The short version
This policy is written to be read. If you only read one section, read this one - the rest of the document says the same things with the precision the law requires.
- Your photograph is analysed to produce your report, and is not used to train our models unless you separately opt in.
- We do not sell your personal data, and we do not share it for advertising.
- You can delete your account and everything in it from inside the app, at any time, without contacting us.
- Facial scan data is sensitive personal data. We treat it that way.
Saundarya AI produces cosmetic guidance. It is not a medical device and does not diagnose disease. See the medical disclaimer.
Who we are
Saundarya AI is operated by [TODO: registered company name, e.g. Saundarya Technologies Pvt Ltd] ("we", "us"). We are the data controller for the personal data described in this policy - we decide what is collected and why.
- Contact
- contact@saundaryaai.com
What we collect
Photographs and facial analysis data
When you run a scan, you provide a photograph of your face. From it our systems derive facial geometry measurements, skin attributes and the scores that appear in your report. Under India's DPDP Act and the GDPR this is sensitive personal data, and in some jurisdictions it is biometric data.
Account data
- Your name and email address
- An encrypted password hash - we never store your password itself
- Your subscription status and payment history
Technical data
- Device model, operating system version and app version
- IP address, used for security and approximate region only
- Crash reports and error diagnostics
- Website usage analytics - page interactions and scrolling, via Microsoft Clarity, on the website only
We do not collect your contacts, your location beyond approximate region, your camera roll beyond the photographs you choose to submit, or any advertising identifier.
Why we use it, and on what basis
We process each category of data for a stated purpose and on a stated legal basis. Where the basis is consent, you may withdraw it at any time.
- Producing your report
- Performance of our contract with you
- Storing your scan history
- Performance of our contract with you
- Taking payment
- Performance of our contract with you
- Security, fraud prevention and abuse detection
- Our legitimate interests
- Fixing crashes and improving reliability
- Our legitimate interests
- Improving our models using your photographs
- Your explicit consent - off by default
- Marketing email
- Your consent - off by default
Model training
Your photographs are not used to train or fine-tune our models unless you turn that setting on. It is off by default, it is a separate choice from using the service, and refusing it does not reduce what the app does for you.
If you do turn it on, you can turn it off again at any time. Doing so stops any further use of your images and removes them from future training sets. Models already trained cannot be un-trained, and we say so plainly rather than implying otherwise.
Who we share it with
We do not sell personal data. We share it only with the processors below, each bound by contract to use it solely for the service they provide to us.
- Cloud hosting and storage
- Operating the service and storing your data
- Payment processing (Razorpay)
- Taking payment. They receive your payment details; we do not store your card
- Crash and error reporting
- Diagnosing faults
- Microsoft Clarity (website analytics)
- Understanding how the website is used. Runs on the website only, not in the app
- Email delivery
- Sending transactional email such as password resets
We may also disclose data where the law compels it - a valid court order or lawful demand from a competent authority. Where we are permitted to tell you about such a demand, we will.
How long we keep it
- Submitted photographs
- Retained while your account is open, so you can reopen past reports. Deleted with your account
- Reports and scan history
- Retained while your account is open
- Account record
- Deleted within 30 days of your deletion request
- Payment and tax records
- Retained as long as tax and companies law requires, typically 8 years, regardless of account deletion
- Backups
- Purged on the ordinary backup cycle, no later than 90 days
Payment records are the one category we cannot delete on request: retaining them is a statutory obligation, not a choice. They contain transaction records, not your photographs.
Your rights
Wherever you live, you can exercise all of the following. We do not operate a two-tier system where some users get fewer rights than others.
- Access - get a copy of the personal data we hold about you
- Correction - fix anything inaccurate
- Deletion - remove your account and its contents
- Portability - receive your data in a machine-readable format
- Withdraw consent - for model training or marketing, at any time
- Object - to processing carried out on the basis of our legitimate interests
- Complain - to your data protection authority, or to India's Data Protection Board
Deletion is available in the app under Profile. For anything else, write to contact@saundaryaai.com. We respond within 30 days and will tell you if we need longer and why.
Security
- Data is encrypted in transit with TLS and at rest
- Passwords are stored only as salted hashes
- Access to production data is restricted to staff who need it and is logged
- Payment card details never touch our servers - they go directly to our payment processor
No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal data we will notify you and the relevant authority within the timeframes the law sets.
Children
Saundarya AI is not for children. You must be 18 or older to create an account, and we do not knowingly collect data from anyone under 18.
If you believe a child has given us their data, write to contact@saundaryaai.com and we will delete it.
International transfers
Our infrastructure may process data outside your country. Where data leaves its region of origin we rely on the safeguards the relevant law provides, including standard contractual clauses, and we require the same protections of our processors wherever they operate.
Changes to this policy
When this policy changes we update the date at the top. If a change materially affects your rights or how we use your data, we will tell you in the app or by email before it takes effect - we will not rely on you noticing a new date.
Contact us
- contact@saundaryaai.com