Privacy Policy
Last updated: 27 September 2026
1. Controller
BeautyVIA (“we”, “us”) is an AI virtual try-on service for hairstyles and looks. The data controller for personal data processed via this website, cabinet, and salon QR pages is:
- Operator: BeautyVIA operator
- Address:
- Privacy email: beautys.studio.ai@gmail.com
Fill LEGAL_OPERATOR_NAME / ADDRESS in server env before production so this block shows your registered name (company or sole trader).
2. Data we process
- Account data: email, display name, password hash (or Google account id), plan and credit balance, billing customer id.
- Photos: images you or salon guests upload for try-on, and generated result images.
- Usage data: try-on history (style, time, guest label for QR), technical logs, and hashed network identifiers for abuse limits.
- Payment data: handled by Stripe (we store plan, credits, and Stripe customer/subscription ids — not full card numbers).
- Cookies / local storage: see section 8.
3. Purposes and legal bases (GDPR)
- Contract (Art. 6(1)(b)): provide try-on, accounts, QR guest sessions, and paid plans/credits.
- Legitimate interests (Art. 6(1)(f)): security, rate limits, abuse prevention, service reliability, basic product diagnostics.
- Legal obligation (Art. 6(1)(c)): tax/accounting records where required (via Stripe).
- Consent (Art. 6(1)(a)): only if we add optional non-essential cookies or marketing later — you can refuse them in the cookie bar. Today we only use essential product cookies.
4. Photos and biometric-sensitive content
Uploaded face photos and AI results are processed to deliver try-on (including calls to our AI image provider). Session photos expire with the try-on session. Owner history images are kept about 10 days, then deleted by cleanup. Do not upload photos of other people without permission. Photos are not used to train public models by BeautyVIA.
5. Processors and sharing
We use processors needed to run the service. We do not sell personal data.
- Hosting / server: our VPS or cloud host where the app and database run.
- AI image generation: Google Cloud Vertex AI / Gemini (image processing for try-on).
- Payments: Stripe (checkout, invoices, tax when enabled).
- Email: Resend and/or SMTP provider for verification and password reset.
- Sign-in: Google OAuth if you choose “Sign in with Google”.
- Salon owners: when you use a salon QR link, that salon can see try-on history billed to their account (about 10 days).
6. International transfers
Some processors (for example Google Cloud / Stripe) may process data outside your country, including the US/EEA. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses offered by those providers.
7. Retention
- Account data: while the account is active, then deleted or anonymized on request where legally possible.
- Try-on session files: until session expiry.
- Generation history: about 10 days.
- Security / abuse logs: longer if needed for security.
- Billing records: as required by tax/accounting law (via Stripe).
9. Your rights (DSAR)
If GDPR applies to you, you may request: access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. You may also withdraw consent where processing is consent-based, and lodge a complaint with your local supervisory authority.
To submit a data-subject request, email beautys.studio.ai@gmail.com with the subject “Privacy request”, your account email, and what you need. We aim to respond within 30 days. We may need to verify your identity.
10. Children
The service is not directed at children under 16. Do not create an account or upload photos of minors without lawful authority and consent where required.
11. Contact
Privacy: beautys.studio.ai@gmail.com. Support: same inbox unless otherwise stated in your plan.