Privacy Policy

1. Introduction

Welcome to Cosmixxology ("Company," "we," "us," or "our"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile application, and services (collectively, the "Services").

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Services.

2. Information We Collect

2.1 Personal Information You Provide

We collect personal information that you voluntarily provide to us when you:

• Register for an account
• Use our hair analysis services
• Subscribe to our services
• Contact us with inquiries
• Participate in surveys or promotions

This information may include:

• Name and contact information (email address, phone number)
• Account credentials (username, password)
• Payment information (processed securely through our payment processor)
• Hair and scalp images for analysis
• Hair care preferences and goals
• Health-related information you provide about your hair and scalp (allergies, sensitivities, conditions) — see Section 2.4

2.2 Information Collected Automatically

When you access our Services, we automatically collect certain information, including:

• Device information (type, operating system, unique identifiers)
• IP address and approximate location data
• Browser type and settings
• Usage data (pages visited, time spent, clicks)
• Cookies and similar tracking technologies

2.3 AI Analysis Data

Our AI-powered hair analysis service processes images you upload to generate personalized recommendations. Images are processed by our AI engine, which runs on secure third-party infrastructure under enterprise/API privacy terms.

No model training on your images. We do not use your hair, scalp, or face images to train, fine-tune, or improve generative AI models. Our processors are configured under terms that prohibit them from using your inputs/outputs to train their models.

Not medical advice. Our AI analyzes the visual characteristics of your hair and scalp to recommend cosmetic ingredients and routines. The results are informational only. They are not a medical diagnosis, are not approved or cleared as a medical device, and are not a substitute for advice from a licensed dermatologist, trichologist, or other healthcare provider. If you have a scalp condition, hair-loss concern, allergic reaction, or any other medical issue, consult a qualified healthcare provider.

Results may be inaccurate. AI output is probabilistic and can be confidently wrong — particularly with poor lighting, motion blur, unusual hair characteristics, or images of conditions outside the model's training distribution. You use the analysis at your own discretion and assume the risk associated with following or not following the recommendations.

Third parties involved. Processing is performed by third-party AI providers and cloud infrastructure providers acting as our processors under written contracts. Our current sub-processor list is available on request via /legal/sub-processors.

We retain the analysis results (text descriptions, scores, recommendations) so you can review your history, track progress, and reorder formulas. You can delete your analysis history at any time from Settings or by contacting us. See also our Biometric & Hair Image Data Notice.

2.4 Sensitive Personal Information

Some of what we collect is sensitive personal information under California (CCPA/CPRA), Texas (TDPSA), and other US state privacy laws. We treat it accordingly:

• Health-related information you tell us about your hair and scalp — allergies, sensitivities, irritation history, scalp conditions, current medications affecting hair;
• Hair, scalp, and (where you upload) face imagery used for AI analysis, which we treat as biometric-style data even where state law does not require it;
• Precise geolocation if you authorize the mobile app to use it for finding nearby salons;
• Account credentials.

We process sensitive personal information only:

• With your explicit consent (a separate consent flow runs before any hair, scalp, or face imagery is uploaded — see our Biometric Notice);
• For the specific purposes you authorized — running your analysis, generating your formula, fulfilling your order;
• To ensure the security and integrity of the Services;
• To comply with legal obligations.

We do not use sensitive personal information to infer characteristics about you for any purpose beyond delivering the Services. You can withdraw consent at any time from Settings or by emailing privacy@cosmixxology.com — withdrawal stops future processing but does not affect processing that was already lawful.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Services
• Process your hair analysis and generate personalized recommendations
• Create and manage your account
• Process payments and subscriptions
• Send you service-related communications
• Respond to your inquiries and provide customer support
• Send marketing communications (with your consent)
• Analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues
• Comply with legal obligations

4. Sharing Your Information

We may share your information with:

• Service Providers / Sub-Processors: Third-party vendors who perform services on our behalf — including AI providers, cloud-infrastructure providers, payment processing, transactional email, and analytics. They act under written contract and may use the information only to provide their service to us;
• Professional Partners: Hair care professionals or salons you choose to connect with through our platform — with your explicit consent for each connection;
• Business Transfers: In connection with any merger, acquisition, financing, or sale of company assets, subject to confidentiality protections;
• Legal Requirements: When required by law, valid legal process, or to protect our rights, property, or safety.

4.1 No sale of personal information

We do not sell your personal information for monetary consideration.

4.2 "Sharing" for cross-context behavioral advertising

California (CCPA/CPRA) and several other US state laws define "sharing" more broadly than "selling" — it includes disclosing personal information to third parties for cross-context behavioral advertising, even when no money changes hands. Our cookie banner lets you opt out of analytics and marketing cookies, which serves as your opt-out of sharing for that purpose. You can update your choice at any time from the footer.

