Privacy Policy

Last updated: October 23, 2026

I. INTRODUCTION. REGIONAL PATTERNS (CALIFORNIA)

HeyGorgeous (“we,” “us” or “our”) takes your privacy seriously. This Privacy policy (“Privacy policy”) explains our data protection policy and describes the types of information we may process when you install and/or use the HeyGorgeous software application for mobile devices (the "App", "our App"). The App is operated by wazo ventures UG (haftungsbeschränkt), Eberswalder Straße 32, 10437 Berlin, Germany.

When we refer to personal data (or personal information) we mean any information of any kind relating to a natural person who can be identified, directly or indirectly, in particular by reference to such data. It is a natural person who can be identified directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social status.

Our Privacy policy applies to all users, and others who access the App (“Users”). For the purposes of the GDPR, we are the data controller, unless otherwise stated.

PLEASE READ THE FOLLOWING PRIVACY POLICY CAREFULLY, FOR INFORMATION REGARDING THE WAYS YOUR PERSONAL INFORMATION MAY BE PROCESSED.

WHEN YOU USE THE APP YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THESE TERMS.

IF YOU ARE A CALIFORNIA RESIDENT PLEASE READ THE FOLLOWING IMPORTANT NOTICE

Under the California Consumer Privacy Act (CCPA), as amended, California residents have the right to request:

• the categories of personal information that is processed;
• the categories of sources from which personal information is obtained;
• the purpose for processing of user personal data;
• the categories of third parties with whom we may share your personal information;
• the specific pieces of personal information that we might have obtained about particular user provided that the data given in the request is reliable enough and allows to identify the user.
• Please use the navigation links through this Privacy Policy:

PERSONAL INFORMATION

All about the categories of information, its sources and purposes of processing: see Sections II and III.

Please mind that according to CCPA personal information does not include de-identified or aggregated consumer information.

SHARING

How your information can be shared: see Section IV.

Please note that all third parties that are engaged in processing user data are service providers that use such information on the basis of agreement and pursuant to business purpose.

OPT-OUT OPTIONS

If you don’t want us to process your personal information any more please contact us through the email support@heygorgeous.app. You can also delete your account in the App (Settings > Delete Account).

In most cases there is no way to maintain the App’s further operating without functional data therefore you will be advised to remove the App from your device. If you don’t want us to share device identifiers with service providers please check your device settings to opt out as described in Section VIII.

REQUESTS

To submit a verifiable consumer request for access, portability or deletion personal data please contact us through the email support@heygorgeous.app.

Please include in the text of your appeal the wording "Your rights to maintain confidentiality in the state of California”.

When submitting a verifiable request, you should be ready to:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which may include: name, address, city, state, and zip code and email address. We may use this information to surface a series of security questions to you to verify your identity. If you are making a request through an authorized agent acting on your behalf, such authorized agent must provide written authorization confirming or a power of attorney, signed by you.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We will not be able to respond to your request or provide you with personal information if we cannot: (i) verify your identity or authority to make the request; or (ii) confirm the personal information relates to you. We may ask you for additional information or documents to verify your identity. We may also carry out checks, including with third party identity verification services, to verify your identity before taking any action with your personal information. This is regarded as a safeguard measure to prevent disclosure of your personal information under a fake or scum request.

We ensure that personal information provided in a verifiable consumer request will be used only to verify the requestor’s identity or authority to make the request and not for any other purpose. We will keep it for the adequate term reasonably needed for the purpose described above and delete after the purpose is fulfilled.

We try to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period in writing. Please note that we are only required to respond to two requests per customer each year.

EQUAL RIGHTS

Nothing in the way we deal with your request shall be interpreted as discrimination, which means that we will not set up different pricing or products, or different level or quality of services for you, if you choose to exercise your rights. However, in some circumstances, we may not be able to provide services if you choose to delete your personal information from our records.

SALE OF DATA

We do not sell any of your personal data to third parties.

II. INFORMATION WE PROCESS

There are several categories of information that can be processed.

