Privacy Policy

1. Introduction

This Privacy Policy describes how HeyGlow ("HeyGlow," "we," "us," or "our"), accessible at heyglow.in, collects, uses, stores, and protects your information when you use our website, web application, and AI-powered skin and hair analysis services (the "Platform").

By accessing or using the Platform, you confirm that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the Platform immediately.

2. Information We Collect

3. How We Use Your Information

• —Provide, operate, and maintain the Platform, including account creation and management.
• —Analyse your skin and hair using AI to generate insights, scores, and personalized recommendations.
• —Personalize your experience — including routine guidance and product-fit suggestions — based on your profile and scan history.
• —Communicate with you regarding support requests, billing, and important service updates.
• —Improve and develop the Platform, including testing features, improving model accuracy, and analysing usage patterns.
• —Maintain Platform security, detect fraud, and comply with applicable legal obligations.
• —Process payments and manage your subscription or one-time purchases.

4. Face Scans, Photos & Biometric Data

Your face and hair images are sensitive biometric data. We treat them with the highest level of care. We use your images exclusively to perform skin and hair analysis, generate scores and visual insights, and display trends over time within your HeyGlow account.

We do not sell your photos, face scans, or quiz responses to advertisers or third parties. We do not use your biometric data for profiling outside the Platform. Where possible, data used to improve our AI models is aggregated and anonymized so that it cannot identify you personally.

You may delete your photos and scan history at any time from your account settings. Upon account deletion, we will permanently remove your biometric data from our systems within 30 days, subject to legal retention requirements.

5. AI Processing & Third-Party Providers

HeyGlow uses artificial intelligence and third-party infrastructure providers (such as cloud hosting, analytics, and image-processing services) to deliver the Platform. When we share data with these providers, we limit it to only what is necessary, require them to protect your information under strict data processing agreements, and prohibit them from using your data for their own purposes.

Our AI models process visual biometric data statistically. Results are probability-based estimates and are not clinically validated. Refer to our Terms of Service for full AI accuracy disclaimers.

6. How We Share Your Information

We do not sell your personal information. We may share your data only in the following limited circumstances:

• —With service providers that help us operate the Platform (hosting, analytics, AI infrastructure, payment processing, customer support) — bound by confidentiality obligations.
• —When required by law, regulation, legal process, court order, or governmental authority.
• —To protect the rights, property, or safety of HeyGlow, our users, or others.
• —In connection with a business transaction such as a merger, acquisition, or asset sale — you will be notified before your data is transferred and becomes subject to a different privacy policy.

7. Data Security

We implement reasonable technical and organisational safeguards to protect your personal information, including encryption in transit (HTTPS/TLS), access controls, and secure storage. Biometric image data is stored with additional access restrictions.

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your rights or freedoms, we will notify you as required by applicable law.

8. Data Retention

We retain your personal information for as long as necessary to provide the Platform, comply with legal obligations, resolve disputes, and enforce our agreements. The following retention periods generally apply:

• —Account data: retained while your account is active and for up to 12 months after account deletion.
• —Scan images and biometric data: deleted within 30 days of your account deletion request.
• —Transaction and billing records: retained for up to 7 years to comply with tax and financial regulations under Indian law.
• —Support communications: retained for up to 2 years.

9. Your Rights & Choices

Depending on your location, you may have the following rights over your personal data. To exercise any of these rights, contact us at support@heyglow.in. We may verify your identity before responding.

• —Access: Request a copy of the personal data we hold about you.
• —Correction: Request correction of inaccurate or incomplete data.
• —Deletion: Request deletion of your personal data (subject to legal retention requirements).
• —Restriction: Request that we limit processing of your data in certain circumstances.
• —Portability: Request a copy of your data in a structured, machine-readable format.
• —Objection: Object to processing of your data for direct marketing purposes.
• —Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

10. India — DPDPA 2023 Compliance

HeyGlow complies with India's Digital Personal Data Protection Act, 2023 (DPDPA). As a Data Fiduciary, we process your personal data only for the purposes described in this Privacy Policy and with a lawful basis for each use.

Under the DPDPA, you have the right to access information about your data, correct inaccuracies, and request erasure where applicable. If you are the parent or guardian of a child under 18, you may also exercise rights on their behalf. To submit a data rights request, email support@heyglow.in with the subject line "DPDPA Data Request."

11. International Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the GDPR, including the right to lodge a complaint with your local data protection authority. Our lawful bases for processing include contract performance, legitimate interests, legal obligation, and where applicable, your explicit consent.

We process EEA user data on servers that maintain adequate data protection standards. Where we transfer data internationally, we ensure appropriate safeguards are in place.

12. Children's Privacy

The Platform is not directed at children under 13 (or 16 in the EU and certain other jurisdictions). We do not knowingly collect personal data from minors without verifiable parental consent. In compliance with the DPDPA 2023, we take additional steps to verify user age during registration.

If you believe we have inadvertently collected data from a minor, please contact us at support@heyglow.in immediately and we will delete the data and close the account without delay.

13. Cookies & Tracking

We use first-party cookies to keep you signed in and remember your preferences, and third-party analytics cookies (such as Google Analytics) to understand how users interact with the Platform. We do not use cookies for cross-site advertising tracking.

You can control cookie settings through your browser. Disabling certain cookies may affect Platform functionality. Where required by law, we will obtain your consent before setting non-essential cookies.

14. Not Medical Advice

All skin and hair insights, scores, and recommendations provided by HeyGlow are for cosmetic, educational, and informational purposes only. They are not medical advice, diagnosis, or treatment and do not replace consultation with a qualified dermatologist or healthcare professional.

Always seek professional medical advice for any skin, hair, or health-related concerns. For more detail, refer to the Medical Disclaimer in our Terms of Service.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will update the "Last updated" date at the top of this page and notify you via email or in-app notification for material changes.

Your continued use of the Platform after changes take effect constitutes your acceptance of the updated Privacy Policy.