Biometric & Hair Image Data Notice

Last updated: 2026-05-01

Plain-English summary

  • You can use Cosmixxology only after providing written consent to collect and process your hair/scalp/face imagery for AI analysis.
  • We retain analysis images for up to 365 days from your last interaction; you can delete them sooner from Settings.
  • We do not sell or trade your imagery, and we do not use it to train generative AI models.
  • If you delete your account, we destroy your imagery within 30 days, except as required by law.
  • This notice supplements our Privacy Policy.

1. Why we publish this notice

Several jurisdictions impose specific obligations when a business collects images that depict the human body, biometric identifiers, or biometric information. To be transparent and to comply, we publish this notice in addition to our general Privacy Policy. Relevant frameworks include:

  • Illinois Biometric Information Privacy Act (740 ILCS 14/, "BIPA")
  • Texas Capture or Use of Biometric Identifier statute (Tex. Bus. & Com. Code §503.001, "CUBI")
  • Washington H.B. 1493 (RCW 19.375) and the Washington My Health My Data Act (RCW 19.373)
  • New York SHIELD Act (N.Y. Gen. Bus. Law §899-bb)
  • California Consumer Privacy Act / CPRA, Cal. Civ. Code §1798.140(v) (sensitive personal information)
  • Texas Data Privacy and Security Act (TDPSA, eff. July 2024)

2. What we collect

To deliver hair and scalp analysis we collect, with your written consent:

  • Photographs of your hair, scalp, and (where you choose) your face;
  • Derived measurements and embeddings produced by our AI models — for example, scores for porosity, density, scalp condition, color tone, and texture;
  • Metadata you supply about hair goals, allergies, sensitivities, and product use.

We treat hair-image-derived measurements as biometric information for purposes of this notice, even where local law would not require it, because we believe that is the more protective interpretation.

3. Why we collect it (purposes)

  • To run AI analysis and generate your personalized hair/scalp report;
  • To recommend ingredients and to produce custom formulations;
  • To let you compare results over time (progress tracking);
  • To help connect you with professionals or salons you choose to work with;
  • To detect fraud and abuse of the Services;
  • To comply with legal obligations.

We will not use your imagery for any purpose materially different from those above unless we obtain your additional consent.

4. AI model training — what we will and will not do

We do not use your hair, scalp, or face images to train, fine-tune, or otherwise improve generative or biometric-identification AI models. Our processors operate under terms that prohibit them from using your inputs and outputs to train their own models. If we ever wish to use de-identified imagery for product research, we will obtain your separate, opt-in consent at that time.

5. Your written consent

5.1 What you are consenting to

Before you can upload an image you must check a clear, unbundled consent box affirming that you have read this Notice and that you consent to: the collection, storage, processing, and disclosure (to our processors and to any professional you select) of your hair, scalp, and face imagery for the purposes described above.

5.2 Withdrawing consent

You may withdraw consent at any time. Withdrawal does not affect processing that already occurred while consent was in effect. To withdraw consent, delete your imagery in Settings or email privacy@cosmixxology.com. Withdrawing consent will end your access to features that depend on AI analysis.

5.3 Children

We do not knowingly collect biometric information from children under 13 years of age. For minors above 13 but below the age of majority in their state, a parent or guardian must provide consent on the minor's behalf where state law requires it. (BIPA, for example, requires written parental consent for minors.)

6. Storage, security & access

  • Images are stored in encrypted Azure Blob Storage with access controls.
  • Transmission is protected with TLS 1.2 or higher.
  • Access to raw imagery is restricted to a small number of authorized personnel and to processors operating under written contracts.
  • We log administrative access for audit.

7. Disclosure to third parties

We disclose imagery and derived measurements only to:

  • Our infrastructure providers (Microsoft Azure for storage and compute);
  • Our AI engine, which runs under enterprise/API terms that prohibit use of your content for model training;
  • Professionals or salon partners you explicitly authorize (for example, when you book an appointment and consent to share your analysis with them);
  • Legal authorities where required by valid legal process.

We do not sell, lease, trade, or otherwise profit from biometric or hair-image data.

8. Retention schedule

  • Active imagery is retained for up to 365 days from your last interaction with the Services or until you delete it.
  • Imagery you delete is removed from production storage within thirty (30) days. Encrypted backups may retain copies for up to ninety (90) days, after which backup rotation overwrites them.
  • If you delete your account, we destroy your imagery within 30 days, except where retention is required to satisfy a legal obligation, resolve a dispute, or defend a claim.
  • For BIPA-covered users specifically, we will permanently destroy biometric identifiers and biometric information when the initial purpose for collection has been satisfied or within three (3) years of your last interaction with us, whichever occurs first — even if our general retention schedule above would allow longer.

9. Your rights

Depending on your state, you may have rights to access, correct, delete, port, or restrict processing of your data. See the rights described in our Privacy Policy and the California Privacy Notice. To exercise these rights, contact privacy@cosmixxology.com.

10. Contact

Cosmixxology, Inc.
2911 Vega Street
Houston, Texas 77088
United States
Email: privacy@cosmixxology.com