Functional Information

We process the following personal information about you when you use the App. This information is necessary for the adequate performance of the contract between you and us. Without such information it is impossible to provide complete functionality of the App and perform the requested services. What data can be processed:

• Content Information, i.e. photos, pictures and other data - when you take or upload them using the App for a scan or in the chat. Photos you use for a scan are sent to our AI providers (OpenAI and AILab) and stored with our hosting provider (Firebase, Google), as described in Sections II (Face Data), IV and VI.
• Analysis Results, i.e. the results of your scans (for example face shape, facial proportions, skin and color analysis and the resulting beauty recommendations). They are stored with our hosting provider (Firebase) and linked to your anonymous user ID so that you can see your scan history.
• Chat Content, i.e. the messages (and, if you add them, images) you send in the App’s beauty chat. They are sent to OpenAI to generate the answer and stored with our hosting provider (Firebase) so that your chat history is available. If you use voice input in the chat, speech recognition is performed by Apple’s speech recognition service.
• Profile Information, i.e. the age and gender you select during onboarding. They are stored on your device and may be included, together with your region code, in the requests we send to OpenAI so that chat answers fit you.
• Account Information. The App does not require a name, e-mail address or password. When you first open it, it creates an anonymous account (random user ID) with Firebase Authentication. We store with this ID, among others, your scan credits, invitation code and number of invitations, push notification ID and subscription renewal date.
• Contact Information (name, e-mail address, as well as any other content included in the email) which you may fill in by yourself when you contact us via email, support form. We use such information to respond effectively to your inquiry, fulfill your requests, and send you communications that you request.

Information That Is Processed Automatically

When you use the App, some information about your device and your user behavior may be processed automatically. This information is generally non-personal, i.e. it does not, on its own, permit direct association with any specific individual, and we may access it only in aggregated form. However, it is linked to your anonymous user ID, so it may be personal data. We process this information on the ground of our legitimate interest in improving our App and giving our users the best experience. If we do not access such data we may not be able to provide you with all the features of the App.

We use third-party automatic data processing technologies to analyze certain information sent by your device via our App (analytics, attribution and app-monitoring tools, see Section IV). Some of them launch automated processing of your personal data, including profiling, which means any form of automated processing of personal data used to evaluate certain personal aspects relating to you, in particular to analyze or predict aspects concerning your personal preferences, interests, behavior, location or movements (see the list of data described below). Processing information through automatic data processing technologies starts automatically when you first time launch the App.

• Device Details. When you use a mobile device (tablet / phone) to access our App, some of details about your device are reported, including “device identifiers”. Device identifiers are small data files or similar data structures stored on or associated with your mobile device, which uniquely identify your mobile device (but not your personality). Device identifier enables generalized reporting or personalized content by the third parties.
  
  What data can be processed:
  • Information about the device itself: type of your device, type of operating system and its version, model and manufacturer, screen size, screen density, orientation, device memory usage.
  • Information about the internet connection: mobile carrier, network provider, network type, IP address, timestamp and duration of sessions, speed.
  • Location-related information: IP address, the country code/ region associated with your device, language setting, time zone. The App does not access your precise location.
  • Device identifiers: Identifier for Vendors (IDFV), Identifier for Advertisers (IDFA, only if you allow tracking when the App asks), and the user ID of the anonymous account we assign to you.
• Information about the applications. Name, API key (identifier for application), version, properties of our App can be reported for automated processing and analyzes.
• Cookies and similar technologies. The App itself does not use browser cookies. The software development kits (SDKs) of the providers listed in Section IV use similar technologies (device identifiers, scripts) to operate. When you visit our website or links in the App, cookies and similar technologies may be used (pixels, web beacons, scripts). A cookie is a text file containing small amounts of information which is downloaded to your device when you access a website. We use aggregated information to understand and optimize how our App is used and to improve our marketing efforts.
• Log file information. Log file information is automatically reported each time you make a request to access the App. When you use our App, analytics tools automatically record certain log file information, including time and date when you start and stop using the App, and how you interact with the App.
• Screen recordings (session replay). We use Smartlook to record how the App is used (screens and touch interactions) so that we can find usability problems. Recordings show what is displayed on the screen and may therefore include content displayed in the App, such as your photo or your results. They are linked to your anonymous user ID.
• Attribution information. To find out which of our marketing campaigns led to an install, we receive from AppsFlyer information such as the campaign and source that led to the install, the date and time of the install and of in-app events, and device identifiers.
• In-app events. When you use our App, analytics tools automatically record your activity information (screens viewed, taps on buttons, tutorial steps, scans started or completed, paywall views, purchases, errors, custom events).

