Privacy Policy — Skinest

1. Who We Are

Skinest is an AI-powered skin analysis and personalised skincare recommendation platform designed for Indian users. We are the Data Fiduciary under the DPDP Act 2023 and the Data Controller under GDPR. Contact: privacy@yourdomain.com

2. What We Collect

Data	Purpose	Retention
Email address	Account creation, verification OTPs, notifications	2 years after last login
Full name	Personalised recommendations	2 years after last login
City / state	Climate-aware skincare recommendations	2 years after last login
Date of birth	Age-appropriate recommendations	2 years after last login
Skin tone classification	Bias-adjusted AI analysis	2 years after last login
512-dimension skin feature vector	AI skin analysis (no image stored)	1 year
Lifestyle questionnaire answers	Personalised recommendations	2 years after last login
IP address	Security — rate limiting, audit logs	90 days
Device / browser (User-Agent)	Security audit logs	90 days

🔒 Raw face images are never stored. Your camera captures a frame, our on-device model extracts a 512-number mathematical vector, and the image is discarded immediately. The vector cannot be reverse-engineered into a face image.

3. How We Use Your Data

✓Provide AI skin analysis and product recommendations — Legal basis: Contract performance
✓Send email verification OTPs and security alerts — Legal basis: Legitimate interest (security)
✓Improve recommendation accuracy (aggregated, anonymised) — Legal basis: Legitimate interest
✓Fraud prevention and abuse detection — Legal basis: Legitimate interest (security)
✓Analytics on platform usage (PostHog — opt-in only) — Legal basis: Consent
✓Dermatologist review of high-risk cases — Legal basis: Explicit consent at registration

4. Your Rights (DPDP Act 2023 & GDPR)

Right to Access

View all data held about you from Settings → Privacy.

Right to Portability

Download a ZIP of all your data in JSON format. Available in Settings → Privacy.

Right to Erasure

Permanently delete your account and all associated data. Settings → Delete Account.

Right to Correction

Update your profile at any time in Settings → Profile.

To exercise any right, use the Settings page or email privacy@yourdomain.com. We will respond within 72 hours as required by the DPDP Act.

5. Who We Share Data With

Data	Purpose	Retention
Groq API	AI recommendation generation	No personal data sent — only anonymised skin profile
Pinecone	Product similarity search	Only product embeddings — no user data
AWS S3 (Mumbai region)	Temporary document storage	DPA in place; data never leaves ap-south-1
SendGrid	Transactional emails	Email address only; DPA in place
Sentry	Error monitoring	Stack traces only; PII scrubbing enabled

We never sell, rent, or share your personal data with advertisers or data brokers.

6. Security Measures

•Passwords hashed with bcrypt (cost 12) — plaintext never stored
•JWTs signed with RS256 — private key never leaves the server
•All data in transit encrypted with TLS 1.3
•PostgreSQL data encrypted at rest (AES-256)
•Admin access requires two-factor authentication (TOTP)
•IP allowlist on admin routes
•Audit log on every data-modifying action
•Annual penetration testing

7. Cookies

Cookie	Type	Purpose	Expiry
next-auth.session-token	Essential	Authentication session — httpOnly, Secure, SameSite=Lax	7 days
__csrf	Essential	CSRF protection — double-submit pattern	1 hour
ph_*	Analytics (opt-in)	PostHog product analytics	1 year
skinest_cookie_consent	Essential	Stores your cookie preference	1 year

You can change your cookie preference at any time via the consent banner or Settings → Privacy.

8. Changes to This Policy

We will notify you by email at least 30 days before any material change. The "Last updated" date at the top of this page reflects the most recent revision. Continued use after changes constitutes acceptance.

Contact Our Privacy Team

For privacy requests, data subject access requests, or concerns:
privacy@yourdomain.com
We respond within 72 hours.