Privacy Policy

1. Who we are

SkinMatch AI ("we", "us", "our") is operated by imad ibrahim khalaf khalaf, the seller and data controller responsible for your personal data processed through this service. For any privacy-related questions, contact us via WhatsApp at +964 770 306 6658.

2. Data we collect

• Account data: email address, name, authentication identifiers (e.g. Google sign-in ID).
• Uploaded content: selfies/photos you submit for AI skin analysis and virtual makeup.
• Usage data: number of analyses performed, subscription status, device and browser information, IP address, log data.
• Support data: messages you send us.
• Payment data: processed by Paddle (see Section 5). We do not store full card numbers.

3. Why we use your data (purposes & legal basis)

• To create your account and provide the AI analysis service — performance of contract.
• To enforce the free-tier analysis limit and manage subscriptions — performance of contract.
• To improve the service and prevent fraud or abuse — legitimate interests.
• To comply with legal and tax obligations — legal obligation.
• To send service-related communications — legitimate interests.

4. Photos and AI analysis

Uploaded images are processed by AI models to generate cosmetic recommendations. Images are transmitted securely and used solely to provide the service to you. We do not sell your images or use them to train third-party models.

5. Sharing with third parties

We share personal data only with the following categories of recipients:

• Paddle.com Market Ltd — our Merchant of Record. Paddle acts as reseller, processes payments, handles billing, tax compliance, invoicing, refunds, and customer payment inquiries.
• Cloud infrastructure & database providers — hosting, authentication, and storage.
• AI model providers — to perform the requested image analysis.
• Professional advisers and authorities — where required by law.

6. Data retention

Account and subscription data are retained while your account is active and for a reasonable period afterwards to comply with legal, tax, and accounting obligations. Uploaded photos are retained only as long as needed to deliver results, and then deleted or anonymised.

7. Your rights

Subject to applicable law, you have the right to access, rectify, delete, restrict, or port your data, to object to processing, and to withdraw consent. EU/UK users may lodge a complaint with their local supervisory authority. To exercise any right, contact us using the details above.

8. International transfers

Your data may be processed outside your country of residence by our service providers. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

9. Security

We use appropriate technical and organisational measures including encryption in transit, access controls, and authenticated APIs to protect your data.

10. Cookies

We use strictly necessary cookies and local storage for authentication and to remember your session. We do not use marketing cookies.

11. Changes

We may update this notice. Material changes will be communicated through the service.