Information provided automatically to analytics or attribution tools is processed by those providers under their own privacy policies, therefore we cannot be responsible for processing such information. Please mind that some services may be engaged in personal data profiling and may obtain information related to your personality and/or your device by using technologies that do not belong to our scope of responsibility. We do not control, supervise or stand surety for how the third parties process your personal data, that might be collected by their own means (not through our App). Any information request regarding the disclosure of your personal information should be directed to such third parties (see Section IV).

Payment Information

Our e-commerce provider (Apple) is responsible for billing, processing and charging for the in-app purchases, handles your personal information and keeps it absolutely safe and secure. We cannot access or use you credit or debit card information. We use Adapty to manage subscriptions: Adapty receives your purchase and subscription status (not your payment card data) linked to your anonymous user ID. You may access the applicable “in-app” purchase rules and policies directly from the App Store.

Face Data Collection & Usage

What we collect and why. When you start a scan, the App uses the photo you take or select to analyze your facial proportions and landmarks, face shape, skin and colors, and to give you personalized beauty recommendations. This is facial data, which some laws treat as sensitive or biometric information. We use it only for these features. We do not use it to identify you, to match you against other people or databases, or for advertising.

It is not processed only on your device. To produce the analysis, the photo leaves your device (over encrypted connections): it is sent to OpenAI (AI image analysis; your answers to the in-App questions may be sent with it) and to AILab (detection of facial landmarks). Both providers process the photo on their servers to return a result to the App.

Storage. The photo and the analysis results are also stored with our hosting provider, Firebase (Google), linked to your anonymous user ID, so that you can see your scan history. They are not stored in a form that contains your name or e-mail address, because the App does not ask for them.

Retention and deletion. We keep your photos and results until you delete them or ask us to delete them (see Sections VI and VII). You can delete individual scan results in your scan history in the App and your account in Settings > Delete Account. To have the photos and results stored on our servers erased, contact us at support@heygorgeous.app. AILab states in its privacy policy that images sent through its API are deleted after processing; OpenAI may keep data sent through its API for a limited period to detect abuse (see the providers’ policies in Section IV).

Sharing. We share facial data only with the service providers named above (OpenAI, AILab, Firebase/Google), only to provide the scan feature and to store your results. We do not sell it. We do not use your photos to train our own AI models. OpenAI states that data sent through its API is not used to train its models unless the customer opts in; AILab states that it does not use uploaded content for model training. If you are in a jurisdiction that requires your consent to process facial data, by taking or uploading a photo for a scan you request this processing; you can stop at any time by not using the scan feature and by deleting your data.

III. THE PURPOSES OF PROCESSING YOUR PERSONAL DATA

Our mission is to constantly improve our App and provide you with new experiences. As part of this mission, we use your information for the following purposes:

(a) To make our service available. We use the functional information and information that is processed automatically to provide you with all requested services, including AI-based analysis of your photos and answers in the chat, storing your scan history and managing your subscription.

(b) To improve, test and monitor the effectiveness of our App. We use the information that is processed automatically to better understand user behavior and trends, detect potential outages and technical issues, to operate, protect, improve, and optimize our App.

(c) To measure and improve our marketing. We use attribution information that is processed automatically to learn which of our marketing campaigns lead to installs and purchases. The App does not show third-party advertising.

(d) To communicate with you. We use the information we have to send you push notifications (only if you allow them in your device settings), receive your feedback about our App experience, and let you know about our policies and terms. We also use your information to respond to you when you contact us.

We periodically seek direct feedback from users through online forms and user interviews. In these cases we use forms or other means to collect personal information from you. This information will only get used for the research purpose and deleted afterwards.

(e) To prevent fraud and spam, to enforce the law. We really want our App to be free of spam and fraudulent content so that you feel safe and free. We may use your information to prevent, detect, and investigate fraud, security breaches, potentially prohibited or illegal activities, protect our trademarks and enforce our Terms of Use.

