Owulo Skin

Privacy Policy

Effective from: July 2026

Owulo is a personalised skincare application that helps you understand your skin, track your progress, and build routines that work for you. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the Owulo app.

By creating an account or using the app, you agree to this Privacy Policy. If you do not agree, please do not use the app.

For questions or requests, contact us at support@owulo.com.

1. Information We Collect

Information you provide directly

Account and profile information: your name, email address, date of birth, and gender when you register or update your profile.

Skin analysis data: photographs of your face that you voluntarily submit to receive a skin analysis. You control when and whether to submit photos. You should not upload photographs of anyone other than yourself without their consent.

Daily check-in and diary data: mood tags, routine completion logs, personal diary notes, and product usage that you enter as part of your daily skin journey.

Skincare product and routine data: products you add to your routine, routine scan results, and product logs.

Support communications: messages you send to us at support@owulo.com.

Information collected automatically

When you use the app, we automatically collect certain technical data necessary to operate and improve the service: device type, operating system, and app version; app usage patterns and feature interactions; session timestamps and crash reports; diagnostic information to identify and fix errors.

We do not collect your precise GPS location.

2. How We Use Your Information

To provide the Owulo service: your profile, photos, and daily data power the app's core features: skin analysis and scoring, Mirror Chat, your transformation diary, routine evaluation, and streak tracking.

To personalise your experience: your skin type, concerns, goals, and history inform the advice, conversation, and product recommendations you receive.

To send reminders: if you enable notifications, your reminder time preferences are used to send push notifications for your morning and evening routines.

To improve the app: we analyse usage patterns and technical data to identify issues, improve features, and deliver a better experience over time.

To communicate with you: we may contact you with important notices about the app, policy updates, or responses to your support requests.

To prevent misuse and ensure security: we use information to detect and prevent fraud, abuse, and security incidents.

To conduct research and support platform activities: where you have not opted out, we may use anonymised and aggregated information derived from app usage to improve our analysis systems, conduct skincare research, generate industry insights, and support platform activities, such as product recommendations, analytics, partnerships, and affiliate integrations. See Section 5 for details and your opt-out options.

3. How Your Data Is Processed

To deliver Owulo's features, certain data is processed by third-party systems operating under our instruction. We select providers that meet appropriate security and data protection standards, and we do not permit them to use your data for their own purposes.

AI-powered skin analysis: your face photograph is processed by AI analysis systems to detect skin attributes, such as texture, tone, pores, and acne, which generate your skin scores and scan report. Photos are used for this purpose only.

AI language model services: the text of your Mirror Chat conversations, along with your skin profile summary and concern scores, is processed by AI language model systems to generate personalised responses. Your photographs are not sent to these systems.

Secure cloud infrastructure: your structured data (profile information, scan scores, diary entries, and routine data) is stored in encrypted, access-controlled cloud infrastructure.

Payment processing: subscription payments are processed entirely by Apple (App Store) or Google (Google Play). Owulo does not receive or store your payment card details. Billing is governed by Apple's and Google's respective terms and privacy policies.

Push notifications: reminders are delivered via the standard notification services provided by Apple and Google as part of iOS and Android.

4. Facial Photographs and Biometric Data

Facial photographs are sensitive personal information and we treat them with particular care.

How photos are used: photos you submit for skin analysis are processed by AI analysis systems solely to generate your skin report and scores. They are not retained by those systems beyond the duration of processing.

We do not use your facial photographs or skin analysis data to build advertising profiles or target third-party advertisements to you.

We do not use your photos to train AI models, including our own future proprietary models, without your explicit, separately obtained consent. Where we seek this consent, it will be presented as a clear, opt-in choice during the app experience and will never be a condition of using the service.

How photos are stored, retained, and destroyed: your scan photos are retained in your private, access-controlled storage space, and only for as long as your account remains active, so that you can view your transformation history over time. This is a core part of the Owulo experience.

You can delete individual scans from your diary at any time, which permanently and irreversibly destroys the associated photograph. All photos are permanently and irreversibly destroyed within 30 days of account deletion. We do not retain facial photographs for any purpose beyond delivering the transformation-diary feature described above, and we do not disclose facial photographs to any third party except the AI analysis systems described in Section 3, solely for the purpose of generating your skin report.

How photos are transmitted: all photos are uploaded and transmitted over encrypted connections (HTTPS/TLS). We do not share your photos with any third party beyond what is described in Section 3.

5. Anonymised Data, Research and Platform Activities

We may process personal data in anonymised or aggregated form for the following purposes: improving our skin analysis and AI systems; conducting skincare and wellness research; generating aggregated industry insights shared with skincare brands, research partners, and industry organisations (for example: skin concern trends by age group, or ingredient effectiveness patterns across skin types); supporting platform activities such as product recommendations, affiliate integrations, and analytics partnerships.

Anonymisation standard: before any data is used for the purposes above, it is anonymised to a standard that prevents re-identification, meaning it cannot be linked back to any specific individual, even through advanced profiling or inference techniques. We do not retain any key or mechanism that would allow anonymised data to be reversed to its source.

We will never share or sell your identifiable personal information for commercial gain without your explicit consent.

Your opt-out choice: you can opt out of your data being used for research and platform activities at any time via Settings → Data & Privacy → "Anonymised data use." Opting out does not affect your access to any features.

If you opt out, your data will only be used to deliver the service directly to you.

6. Sharing Your Information

We do not sell your identifiable personal information. We share your data only in the following circumstances:

With service providers: as described in Section 3, certain data is processed by third-party systems to deliver the app's features. These providers act under our instruction only.

For legal compliance: we may disclose personal information where required by law, or where we reasonably believe disclosure is necessary to comply with a legal obligation, protect our rights, or protect the safety of our users or the public.

In a business transfer: if Owulo is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

7. Legal Basis for Processing

South African users (POPIA)

Owulo (Pty) Ltd is incorporated in South Africa and processes personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA). Our lawful grounds for processing are consent, performance of a contract, legitimate interests, and legal obligation.

For any POPIA-related queries or to exercise your rights under POPIA, contact us at support@owulo.com or lodge a complaint with the Information Regulator at inforegulator.org.za.

EU and UK users (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal information on the following legal bases under the GDPR or UK GDPR: consent, contractual necessity, legitimate interests, and legal obligation.

You have the right to object to processing based on legitimate interests. See Section 10 for how to exercise your rights.

8. Data Retention

We retain your personal information for as long as your account is active. If you delete your account, all personal data associated with your account will be permanently deleted within 30 days, except where we are legally required to retain records for a longer period.

Facial photographs and other biometric identifiers are subject to the retention and destruction rules in Section 4, which govern in the event of any conflict with this section.

Anonymised, aggregated data, processed to a standard that permanently prevents re-identification, may be retained and used indefinitely.

9. Account Deletion

You can delete your account at any time via Settings → Delete Account. Account deletion is permanent and cannot be undone.

Deleting your account permanently removes: your profile and account information; all facial photographs and scan images; your full scan history and skin scores; your transformation diary and daily check-in records; your routine and product data; your streak history and milestone records.

Deletion is processed within 30 days of your request.

Subscription management: deleting your account does not automatically cancel an active subscription. You must cancel your subscription separately through the App Store (iOS) or Google Play (Android) before deleting your account to avoid future charges.

10. Your Privacy Rights

Depending on where you live, you may have the following rights regarding your personal information. To exercise any of these rights, contact us at support@owulo.com. We will respond within 30 days.

Right to know: request information about what personal data we hold about you, where it comes from, and how it is used.

Right to access and portability: request a copy of the personal data we hold about you, in a structured, machine-readable format where applicable.

Right to correction: request that we correct inaccurate or incomplete information.

Right to deletion: request permanent deletion of your personal data. You can also do this directly via Settings → Delete Account.

Right to restrict processing: request that we limit how we use your data in certain circumstances.

Right to object: object to processing based on legitimate interests, including use of your data for research or platform activities. You can also exercise this right quickly via Settings → Data & Privacy.

Right to withdraw consent: where processing is based on your consent, withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

We will not discriminate against you for exercising any of these rights.

11. International Data Transfers

The third-party systems we use to deliver the service may process data on servers located outside your country of residence, including in the United States and the European Union.

Where data is transferred internationally, we rely on the contractual commitments and data protection standards of those providers to ensure your information is handled appropriately. By using the app, you acknowledge that your data may be processed in other jurisdictions.

12. Security

We implement appropriate technical and organisational security measures to protect your personal information, including encrypted data transmission (TLS) between the app and our servers, access controls limiting data access to authorised personnel only, secure session management and authentication, and regular review of our security practices.

No method of electronic transmission or storage is 100% secure. In the event of a confirmed data breach affecting your personal information, we will notify you as required by applicable law.

13. Children's Privacy

Owulo is not intended for children under the age of 13. We do not knowingly collect personal information from anyone under 13. If you are between 13 and 17, your parent or legal guardian should review this policy.

If you believe a child under 13 has provided us with personal information, contact us at support@owulo.com and we will delete it.

14. Supplemental Disclosure, California and US State Residents

This section applies to residents of California and other US states with applicable consumer privacy laws, including the CCPA as amended by the CPRA, and similar laws in Texas, Virginia, Colorado, Connecticut, and Washington and Utah.

Categories of personal information we collect: identifiers (name, email address); demographic information (date of birth, gender); biometric data or characteristics (facial photographs processed solely for skin analysis and scoring, see Section 4); health-related information, including consumer health data (skin condition data derived from analysis); internet and app activity information; inferences drawn from the above (skin scores, concern profiles).

Do we sell your personal information? No. We do not sell your personal information as defined under applicable US state privacy laws.

Do we share your information for targeted advertising? No. We do not share your personal information with third parties for targeted or cross-context behavioural advertising, and we do not use your facial photographs or skin analysis data to build advertising profiles.

Right to limit use of sensitive personal information: your biometric data and health-related information are "sensitive personal information" / "consumer health data" under applicable law. We use this data only to provide the service you requested and do not use it for any purpose that requires an opt-in right to limit beyond what Settings → Data & Privacy already offers. You may still request that we limit use of this data to service-delivery purposes only by contacting support@owulo.com.

Your California rights: in addition to the rights described in Section 10, California residents have the right to know, request deletion, correct, limit use of sensitive personal information, not be discriminated against, and appeal a denied privacy request by contacting support@owulo.com.

Submitting a request: email support@owulo.com with the subject line "Privacy Request, [Your State]". We will verify your identity and respond within 45 days, extendable by a further 45 days where reasonably necessary.

Shine the Light (California Civil Code § 1798.83): we do not disclose personal information to third parties for their direct marketing purposes.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the app or by email. The "Effective date" at the top of this document will reflect when it was last updated.

Continued use of the app after an updated policy takes effect constitutes your acceptance of the changes.

16. Contact and Complaints

For privacy questions, to exercise your rights, or to raise a concern: email support@owulo.com. Owulo (Pty) Ltd | Incorporated in South Africa.

If you are not satisfied with our response, you may lodge a complaint with the data protection authority in your country or region: South Africa (Information Regulator, inforegulator.org.za); European Union (your national data protection authority); United Kingdom (Information Commissioner's Office, ico.org.uk); United States (your state Attorney General's office, or the FTC at ftc.gov).

Your Digital Mirror