Privacy Policy

Important Notice
Misou Skin is NOT a medical service. The data we collect is used to power the autonomous skin layer — not for medical diagnosis, care, or clinical decision-making. If you have medical concerns about your skin, consult a qualified healthcare provider.

1. What We Collect
We collect only data that directly enables a specific feature of the Service. We do not collect data for advertising, profiling, or sale to third parties.

Photos & Skin Reading
Photos you upload are used for skin reading — the system observes your face zone-by-zone to flag patterns, asymmetries, and changes over time. Photos are stored encrypted in private buckets on Supabase and processed by Google's vision service for the visual reading. You can delete photos at any time. Photos are never shared with other users or made public.

Product Data
When you scan a product, the system reads the label, extracts the ingredient list, and stores ingredient data so it can surface information about how the product fits your personal context.

Health & Safety Context
Pregnancy/breastfeeding status, active medications, recent procedures, known allergens, date of birth, and biological sex. This information is classified as sensitive personal data and is used exclusively to surface ingredient information that fits your personal context, and to avoid suggesting routines that conflict with what you have told us. It is never sold, shared for marketing purposes, or used for any purpose beyond personal-context information surfacing. This data is NOT used for medical diagnosis or care.

Usage & Routine Data
Daily routine logs, skin sensation reports, and check-in responses. This data powers pattern detection and routine adaptation over time.

Conversations
Messages between you and your ally are stored to maintain context across days and to extract long-term patterns about your skin. Conversations may contain health-related information you choose to share — this is treated with the same sensitivity as your Health & Safety Context data.

2. How We Use Your Data
Your data is used to: read your skin and track changes over time, read product ingredients alongside your personal context, build and adapt your routines, detect patterns across your skin history, and surface personalized insights. We do not sell your data. We do not use your data for advertising. We do not share your data with other users.

Marketing Communications
Separately from the Service, you can opt in — by an unticked checkbox at signup, or anytime in Settings → Notifications — to receive marketing emails about product updates, early access, and offers. This is a separate consent: we email only addresses that opted in, never share or sell them, and every email carries a one-click unsubscribe. Because it is separate from your account, this subscription continues if you delete your account, until you unsubscribe. Account and security emails (sign-in codes, password resets) are not marketing and are always sent.

3. Data Processors
To deliver the Service, we use a small number of third-party processors: Supabase (database and encrypted file storage), Google (vision processing for skin reading and product label reading), and OpenAI (conversational reasoning and personal-context information review). Data sent to these processors is governed by their enterprise/API data agreements — your data is not used to train their public models. We select processors with enterprise-grade data-handling commitments and review the list annually.

4. Data Storage & Security
Data is stored on Supabase (PostgreSQL + file storage) with encryption at rest and in transit. Your photos live in private storage and are only ever shown to you through your logged-in session — there is no public or shareable link to them. Access to production data is restricted to authorized personnel only.

5. Data Retention
We retain your data for as long as your account is active. If you cancel your subscription, your data is preserved for 12 months in case you resubscribe. If you delete your account, all data is permanently deleted within 30 days. Backups are purged within 90 days of account deletion.

6. Your Rights
You have the right to: access all data we hold about you, correct inaccurate data, export your data in a portable format, delete your account and all associated data, withdraw consent for data processing at any time. Export and deletion are self-serve in Settings → Privacy, consent toggles are in Settings → Privacy, and email preferences are in Settings → Notifications. To exercise any other right, or any of these another way, contact: support@misouskin.com

7. Age Requirement
Users must be at least 16 years old to use Misou Skin. We do not knowingly collect data from anyone under 16. If we learn that we have collected data from someone under 16, we will delete it promptly.

8. Cookies & Analytics
We use essential cookies for authentication and session management. We do not use tracking cookies, third-party advertising trackers, or behavioral profiling tools.

9. Changes to This Policy
We may update this Privacy Policy from time to time. Non-material changes (clarifications, typos, contact details) take effect upon posting, with the "Last updated" date revised. Material changes — including new categories of data collected, new processors, or new purposes of processing — will be communicated via email and in-app notification at least 14 days before taking effect. Where a change introduces a new purpose of processing your sensitive data (Health & Safety Context, photos, or other health-related information), we will request your fresh consent rather than rely on continued use. Previous versions are available on request at support@misouskin.com.

10. Contact
Data protection inquiries: support@misouskin.com