Privacy Policy

Percept ("Percept", "we", "us") provides an AI-guided skin, face, and hair analysis service at percept.skin and through the Percept app (together, the "Service"). This policy explains what personal data we collect, why, who we share it with, and the choices and rights you have. It applies to everyone who visits our site or creates an account, regardless of where you're located.

Contact us about anything in this policy, or to exercise any of the rights described below, at support@percept.skin.

Account information. Name, email address, and password when you sign up.

Profile information. Age range, gender, country, skin type and concerns, hair type and concerns, and your current skincare/haircare routine. All are optional beyond what is needed to generate your report.

Photos. The face, skin, and hair photos you capture during a guided scan. These are stored in a private storage bucket, not publicly accessible, and are only ever readable via short-lived signed URLs.

Consultation details. If you book a dermatologist consultation, your phone number and payment details, handled through PayPal.

Usage data. Pages visited, interactions, approximate location, and device/browser type, collected via Google Analytics, Google Tag Manager, and Contentsquare only after you accept analytics cookies in the cookie banner. See Section 8.

Communications. Emails we send you (e.g. a welcome email) are delivered through Resend and logged for delivery purposes.

• To create and secure your account, and to deliver the Service you signed up for.
• To generate your AI skin, face, and hair analysis and report.
• To generate optional hairstyle and eyewear try-on previews you request.
• To process payments for reports and consultations.
• To send service-related email (account confirmation, receipts, report-ready notices).
• To understand aggregate usage and improve the Service, where you've consented to analytics cookies.
• To detect, prevent, and respond to fraud, abuse, and security incidents.
• To comply with legal obligations.

Where the law requires a specific legal basis (for example, under the GDPR), we rely on: your consent for photo processing and analytics cookies; contractual necessity to create your account and deliver reports you've purchased; and our legitimate interest in keeping the Service secure and improving it, balanced against your rights.

Your photos are the most sensitive data you give us, so here's the specific path they take. When you complete a guided scan, your photos are uploaded to a private Supabase storage bucket. To generate your analysis, a signed, time-limited URL to those photos is sent to Anthropic's Claude models. If you request a hairstyle or eyewear try-on preview, your photo is sent to Google's Gemini / Vertex AI models to generate the preview image.

We do not use your photos to train any AI model, ours or a third party's, without asking you separately and explicitly first. Analysis and preview generation are the only uses of your photos unless you opt in to something further.

You can permanently delete your photos and account at any time from Settings, or by emailing support@percept.skin. Deletion removes your stored photos and cascades to your account records.

We don't sell your personal data. We share it only with the service providers ("subprocessors") that help us run Percept, each bound to use your data solely to provide their service to us:

We may also disclose data if required by law, to enforce our Terms of Service, or to protect the rights, safety, or property of Percept, our users, or the public.

Our subprocessors operate globally, which means your data may be processed in countries other than the one you're in, including the United States. Where required, we rely on appropriate safeguards for these transfers, such as standard contractual clauses.

We keep your account, profile, and photos for as long as your account is active. If you delete your account, your photos and profile data are permanently removed from active storage. Payment and consultation records may be retained longer where we're legally required to keep them (e.g. for tax or accounting purposes).

We use a small number of cookies and similar technologies:

• Essential: keep you signed in and remember your cookie choice. Always on; the Service doesn't work without these.
• Analytics: Google Analytics and Google Tag Manager, so we can see aggregate traffic and usage patterns.
• Session replay: Contentsquare, which records on-page interactions (not photo content) to help us fix confusing UI.

Analytics and session-replay cookies only load after you accept them in the cookie banner shown on your first visit. You can change your choice at any time via "Cookie Preferences" in the site footer or in Settings.

Depending on where you live, you have some or all of the rights below. To exercise any of them, email support@percept.skin. We will respond within the time limit your local law requires.

If you're in the EU/UK (GDPR): right to access, correct, erase, or restrict your data; right to data portability; right to object to processing; right to withdraw consent at any time without affecting prior processing; right to lodge a complaint with your local data protection authority.

If you're in California (CCPA/CPRA): right to know what personal information we collect and why; right to delete it; right to correct it; right to opt out of sale or sharing. We don't sell or share your personal information for cross-context behavioral advertising; right to non-discrimination for exercising these rights.

If you're in India (DPDP Act, 2023): as a Data Principal, you have the right to access a summary of your personal data and processing activities, the right to correction and erasure, the right to grievance redressal, and the right to nominate another individual to exercise your rights on your behalf in the event of death or incapacity. For grievances, contact our Grievance Officer at support@percept.skin.

Wherever you are, you can also delete your account and photos yourself at any time from Settings.

Percept is not directed to, and may not be used by, anyone under 18. We don't knowingly collect personal data from minors. If we learn that we've collected data from someone under 18, we'll delete it. If you believe a minor has used the Service, contact support@percept.skin.

Photos are stored in a private, access-controlled bucket and served only via short-lived signed URLs. Passwords are hashed by our authentication provider and never stored in plain text. No method of transmission or storage is 100% secure, so while we work to protect your data, we can't guarantee absolute security.

We may update this policy as the Service evolves. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you directly.

Questions, requests, or complaints about this policy or your data: email support@percept.skin.