If any new purposes for processing your personal data arise we will let you know we start to process information on that other purpose by introducing the corresponding changes to this Privacy policy.

IV. SHARING OF YOUR INFORMATION

We share your photos and chat content with the service providers listed below only to provide the features you request (see “Face Data Collection & Usage” in Section II).

We will not rent or sell your personal data to any third parties, but we share your information with third-party organizations that provide AI analysis, hosting, automatic data processing technologies, subscription management and push notifications for the App, as listed below.

We do not show third-party ads in the App. Attribution data is used to measure our own marketing.

In case you want to learn more about these services and their privacy options (including opt-out) please consult the correspondent websites and privacy policies. We are not responsible for any usage of your personal data by the abovementioned third parties in violation of our instructions.

Our App may contain links to third-party websites/services or you may access the App from a third-party site. We are not responsible for the privacy practices of these third-party sites or services linked to or from our App, including the information or content contained within them.

We may disclose your personal information if it is needed for objective reasons, due to the public interest or in other unforeseen circumstances:

• as required by law;
• when we believe, in good faith, that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
• if we are involved in a merger, acquisition, or sale of all or a portion of our assets, you will be notified via email and/or a prominent notice in our App of any change in ownership or your personal information usage, as well as any choices you may have regarding your personal information.

V. INTERNATIONAL DATA TRANSFERS

We work in the cross-border area and provide our App to our Users around the world.

We and third-party organizations that provide AI analysis, hosting and automatic data processing technologies for the App may transfer the information, including photos and chat content, across borders and from your country or jurisdiction to other countries or jurisdictions around the world, in particular to the U.S.A.

If you are located in the European Union or other regions with laws governing data processing that may differ from U.S. law, please note that we may transfer information, including personal information, to a country and jurisdiction that does not have the same data protection laws as in your jurisdiction. This means that your personal information can be transferred to a third country, a territory or one or more specified sectors within that third country, or to the international organization where data protection and confidentiality regulations may not provide the same level of protection of personal data as your country does.

We try to make sure that the recipient of any personal data provides a proper protection of the personal data received, in accordance with the current legislation on the protection of such information. By using the App, you agree that we may transfer your personal data to any third country, a territory or one or more specified sectors within that third country, or to the international organization.

For the purposes of data storage, we recourse to the services of the hosting organizations (Firebase, Google). We take your privacy seriously and, therefore, data is encrypted in transit and - if possible - before sending it to the hosting organizations for the purposes of its storage. Please note that we cooperate only with those hosting organizations that have passed our security and reliability check.

VI. HOW LONG WE USE YOUR PERSONAL DATA

We generally retain your personal information for as long as is necessary for performing the functional service of the App and to comply with our legal obligations. In particular, photos, scan results and chat history stored with our hosting provider are kept until you delete them or ask us to delete them. You can delete individual scan results in your scan history in the App. If you delete your account in the App (Settings > Delete Account), your anonymous account is removed and you are signed out; to have the photos, results and chat history linked to it erased from our servers, please also contact us at support@heygorgeous.app.

If you no longer want us to use your information that we physically access and store, you can request that we erase your personal information and close your account. However, some data may still be stored for a certain time period (but no longer than the storage purpose requires) if information is necessary to comply with legal obligation (taxation, accounting, audit) or in order to maintain safety and data backup settings, prevent fraud or other malicious acts. Data held by analytics, attribution, subscription and push notification providers is kept according to their own policies (see Section IV).

VII. EXERCISING YOUR RIGHTS

Applicable data protection laws give you certain rights regarding your personal information. You have the following options in relation to your personal information that was collected:

• Data Access and Portability. You can request copies of your personal information.
• Change or Correct Data. Where you cannot update data by yourself through your account, you have the right to ask to correct change, update or rectify your data.
• Data Retention and Deletion. The user data is generally retained for as long as your user profile is in existence or as it is needed to provide the relevant services. However, specific retention times can vary based on context of the processing performed. You have the right to ask to delete all or some of the personal data that is held about you. You can delete your account in the App (Settings > Delete Account) and contact us to have the data stored on our servers erased (see Section VI).
• Restriction of Processing and Objection. Under certain circumstances, you may have the right to limit the ways in which your personal information is used or to object to it.
• Complaint. If you are in the European Union, you may lodge a complaint with your local data protection authority.

