Privacy Policy

Skinmate AI is operated by Webspero. For information about merchants and their stores, we decide how it is used and act as the controller.

For information about shoppers that the App processes on a merchant’s store, we act as a service provider (processor) on that merchant’s behalf. The merchant is the controller, and their own privacy policy also applies. Merchants should tell their shoppers that the store uses a skin advisor that analyses photos.

Merchants are responsible for their customers’ data at their level. This includes describing the skin advisor in the store’s own privacy policy, obtaining any consent their customers’ local laws require, and responding to their customers’ privacy requests. We support merchants with these requests as described below.

From Shopify, when a merchant installs the App

With the permissions the merchant approves at install, Shopify’s APIs give us access to:

• Store details: store name, Shopify domain, primary domain, Shopify store ID, currency and time zone.
• Product catalog: products, variants, collections, titles, descriptions, tags, product types, options, metafields, prices and availability. The merchant chooses which collections or products the App may use.
• Online store: the store’s themes, to check that the advisor block is in place, and the advisor page the App creates when the merchant asks it to.
• An access token that Shopify issues so the App can do these tasks. It is kept on our servers and never sent to shoppers’ browsers.

The App does not request access to the merchant’s orders or customer records.

From merchants directly

• Settings and design choices, such as the advisor’s name, tagline, colours and fonts, and any avatar or welcome images the merchant uploads.
• Catalog and sync choices, data retention settings and a support email if provided.
• Messages the merchant sends us for support.
• Plan and usage information, such as the number of analyses and chat messages. Payments are processed by Shopify. We never receive card details.

From shoppers who use the skin advisor

• A photo: the selfie or image a shopper chooses to submit. See Photos and facial images.
• Skin analysis results: the skin type, visible skin concerns and confidence scores the analysis returns.
• Chat: questions the shopper asks the advisor and the advisor’s replies.
• Interactions: which products were recommended, opened or added to cart, and when.
• A session ID: a random identifier stored in the browser’s session storage, which is cleared when the tab closes. Our servers store only a scrambled (hashed) version of it.
• Technical data: requests reach us through Shopify’s secure app proxy. Our servers may log technical details, such as request times, errors and the store’s domain, to keep the service secure and working.

We do not ask shoppers for their name, email, phone number or address, and we do not link advisor sessions to Shopify customer accounts. The App does not use tracking or advertising cookies.

From visitors to this website

This website does not use analytics or advertising cookies. Our hosting provider may keep standard server logs, such as IP address and browser type, for security.

• The camera’s framing guide runs on the shopper’s own device. Live video is not sent to us.
• A submitted photo is held in memory only, sent to our AI provider to produce the skin analysis, and then discarded. It is never written to our disks or saved in our database.
• To avoid processing the same image twice, we may keep a one-way fingerprint of it with the session. A fingerprint can’t be turned back into the photo.
• Photos are used only to describe visible skin characteristics for cosmetic product recommendations. We do not use them to identify anyone, and we do not create facial recognition templates or other biometric identifiers.
• The analysis is cosmetic guidance, not a medical diagnosis. Shoppers with skin concerns should consult a dermatologist.

• We don’t look at shopper data to decide anything. Our team does not review shopper photos, skin analyses or conversations, and we do not use them to make decisions about any person. The only exceptions are investigating a technical problem or abuse, or helping a merchant who asks us to.
• No discrimination based on facial features. Recommendations depend only on the skin type and visible skin concerns from the analysis, the shopper’s questions and the merchant’s catalog. We never use facial features to identify a person or to infer race, ethnicity, gender or any other protected characteristic, and we never treat shoppers differently because of them.
• Shoppers stay in control of their results. If the analysis looks wrong, the shopper can change their skin type, add or remove concerns, or retake the photo before getting recommendations. Their choices always override the analysis, and recommendations follow what they confirm.
• Never shared with advertisers. We never share photos, facial features, skin analyses or recommendation data with advertisers, ad networks or data brokers, and we never use them to target ads or to recommend products on behalf of advertisers.

• To run the skin advisor: analyse photos, recommend products from the merchant’s catalog and answer questions in chat.
• To show merchants analytics about their advisor, such as sessions, analyses, clicks, cart adds and the skin types and concerns of their shoppers.
• To keep the merchant’s catalog in sync and recommend only products that are available.
• To operate, secure and fix the App, prevent abuse and measure usage for billing.
• To provide support and send merchants important information about the App.
• To comply with the law.

We do not sell personal information, share it for cross-context behavioural advertising, or use shopper photos or conversations to train our own AI models.

Legal bases (EEA and UK): for merchant information we rely on performing our contract with the merchant and our legitimate interests in running and securing the App. For shopper information we process on a merchant’s behalf, the merchant determines the legal basis.

We use OpenAI to analyse photos, write chat replies and search the merchant’s catalog. Photos, chat messages and product details are sent to OpenAI’s API for these tasks.

Under OpenAI’s API terms, data sent through the API is not used to train OpenAI’s models. OpenAI may keep it for a limited period, generally up to 30 days, to detect abuse and, for chat, to continue the conversation.

• Service providers that help us run the App: OpenAI (AI processing), and our cloud hosting and database providers. They may use the information only to provide their services to us.
• Shopify, which hosts the store, routes advisor requests through its app proxy and handles billing.
• The merchant, who sees analytics and session information for their own store.
• For legal reasons: to comply with the law, respond to lawful requests, or protect our rights, users or the public.
• Business transfers: if Webspero is involved in a merger, acquisition or sale of assets, information may transfer as part of that deal, under this policy’s protections.

When a merchant uninstalls the App, shopper access to the advisor stops right away. Shopify then sends us a request to erase the store’s data, normally 48 hours later, and we delete all data for that store. Merchants can ask us to delete it sooner.

Merchants

You can ask to access, correct, export or delete your information by emailing access@webspero.com. You can change your data retention period in the App’s settings at any time.

Shoppers

Advisor sessions are anonymous, so we usually can’t look up a session by your name or email. Closing the browser tab ends your session. For a request about your data, contact the store where you used the advisor, or email us with the store’s name and roughly when you used it, and we will help.

We respond to Shopify’s customer data request and erasure requests. Because the App does not store data linked to Shopify customer accounts, there is usually nothing to return or delete.

Residents of the EEA, UK and similar jurisdictions

You may have the right to access, correct, delete, restrict or object to the processing of your personal information, to receive it in a portable format, and to withdraw consent. You can also complain to your local data protection authority.

Residents of California and other US states

You may have the right to know what personal information we collect and how we use it, and to correct or delete it. We do not sell or share personal information for cross-context behavioural advertising, and we will not treat you differently for using your rights.

We respond to requests within the time required by applicable law.

We and our service providers may process information in countries other than yours, including the United States. Where the law requires it, we use safeguards such as Standard Contractual Clauses for these transfers.

We protect information with encryption in transit, verified Shopify requests, store-by-store separation of data, hashed shopper session IDs and restricted access to our systems. No method of transmission or storage is completely secure, but we work to protect information and fix issues quickly.

The App is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has used the advisor, contact us and we will delete the related data.

We may update this policy as the App changes or the law requires. We will post the new version here with a new “last updated” date, and tell merchants about significant changes in the App or by email.

For questions, requests or complaints about privacy, contact Webspero at access@webspero.com.