Privacy Policy

Protecting your personal data matters to us. This Privacy Policy explains which personal data we process when you use the HairLab app and this website (together, the “Services”), for what purposes and on what legal basis, as well as the rights you have under the General Data Protection Regulation (GDPR) and comparable laws.

1. Controller

The controller responsible for data processing within the meaning of Art. 4(7) GDPR is:

Artemi Polonski (HairLab)
Schleswiger Damm 193D
22457 Hamburg, Germany
Email: artemi.polonski@gmail.com

2. What data we process

2.1 Photos and generated images

HairLab's core function is the AI-powered preview of hairstyles, hair colors and beards. To use it, you upload photos of yourself or take them with your camera. These photos and the previews generated from them are processed in order to:

• analyze your face shape, jawline and hair type,
• generate realistic hairstyle, color and beard previews,
• show you matching style recommendations.

Because biometric characteristics may be derivable from a facial photo, we treat this data with particular care. Processing takes place solely on the basis of your explicit consent (see Section 4) and only to provide the feature you requested. We do not use your photos to identify you, we do not create persistent biometric profiles, and we do not sell them.

2.2 Account data

When you create an account, we process — depending on the sign-in method you choose (Sign in with Apple, Google or email) — your email address or a pseudonymous identifier, as well as a display name if provided. With “Sign in with Apple” you can choose to hide your email address; in that case we receive an anonymized relay address.

2.3 Usage and device information

To provide, secure and improve the Services, we process technical data such as device type, operating system version, app version, language setting, anonymous identifiers and basic log and crash data.

2.4 Purchase and billing data

Purchases and subscriptions (e.g. credits for generations) are handled through the app store platform and our billing provider. In doing so we receive information about the status of your purchase or subscription and an anonymous customer identifier, but no full payment details (e.g. credit card numbers). Those are processed exclusively by the respective app store.

3. Purposes of processing

• providing the AI hairstyle, color and beard preview,
• creating and managing your user account,
• handling purchases, subscriptions and credits,
• ensuring stability, security and abuse prevention,
• improving and further developing the Services,
• complying with legal obligations.

4. Legal bases

• Art. 6(1)(b) GDPR (performance of a contract) — to provide the features you request and to manage your account.
• Art. 6(1)(a) and, where applicable, Art. 9(2)(a) GDPR (explicit consent) — for processing your photos and any biometric characteristics derivable from them.
• Art. 6(1)(f) GDPR (legitimate interests) — for security, abuse prevention and the technical improvement of the Services.
• Art. 6(1)(c) GDPR (legal obligation) — where statutory retention or disclosure obligations apply.

You may withdraw any consent given at any time with effect for the future, without affecting the lawfulness of processing carried out before the withdrawal.

5. Recipients and processors

To provide the Services we use carefully selected service providers that act as processors (Art. 28 GDPR) on our behalf:

• Hosting, database & authentication: Supabase — storage of account and application data.
• AI image analysis & generation: Google (Gemini API) — processing of your photos to create the previews.
• Subscription & credit management: RevenueCat — management of purchase status and entitlements.
• App distribution & payment processing: Apple App Store (and Google Play where applicable).

Where required, data processing agreements are in place with these providers. We do not transfer your data to third parties for their own advertising purposes.

6. International data transfers

Some of the providers named above may process data outside the European Economic Area (e.g. in the USA). In these cases we ensure an adequate level of data protection through appropriate safeguards — in particular the EU Commission's Standard Contractual Clauses (Art. 46 GDPR).

7. Retention period

We store personal data only for as long as necessary for the purposes described above:

• Uploaded photos and previews are kept only for the duration of processing or of the display you requested and are then deleted, unless you choose to save them in your account.
• Account data is stored until you delete your account.
• Billing-related data is retained within statutory retention periods.

8. Account and data deletion

You can delete your account and the associated data at any time directly in the app (Settings → Delete account). Alternatively, contact artemi.polonski@gmail.com. After deletion, your data is removed unless statutory retention obligations require otherwise.

9. Your rights

Under the GDPR you have the following rights:

• access to the data we store about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (“right to be forgotten”, Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing (Art. 21 GDPR),
• withdrawal of consent given (Art. 7(3) GDPR).

To exercise your rights, simply send a message to artemi.polonski@gmail.com. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

10. Data security

We take technical and organizational measures to protect your data against loss, misuse and unauthorized access, including transport encryption (TLS) and access controls. Please note that no method of transmission or storage can offer absolute security.

11. Children

HairLab is not directed at children under 16. We do not knowingly process data of children without parental consent. If you become aware that such data has been provided to us, please contact us.

12. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in the law or in our features. The current version is always available on this page. The date of the last update is shown at the top.

13. Contact

If you have any questions about data protection, you can reach us at artemi.polonski@gmail.com.