To exercise any of the rights described above, you can contact us at support@heygorgeous.app. To help us find your data, please describe your request in as much detail as possible (the App has no name or e-mail account, so we may ask you for details such as your device model and the approximate date of your scans). Please bear in mind that we ensure the above mentioned rights only with respect to the information that we physically access and store.

California residents. In addition to the options above, the CCPA gives California residents the right to know what personal information we collect, use and disclose, to request deletion and correction of it, to opt out of the sale or sharing of personal information, and not to be discriminated against for exercising these rights. We do not sell your personal information. You can limit the sharing of device identifiers for advertising measurement by declining the tracking request in the App or turning tracking off in your device settings (see Section VIII). You may use an authorized agent to submit requests, as described in Section I. This Privacy Policy is a general description of our practices and is not legal advice.

When your personal information is processed automatically you may object to such processing in some circumstances. Where your personal information is processed for direct marketing purposes, you may ask to cease processing your data for these direct marketing purposes. In order to exercise your right please contact the third party services listed in the Section IV of this Privacy Policy to learn how you can object to processing your data. Most of them have clear instructions on their privacy pages, functional API or other options.

VIII. HOW TO OPT OUT

Opt-out of marketing tracking

If you don’t want third-party service providers to use your device identifier (IDFA) for attribution and measurement please follow the instructions below:

• Decline the tracking request (“Allow … to track your activity across other companies’ apps and websites?”) when the App shows it, or turn off “Allow Apps to Request to Track” in your iOS device Settings > Privacy & Security > Tracking, please find additional information here: https://support.apple.com/en-us/HT212025.

You can also visit https://youradchoices.com for the same purpose.

Opt-out of Location Data Processing

The App does not ask for access to your precise location. Information about your country or region is derived from your device’s region and language settings and your IP address and cannot be switched off in the App; if you don’t want this, please do not use the App.

Opt-out of push notifications, camera and microphone

You can turn off push notifications, camera access and microphone / speech recognition access for the App at any time in your device Settings > HeyGorgeous. Without camera access you can still select a photo from your library for a scan.

IX. SECURITY

The security of your personal information is highly important to us. We follow generally accepted industry standards to protect the personal information, both during transmission and once we receive it.

We take reasonable and appropriate measures to protect personal information from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into account the risks involved in the processing and the nature of the personal information.

We implement appropriate technical and organizational measures, which are designed to implement data-protection principles, such as data minimization, in an effective manner and to integrate the necessary safeguards into the processing. We seek your personal data to be encrypted with proper and strong encryption algorithms, including hashing where possible.

Unfortunately, no method of transmission over the Internet, or method of electronic storage, is 100% secure. We do our best to protect your personal data, nevertheless, we cannot guarantee its absolute security. In the event that your personal information is compromised as a breach of security, we will promptly notify you in compliance with applicable law.

If you have any questions about security of our App, you can contact us at through the email below.

X. CHILDREN’S PRIVACY

Our App is designed to provide beauty assistance for users aged 13 and above and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently received personal information from someone under 13, or from someone under 18 without the consent of a parent or guardian, we will delete such information from our records. If you are under 18 and have concerns about privacy or data, please discuss them with your parent or guardian. If you have any reason to believe that we may have inadvertently collected information from someone under the age of 13, please reach out to us so we can address the issue.

XI. CHANGES TO THIS PRIVACY POLICY

This Privacy policy is updated regularly.

Whenever we change this Privacy policy, we will post those changes to this Privacy policy and other places that we consider appropriate. Additional forms of notice of modifications or updates as appropriate under the circumstances may be provided to you.

XII. HOW TO CONTACT US

If you have any questions about this Privacy Policy, please feel free to contact us.
wazo ventures UG (haftungsbeschränkt), Eberswalder Straße 32, 10437 Berlin, Germany
support@heygorgeous.app.