We honor the Global Privacy Control browser signal as a valid opt-out request in every state where it is recognized.

You can also submit a verified Do Not Sell or Share request: /legal/do-not-sell.

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption of data in transit (TLS 1.2+) and at rest
• Secure password hashing (bcrypt)
• Role-based access control with least-privilege defaults
• Regular security assessments and vulnerability scanning
• Audit logging of administrative actions
• Secure payment processing through a PCI-DSS-compliant payment processor (we never see or store full card numbers)

No method of transmission or storage over the Internet is 100% secure. While we work hard to protect your data, we cannot guarantee absolute security.

5.1 Breach Notification

If we experience a personal-data breach that creates a risk of harm to you, we will notify you and the appropriate regulatory authorities as required by applicable state law — including, where applicable, California Civil Code § 1798.82, New York General Business Law § 899-aa, and the Texas Identity Theft Enforcement and Protection Act. Notification will be sent to the email address on your account and, where required by law, by additional reasonable means. We will tell you what happened, what data was affected, what we are doing about it, and what you can do to protect yourself.

6. Data Retention

We keep different categories of personal information for different periods. Approximate schedule:

We may keep information longer than the schedule above where required by law (responding to legal process, defending a claim, satisfying tax or regulator obligations), but only what is necessary for that specific purpose.

7. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Portability: Request transfer of your data to another service
• Opt-out: Opt out of marketing communications
• Withdraw Consent: Withdraw consent where processing is based on consent

To exercise these rights, please contact us at privacy@cosmixxology.com.

8. Automated Decision-Making

Our Services use AI to analyze hair, scalp, and (where you upload) face imagery and to suggest ingredients, formulas, and care routines. These outputs are automated — generated by software without case-by-case human review of every individual result.

The outputs are cosmetic and informational in nature. They do not produce legal or similarly significant decisions about you — for example, we do not use AI to deny you a service, set a different price for you, evaluate your creditworthiness, employment, insurance, or housing eligibility, or share automated profiles with third parties for those purposes.

Right to human review. You can request that a trained team member review any AI-generated analysis or recommendation. Email privacy@cosmixxology.com with the subject line "Human review" and we will look at the inputs and outputs and either confirm or revise the result.

For more on how the AI works and its limitations, see our AI Transparency Disclosure.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store information. These include:

• Essential Cookies: Required for the operation of our Services
• Analytics Cookies: Help us understand how users interact with our Services (only set with your consent)
• Preference Cookies: Remember your preferences and settings (only set with your consent)
• Marketing Cookies: Used by us or partners to show you relevant ads on other sites (only set with your consent)

You control cookies through our cookie banner (re-openable from the footer) and through your browser settings. See our Cookie Policy for the full list with vendors, durations, and purposes.

Disabling essential cookies will prevent core features (signing in, secure checkout) from working.

10. Children's Privacy

10.1 Under 13 (COPPA)

The Services are not directed to children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent under the Children's Online Privacy Protection Act (COPPA). If we learn that we have collected such information without proper consent, we will delete it promptly.

10.2 Teens (13–17)

For users between 13 and 17:

• A parent or legal guardian must consent to the user creating an account.
• Some state biometric laws — notably the Illinois Biometric Information Privacy Act — require written parental consent before collecting any biometric information from a minor. We follow that rule for all minors regardless of state.
• A parent or guardian can request to access, correct, or delete the minor's account information at any time by emailing privacy@cosmixxology.com from a verifiable parental address. We may ask for additional verification before acting on the request.
• No sale or sharing of minors' data. We do not sell or share the personal information of users under 16, in line with CCPA/CPRA § 1798.120(c).
• We do not send marketing communications to users under 18 without affirmative parental consent.

10.3 Adults of majority

Some features (custom-mixed cosmetic formulas, professional appointments, paid subscriptions) are restricted to users who are 18 or older or who have parent/guardian consent on file.

11. Where we operate

Cosmixxology is intended for users in the United States. Our infrastructure providers — including our cloud hosting, transactional email, AI engine, and payment processor — process data in the United States. We do not currently target or actively market to users outside the United States.

If you choose to use the Services from outside the United States, your information will be processed in the United States, which may have different data-protection rules than your country of residence. Where your specific use is subject to mandatory EU/UK/Swiss privacy law, we will respond to lawful requests from supervisory authorities and honor the rights you have under that law. Before any active EEA or UK launch we will publish a complete GDPR/UK GDPR addendum at /legal/gdpr.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: