Privacy Policy

Solarity AI LLC (“we”, “us”) operates the Looks Max mobile application (the “App”). This policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have over it. It is written to comply with the EU/UK GDPR, the Turkish Personal Data Protection Law (KVKK), and the California Consumer Privacy Act (CCPA/CPRA).

1. Data We Collect

• Account data: email address and a password, which we store only as a one-way hash. If you sign in with Apple or Google, we receive the account identifier and email address (and, from Apple, the name) that service shares with us.
• Profile data: your name, the improvement goal you choose, and height and weight if you enter them.
• Photos you submit: images of your face uploaded for AI analysis or for a Future Self projection.
• Analysis results: the scores, observations and advice generated from your photos, and the Future Self images and advice generated for you.
• Timelapse: if you use it, one photo per day, the face landmark positions detected on your device to align it, the date and your timezone, and the videos made from these photos.
• Leaderboard: if you opt in, the display name (your first name and at most a surname initial) and the country you choose. Both are shown to other users next to your score.
• Habits, streaks and reminders: the habits you complete, your streaks, points and rewards, your timezone, and your reminder time and notification permission. Reminders are scheduled on your device.
• Coach sessions: if you book one, the name, contact email, optional phone number, preferred time and notes you enter, and the payment status.
• Purchase data: subscription status and consumable purchase records (via RevenueCat and the App Store / Google Play), linked to your account ID and email address. We never receive your full card number.
• Usage & device data: app events, device type and platform, app version and an app installation ID, used to operate and improve the App.
• Consent records: a log of the consents you give (e.g. for sharing a result card), with the date, app version, platform and installation ID.
• Website: on our website we count page views and app store clicks with the page path, country, referring site, device type (mobile, tablet or desktop) and a random ID that lasts only as long as the browser tab. We do not store your IP address or browser identifier.

2. Biometric / Special-Category Data

The facial photos you upload, and features derived from them for aesthetic scoring, may constitute biometric or special-category data under GDPR Art. 9 and the KVKK’s “özel nitelikli kişisel veri” rules. We process this data only with your explicit consent, given when you submit a photo for analysis, and solely to produce your requested analysis. You can withdraw consent at any time by deleting your account (Section 7).

3. How We Use Your Data

• To create and run your AI aesthetic analysis.
• To maintain your account, history, and progress over time.
• To provide the features you use: Future Self, Timelapse, the leaderboard, habits, streaks and reminders.
• To arrange and run the coach sessions you book.
• To process and verify your purchases and entitlements.
• To operate, secure, debug and improve the App.
• To contact you by email when we need to reach you about the App — for example to confirm a coach session and send your meeting link, to answer a support request, or to tell you about a change that affects your account. Your email address is used for this by Solarity AI LLC only. We do not sell it, and we do not share it with third parties.
• To comply with our legal obligations.

4. Photo Retention

Photos submitted by free users are automatically deleted from our storage within 24 hours of upload. Photos associated with a premium/paid analysis are retained so your results stay viewable, until you delete the analysis or your account. Timelapse photos and videos and Future Self images are kept until you delete them or your account. We do not use your photos to train AI models.

5. Who We Share Data With

We do not sell your personal data. We share it only with service providers (data processors) who help us run the App, under contract and only as needed:

• Amazon Web Services (AWS) — hosts our servers, where our database runs, and stores your photos, Future Self images and Timelapse photos and videos in encrypted, private storage (Amazon S3).
• Cloudflare — network and security layer in front of our servers. All traffic to the App’s servers and our website passes through it, including your IP address.
• OpenAI — processes your photos to generate the analysis and Future Self images, and your results to generate advice and progress reports (not used to train their models per their API terms).
• RevenueCat and the App Store / Google Play — purchase and subscription processing. RevenueCat receives your account ID and email address.
• Stripe — payment processing for 1-on-1 coach sessions. Stripe receives your account ID and email address to process the payment and issue a receipt. We never receive your full card number.
• Google (Google Meet) — hosts the video call for a coach session you book.
• Resend — delivers the emails we send, such as password resets and coach session requests. Resend processes your email address and the email’s content on our behalf and may not use it for anything else.
• PostHog — product analytics on app events, linked to your account ID and email address (you can opt out in the App under Privacy & Security).
• Supabase — our former backend provider. It verifies sign-in sessions that began before we moved to our own servers, until those sessions end.

If you sign in with Apple or Google, that service confirms your identity to us under its own privacy policy.

Each of these acts as a data processor under our instructions and may use your data only to provide that service to us. Under GDPR Art. 4(10) a processor is not a “third party”, and under the CCPA a service provider is distinct from a third party: disclosing your data to them is not sharing it with third parties, and none of them may use it for their own purposes. We do not sell or rent your personal data to anyone.

6. International Transfers

Some providers process data outside your country (e.g. in the United States). Where required, such transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.

7. Your Rights

Depending on where you live, you have the right to access, correct, export, restrict, or delete your personal data, to withdraw consent, and to object to certain processing. You can:

• Export your data in the App: Profile → Data Management → Export My Data.
• Delete your account and all associated data in the App: Profile → Data Management → Delete Account (see also our Data Deletion page).
• Contact us at [email protected] to exercise any right.

California residents have the right not to be discriminated against for exercising these rights. EU/UK and Turkish users may lodge a complaint with their local data protection authority.

8. Data Security

Photos are stored in a private, access-controlled bucket and transmitted over encrypted connections. Access is restricted by row-level security so only you (and our authorized systems) can reach your data.

9. Children

The App is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data. If you believe a child has used the App, contact us and we will delete the data.

10. Changes

We may update this policy. Material changes will be reflected by an updated “Last updated” date and, where appropriate, in-app notice.

11. Contact

Solarity AI LLC — [email protected]