The short version
This policy is written to be read. If you only read one section, read this one - the rest of the document says the same things with the precision the law requires.
- Your photograph is analysed to produce your report, and is not used to train our models unless you separately opt in.
- We do not sell your personal data, and we do not share it for advertising.
- You can delete your account and everything in it from inside the app, at any time, without contacting us.
- Facial scan data is sensitive personal data. We treat it that way.
Saundarya AI produces cosmetic guidance. It is not a medical device and does not diagnose disease. See the medical disclaimer.
Who we are
Saundarya AI is operated by Ambuj Singh ("we", "us"). We are the data controller for the personal data described in this policy - we decide what is collected and why.
- Contact
- contact@saundaryaai.com
What we collect
Photographs and facial analysis data
When you run a scan, you provide a photograph of your face. It is analysed by AI to describe visible features such as face shape and skin attributes, and the scores that appear in your report. We do not use it to recognise or identify you, and we do not create or keep a faceprint or any biometric template. Even so, a photograph of your face and what is derived from it are sensitive personal data under India's DPDP Act and the GDPR, and we treat them that way.
Before you take or choose a photo, the app may run face detection on your device, only to help you frame the shot. It runs on the device, and nothing from it is stored or sent to us.
Your answers about skin, diet and health
Before your first scan we ask about your skin type, skin concerns, diet, allergies, and any conditions you choose to share. These are used only to filter your recommendations - so a remedy never includes something you are allergic to - and you can change or clear them at any time in your account.
Your coach
If you use the skin coach, we keep what you and the coach say to each other, so the conversation can continue and you can come back to it. That includes:
- The messages you send and the coach's replies
- Photos you send in a chat, such as a close-up of your skin or a product label
- Notes the coach saves so it can help you better, such as your city or what irritated your skin
- Your routines and the steps you tick off in the tracker
- Health details you choose to share, for example pregnancy, a skin condition or medicines you take
Sharing health details is always your choice. The coach uses them to tailor its advice and keep it safe for you.
Approximate country
So that product recommendations link to shops that deliver to you, the app works out a two-letter country code (such as IN) from your device's location - only if you allow location access. Your coordinates are never sent to us or stored; only the country code is, alongside your report.
Account data
- Your name and email address
- An encrypted password hash - we never store your password itself
- Your Premium pass status and payment history
Technical data
- Device model, operating system version and app version
- IP address, used for security and approximate region only
- Error diagnostics in our server logs
- Website usage analytics - page interactions and scrolling, via Microsoft Clarity, on the website only
We do not collect your contacts, your location beyond approximate region, your camera roll beyond the photographs you choose to submit, or any advertising identifier.
Why we use it, and on what basis
We process each category of data for a stated purpose and on a stated legal basis. Where the basis is consent, you may withdraw it at any time.
- Producing your report
- Performance of our contract with you
- Storing your scan history
- Performance of our contract with you
- Skin coach - answer your questions and coach your routine using your report and profile
- Performance of our contract with you. Health details you choose to share in a chat: your consent
- Taking payment
- Performance of our contract with you
- Security, fraud prevention and abuse detection
- Our legitimate interests
- Fixing crashes and improving reliability
- Our legitimate interests
- Improving our models using your photographs
- Your explicit consent - off by default
- Marketing email
- Your consent - off by default
For users in India, the basis for processing your personal data is your consent, which you give in the app before your first scan, and the legitimate uses that section 7 of the Digital Personal Data Protection Act 2023 permits. Elsewhere, the GDPR bases in the table above apply.
Model training
Your photographs are not used to train or fine-tune our models unless you turn that setting on. It is off by default, it is a separate choice from using the service, and refusing it does not reduce what the app does for you.
If you do turn it on, you can turn it off again at any time. Doing so stops any further use of your images and removes them from future training sets. Models already trained cannot be un-trained, and we say so plainly rather than implying otherwise.
Who we share it with
We do not sell personal data. We share it only with the processors below, each bound by contract to use it solely for the service they provide to us.
