policy

1. Data Controller

BeautySpark is the data controller for your personal information.

2. Information We Collect

2.1 Personal Information

• •Name and email address
• •Profile information and preferences
• •Gender identity and date of birth
• •Physical characteristics (height and weight)
• •Account credentials
• •Communication preferences

2.2 Photos and Biometric Data

When you upload photos for AI makeup analysis and recommendations, we collect and process these images. Your photos are used solely for providing our beauty services and are not shared with third parties without your explicit consent.

2.3 Device and Usage Data

• •Device information (device type, operating system, unique device identifiers)
• •Usage patterns and feature interactions
• •Performance data and error logs
• •IP address and general location (country/city level)

2.4 Newsletter Subscription Data

When you subscribe to our newsletter, we collect:

• •Email address
• •Language preference
• •IP address and browser information (as proof of consent)
• •Subscription source (which page you signed up from)
• •Confirmation and unsubscribe timestamps

3. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:

4. How We Use Your Information

• •Provide AI-powered beauty recommendations and analysis (Requires Subscription)
• •Process and analyze uploaded photos for makeup suggestions (Requires Subscription)
• •Maintain and improve our services
• •Communicate with you about your account and our services
• •Ensure security and prevent fraud
• •Comply with legal obligations
• •Analyze usage patterns to improve user experience
• •Send newsletter emails to confirmed subscribers

5. AI Processing and Facial Data

Our AI processes facial features from your photos, which is considered biometric data under UK GDPR.

What We Do:

• •Extract facial landmarks, skin tone, eye shape, and facial measurements
• •Analyze these features to generate makeup recommendations
• •Do NOT use facial data for identification or authentication
• •Do NOT share facial data with third parties (except AI processing services)

Data Retention:

• •Unprocessed photos: Retained until you delete or close account
• •Saved photos in your account: Retained until you delete or close account
• •Analysis results: Retained until you delete your account or close it

Third-Party AI Processors:

We use the following services for AI processing. All processors are bound by data processing agreements (DPAs):

Operational Service Providers (Non-AI):

We also rely on the following providers for operational purposes unrelated to AI processing. These services do not receive your facial data or analysis content. All processors are bound by data processing agreements (DPAs):

6. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

1. 1.Right to Access (Subject Access Request): Request a copy of your data (free, within 1 month)
2. 2.Right to Rectification: Correct inaccurate data
3. 3.Right to Erasure ('Right to be Forgotten'): Delete your data (subject to limitations)
4. 4.Right to Restrict Processing: Limit how we use your data
5. 5.Right to Data Portability: Receive your data in a structured format
6. 6.Right to Object: Object to processing based on legitimate interests
7. 7.Right to Withdraw Consent: Withdraw consent for facial data processing at any time
8. 8.Right to Lodge a Complaint: Complain to the ICO

ICO Contact Information:

7. International Data Transfers

We may transfer your data to countries outside the UK for AI processing and cloud storage.

Transfer Safeguards:

1. 1.EU/EEA: Considered adequate by UK under transition provisions
2. 2.USA: Transfers covered by Standard Contractual Clauses (SCCs) or Data Privacy Framework
3. 3.Other Countries: Individual adequacy assessments and SCCs

You can request information about where your data is transferred and copies of transfer safeguards by contacting [email protected]

8. Data Retention

• •Account data: Retained while your account is active
• •Transaction records: 7 years for tax, legal, and dispute purposes
• •Credit usage logs: 2 years
• •Failed generation records: 1 year
• •Newsletter subscriber data: Retained until you unsubscribe; unconfirmed subscriptions are removed after 30 days

9. Security Measures

We implement appropriate technical and organizational security measures:

• •Encryption of data in transit and at rest
• •Regular security assessments and updates
• •Access controls and authentication requirements
• •Secure data centers and infrastructure

10. Children's Privacy

BeautySpark is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy and updating the "Last updated" date.

12. Linked AI Assistants

You can link your BeautySpark account to ChatGPT, Claude or another AI assistant that supports the Model Context Protocol (MCP). Nothing from your account is shared until you link it and approve the request on our consent screen. The consent screen lists what the assistant is asking for, and it can reach only what you approve:

• •Profile analysis (profile:read): your color season, undertone, eye shape, face shape and language
• •Saved looks (looks:read): your saved looks, the people they are for, and their photos
• •Changing saved looks (looks:write): saving new looks, editing looks and deleting looks
• •Scanned palettes (palettes:read): your scanned palettes and their shades
• •Past generations (generations:read): your past generated looks and their images
• •Try-on (generate): once this feature is available, trying a look on your selfie, which uses your credits. You see the cost and confirm it before anything is charged
• •Staying connected (offline_access): the assistant stays linked without asking you to sign in again, until you disconnect it

Photos and images are shared with the assistant as links that stop working after 15 minutes.

Our public guide tools work without linking an account. They reach only our published articles, never your account.

13. Photos for Try-On Through an AI Assistant

When try-on is available in an assistant, you choose the photos yourself: your saved selfie or a new one, and a reference photo of the look you want to try.

• •We ask for your consent at the point of upload.
• •If the reference photo shows another person, only use it if they have agreed.
• •Your photos are processed by the AI providers listed in section 5, for this purpose only.
• •Photos you upload through an assistant are kept under the same retention rules as photos you add in the app.
• •The before-and-after images are shared with the assistant as links that stop working after 15 minutes.

14. Searches From AI Assistants

Anyone can search BeautySpark guides through an AI assistant, without an account. To learn which questions our guides do not answer yet, we log these searches. Each entry holds:

• •The search text
• •The search filters, such as language, color season and article type
• •The IDs of the top guide sections returned, and how closely the best one matched
• •Which assistant sent the search (ChatGPT, Claude or another assistant)
• •The date and time

Searches are not stored with your IP address, your account or any user ID. Email addresses and phone numbers are removed from the search text before it is stored.

15. Disconnecting an AI Assistant

You can disconnect an assistant at any time. In the BeautySpark app or web app, go to Profile → Connected apps and choose Revoke. The assistant loses access within about 15 minutes.

Deleting your BeautySpark account removes all assistant links.

Contact Us