Privacy Policy

1. Who we are

Glowinout Limited ("Glowinout", "we", "us") is a company incorporated in Hong Kong with its registered office at 2301, 23/F Bayfield Building, 99 Hennessy Road, Wan Chai, Hong Kong. We are the data controller (in Hong Kong terms, the data user) for the personal data collected through the Glowinout mobile app, the website at www.glowinout.com, and related services (together, the "Service").

This policy explains what data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have. Where we rely on your consent, we ask for it separately, and you can withdraw it at any time.

2. What this policy covers

This policy applies to personal data that we collect through the Service, whether you give it to us directly, it comes from your use of the Service, or it comes from the face-scan feature.

It does not apply to other websites, retailers, brands or platforms that you reach through links in the Service. Their own privacy policies apply. Please read them before you give them your data.

3. Age requirement

The Service is only for people who are 18 or older. You must confirm your age to create an account or to use the face-scan feature. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we delete it as soon as practicable.

4. Data we collect

Account data: your email address, name if you give it, password (stored by our authentication provider in hashed form), age confirmation, and sign-in details if you use Apple or Google sign-in.
Skin questionnaire answers: your skin type, the concerns you want to improve (for example dryness, redness, breakouts or fine lines), your preferences and your routine goals.
Face photos: the photos you take or upload with the face-scan feature.
Scan results: the results generated from your photos and answers, such as scores for visible signs, routine steps, product suggestions and your scan history.
AI Cosmetologist messages: the questions you send to the in-app chat and the answers it generates.
Subscription data: your subscription status, plan, renewal dates and purchase receipts. Payments are processed by Apple or Google. We do not receive your full card details.
Device and usage data: device model, operating system, app version, crash and diagnostic logs, notification tokens, and how you use features of the app.
Support messages: what you send us by email or through the app.
Waitlist data: if you join the launch waitlist on this website, your email address, the date and time you joined, which form and page you used, how you found the page (the campaign tags in the link, such as utm_source, and the name of the website that sent you, without the full address), the country of your IP address, your browser type, and the version of the consent text you saw. See Emails and marketing.

5. Face scans and sensitive information

The face-scan feature is optional. It uses your photos only to give you cosmetic guidance: an overview of visible skin signs, a routine, and product suggestions. It is a consumer lifestyle tool. It is not a medical, diagnostic or treatment service.

To create your skin analysis, your photos are analyzed by trusted AI providers that work for us and, as we build it, by our own AI model. They use your photos only to create your analysis and routine.
We keep your photos and scan results in your account so that you can see your history and compare scans. They stay there until you delete the scan or your account, unless the law requires us to keep them longer.
We do not use face photos or scan results to create a faceprint, a facial geometry template or any other biometric identifier to recognize who you are. If this ever changes, we will tell you first and ask for any consent the law requires.
We never use face photos or scan results for targeted advertising or cross-app tracking, and we never sell them.

If you tell us about a diagnosed skin condition, an allergy or a sensitivity, we use that information only to adjust or limit product suggestions. Where the law treats this as sensitive data, we rely on your explicit consent or another lawful basis that the law allows.

If a law where you live requires a separate biometric notice, a written consent or a published retention schedule (for example, the Illinois Biometric Information Privacy Act or the Texas Capture or Use of Biometric Identifier Act), we will give that notice and meet those requirements.

6. How we use your data

To create and manage your account and let you sign in.
To analyze your photos and answers and create your skin overview, routine and product suggestions.
To save your scan history so you can track changes over time.
To run the AI Cosmetologist chat and the daily tips.
To provide and manage subscriptions and restore purchases.
To send service messages, such as account, security and policy notices, and reminders you turn on.
To keep the Service secure, prevent fraud and abuse, and fix problems.
To understand how the Service is used and improve it, using data that is aggregated or minimized where possible.
To answer your support requests and data protection requests.
To meet our legal obligations.

7. Legal bases

Hong Kong. We collect personal data for lawful purposes directly related to the Service, and only the data that is necessary for those purposes, as the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") requires. We follow all six Data Protection Principles of the PDPO.

United Kingdom and European Economic Area. Where the UK GDPR or EU GDPR applies, we rely on:

Contract: to provide the Service you asked for, including your account and subscription.
Consent: for face photos, scan results and any sensitive information you share, and for launch emails to people on the waitlist. You can withdraw consent at any time; this does not affect processing before you withdraw it.
Legitimate interests: for security, diagnostics and improving the Service, when your rights do not override those interests.
Legal obligation: when the law requires us to process data.

California. We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

We share personal data only when it is necessary, and only with:

Service providers that work for us under contracts that require confidentiality, security and use only for our purposes. These include cloud hosting and storage, authentication, subscription management, email delivery, crash reporting, and AI model providers. To create your scan results and chat answers, we send the needed photos, answers or messages to an AI model provider. You can ask us for the current list of providers.
Apple and Google, which process your in-app purchases under their own terms and privacy policies.
Professional advisers, such as lawyers, auditors and insurers, when needed.
Authorities, such as regulators, courts and law enforcement, when the law requires or permits it.
A buyer or successor in a merger, acquisition or sale of assets, with suitable confidentiality and data protection safeguards.

We do not sell face photos, scan results, health-related information or AI Cosmetologist messages to anyone, and we do not share them for advertising or data brokerage.

9. Emails and marketing

We send service messages as part of the Service, for example about your account, security, subscription or changes to this policy. We send marketing messages only as the law allows and, where required, only with your consent. In Hong Kong, we follow the direct marketing rules in Part 6A of the PDPO. You can opt out of marketing at any time.

Launch waitlist. When you join the waitlist on this website, we keep your email address, when you joined, which form and page you used, the campaign tags in the link you followed (such as utm_source and utm_campaign), the name of the website that sent you (not the full address), the country of your IP address (not the full address), your browser type and the version of the consent text you saw. We use your email address only to tell you when the Glowinout app is available in the App Store and Google Play. We record the other details to show when and how you agreed, to learn which of our posts and channels people find useful, and to stop abuse of the form. We do not sell the list or share it for advertising.

You can leave the waitlist at any time. Use the unsubscribe link in any waitlist email, or email hello@glowinout.com and we will delete your email address from the list. We keep waitlist data until you leave the list, and no longer than 12 months after the app launches.

Face photos, scan results, health-related information and AI Cosmetologist messages are never used for advertising.

10. This website and cookies

This website does not use advertising or analytics cookies, and it does not run third-party tracking scripts. Our web server keeps standard technical logs (such as IP address, browser type and the pages requested) for security and to keep the site running. We keep these logs for a short time only.

If we add analytics or other cookies in the future, we will update this section and ask for your consent where the law requires it.

11. International transfers

We and our service providers may store and process personal data outside the place where you live. When we transfer data internationally, we use reasonable technical, organizational and contractual safeguards. Where the UK GDPR or EU GDPR requires it, we use recognized transfer mechanisms, such as Standard Contractual Clauses. For transfers from Hong Kong, we follow the recommended model contractual clauses published by the Privacy Commissioner for Personal Data.

12. How long we keep data

Face photos and scan results: while your account is active, until you delete the scan or your account.
Account data, routines, chat messages and other saved data: while your account is active, and for up to 30 days after you delete your account.
Backups: up to 90 days, then securely deleted or overwritten.
Purchase records: as long as tax and accounting laws require.
Waitlist data: until you leave the waitlist, and no longer than 12 months after the app launches.

We may keep data longer when the law requires it, to resolve disputes, or to protect the Service from fraud or abuse. If a biometric law where you live sets a shorter period, we follow the shorter period.

13. Your rights

Depending on where you live, you may have these rights:

Hong Kong: to request access to and correction of your personal data under the PDPO. We respond within 40 days of a valid request.
United Kingdom and EEA: to access, correct, delete or restrict your data, to object to processing, to data portability, and to withdraw consent. You can also complain to a supervisory authority, such as the UK Information Commissioner's Office.
California: to know what personal information we collect, to request deletion and correction, to opt out of sale or sharing, and to limit the use of sensitive personal information.
Singapore: to request access to and correction of your data, and to withdraw consent, under the Personal Data Protection Act 2012.
Australia: to access and correct your personal information under the Privacy Act 1988 and the Australian Privacy Principles, and to complain to the Office of the Australian Information Commissioner.

You can delete individual scans in the app. To use any other right, email hello@glowinout.com. We may need to verify your identity first. We respond within the time the applicable law requires.

14. Security

We use reasonable technical and organizational measures to protect personal data, including access controls, encryption in transit, private storage for photos, restricted internal access, and incident response procedures. No system is perfectly secure, so we cannot guarantee absolute security. If a data breach affects you, we will tell you and the authorities as the law requires.

15. Automated processing

The Service uses automated processing, including AI models, to create your skin overview, routine and product suggestions from your photos and answers, and to answer questions in the AI Cosmetologist chat. This processing is for cosmetic guidance only. It does not make decisions that have legal or similarly significant effects on you. Where the law gives you the right to human review, to give your view, or to contest an automated result, contact us.

16. Changes to this policy

We may update this policy. When we make material changes, we will publish the new version in the app and on this website, change the "Last updated" date, and give you additional notice where the law requires it.

17. Contact us

Glowinout Limited
2301, 23/F Bayfield Building, 99 Hennessy Road, Wan Chai, Hong Kong
Email: hello@glowinout.com

You can also contact the Office of the Privacy Commissioner for Personal Data in Hong Kong (www.pcpd.org.hk), the UK Information Commissioner's Office (ico.org.uk), or the Office of the Australian Information Commissioner (www.oaic.gov.au).