- Amazon Web Services
- Hosting the service and storing your photographs
- MongoDB Atlas
- Our database: your account, answers and reports
- OpenRouter, routing to Google's Gemini models
- Analysing your photograph and your answers to produce your report
- OpenRouter, routing coach chats to Anthropic's Claude models, and to OpenAI's models only if Claude is unavailable
- Answering your messages in the skin coach. They receive your messages, photos you send in chat, and the report and profile details the coach needs to answer
- Google Firebase Authentication
- Signing you in
- Payment processing (Cashfree Payments)
- Taking payment. They receive your payment details, mobile number and email; we do not store your card or UPI details
- Microsoft Clarity (website analytics)
- Understanding how the website is used. Runs on the website only, not in the app, and only if you accept analytics cookies
- Email delivery
- Sending transactional email such as password resets
We may also disclose data where the law compels it - a valid court order or lawful demand from a competent authority. Where we are permitted to tell you about such a demand, we will.
How long we keep it
- Submitted photographs
- Retained while your account is open, so you can reopen past reports. Deleted with your account
- Reports and scan history
- Retained while your account is open
- Coach chats, saved notes, routines and tracker
- Deleted 12 months after your last coach activity, or with your account if sooner
- Photos you send in a coach chat
- Deleted after 90 days
- Account record
- Deleted within 30 days of your deletion request
- Payment and tax records
- Retained as long as tax and companies law requires, typically 8 years, regardless of account deletion
- Photographs and reports after you delete them
- Removed immediately from our live systems
- Server and security logs
- Up to 1 year, as India's DPDP Rules require, then deleted
- Backups
- Purged on the ordinary backup cycle, no later than 90 days
Payment records are the one category we cannot delete on request: retaining them is a statutory obligation, not a choice. They contain transaction records, not your photographs.
Your rights
Wherever you live, you can exercise all of the following. We do not operate a two-tier system where some users get fewer rights than others.
- Access and portability - download your data in the app (Profile → Privacy & data) or in your web account, in a machine-readable format. Your coach chats, photos, saved notes, routines and tracker are included in "Download my data"
- Correction - fix anything inaccurate
- Deletion - Profile → Account → Delete account in the app, or in your web account. Your coach data is deleted with your account
- Withdraw consent - for model training or marketing, at any time
- Object - to processing carried out on the basis of our legitimate interests
- Nominate - under India's DPDP Act you may nominate a person to exercise your rights if you die or become unable to
- Complain - to your data protection authority, or to India's Data Protection Board
Download and deletion need no contact with us. For anything else, write to contact@saundaryaai.com. We respond within 30 days and will tell you if we need longer and why.
Security
- Data is encrypted in transit with TLS and at rest
- Passwords are stored only as salted hashes
- Access to production data is restricted to staff who need it and is logged
- Payment card details never touch our servers - they go directly to our payment processor
No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal data we will notify you and the Data Protection Board of India without delay, as the DPDP Rules require, and any other authority within the timeframes its law sets.
Children
Saundarya AI is not for children. You must be 18 or older to create an account, and we do not knowingly collect data from anyone under 18.
If you believe a child has given us their data, write to contact@saundaryaai.com and we will delete it.
International transfers
Our infrastructure may process data outside your country. Where data leaves its region of origin we rely on the safeguards the relevant law provides, including standard contractual clauses, and we require the same protections of our processors wherever they operate.
Changes to this policy
When this policy changes we update the date at the top. If a change materially affects your rights or how we use your data, we will tell you in the app or by email before it takes effect - we will not rely on you noticing a new date.
When the policy changes materially, we ask you to accept the new version in the app before your next scan.
Grievance Officer
If you have a complaint about how we handle your personal data, write to our Grievance Officer.
- Grievance Officer
- Ambuj Singh
- contact@saundaryaai.com
- Acknowledgement
- Within 24 hours
- Resolution
- Within 15 days
If you are not satisfied with our response, you can complain to the Data Protection Board of India.
Contact us
- contact@saundaryaai.com