Owulo Skin

Privacy Policy

Effective from: 6 September 2026

Owulo is a personalised skincare application that helps you understand your skin, track your progress, and build routines that work for you. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the Owulo app.

By creating an account or using the app, you agree to this Privacy Policy. If you do not agree, please do not use the app.

For questions or requests, contact us at support@owulo.com.

1. Information We Collect

Information you provide directly

Account and profile information: your name, email address, date of birth, and gender when you register or update your profile. If you sign in with Apple or Google, we receive the name and email address (or Apple's private relay address) that you choose to share.

Pregnancy or breastfeeding status: during onboarding we ask users who select "female" whether they are currently pregnant or breastfeeding, because some skincare ingredients are not recommended during pregnancy or while breastfeeding. This answer is stored on your profile and used only to tailor product and ingredient guidance. You can change it at any time in Settings.

Skin goals and concerns: the skin goal you choose during onboarding and the concern scores, skin type, skin tone classification and skin phase derived from your scans.

Skin analysis data: photographs of your face that you voluntarily submit to receive a skin analysis. You control when and whether to submit photos. You should not upload photographs of anyone other than yourself without their consent.

Daily check-in and diary data: mood tags, routine completion logs, personal diary notes, and product usage that you enter as part of your daily skin journey.

Skincare product and routine data: products you add to your routine, photographs or screenshots of products and ingredient labels that you scan or share to Owulo, routine scan results, and product logs.

Mirror Chat messages: the questions you type or dictate to Owulo's AI companion and the answers you receive. Dictation is converted to text by your phone's own speech recognition; we do not receive or store audio recordings.

Support communications: messages you send to us at support@owulo.com.

Information collected automatically

When you use the app, we automatically collect certain technical data necessary to operate and improve the service: device type, operating system, and app version; app usage patterns and feature interactions (for example, which screens you open and which features you use); session timestamps; crash reports and diagnostic information to identify and fix errors; a push notification token so we can deliver reminders to your device; and a user identifier and device identifier used by our analytics and crash-reporting tools.

Analytics and session recordings: we use a third-party analytics service, hosted in the European Union, to understand how the app is used. It receives your Owulo user ID, your device identifier and usage events. It does not receive your email address, your name, your photographs or the text of your Mirror Chat messages. We may also record how the app's screens are used during a session so that we can find and fix usability problems. In these recordings all text, images and camera views are masked before they leave your device, so your face, your photographs and what you type are never captured.

We do not collect your precise GPS location.

2. How We Use Your Information

To provide the Owulo service: your profile, photos, and daily data power the app's core features: skin analysis and scoring, Mirror Chat, your transformation diary, routine evaluation, and streak tracking.

To personalise your experience: your skin type, concerns, goals, and history inform the advice, conversation, and product recommendations you receive.

To send reminders: if you enable notifications, your reminder time preferences are used to send push notifications for your morning and evening routines.

To improve the app: we analyse usage patterns and technical data to identify issues, improve features, and deliver a better experience over time.

To communicate with you: we may contact you with important notices about the app, policy updates, or responses to your support requests.

To prevent misuse and ensure security: we use information to detect and prevent fraud, abuse, and security incidents.

To conduct research and support platform activities: where you have not opted out, we may use anonymised and aggregated information derived from app usage to improve our analysis systems, conduct skincare research, generate industry insights, and support platform activities, such as product recommendations, analytics, partnerships, and affiliate integrations. See Section 5 for details and your opt-out options.

3. How Your Data Is Processed

To deliver Owulo's features, certain data is processed by third-party systems operating under our instruction. We select providers that meet appropriate security and data protection standards, and we do not permit them to use your data for their own purposes.

AI-powered skin analysis: your face photograph is processed by a specialist skin analysis provider, acting on our instructions, to detect skin attributes such as texture, tone, pores and acne, which generate your skin scores and scan report. Photos are used for this purpose only and are not used by the provider to train its models.

AI language model services: the text of your Mirror Chat conversations, your skin profile summary, your concern scores and your routine and product data are processed by third-party AI language model providers, acting on our instructions, to generate personalised responses, scan summaries and product and routine assessments. Your photographs themselves are not sent to these systems. Product label and screenshot images that you scan are read by third-party image recognition services to identify the product and extract the ingredient list; these images do not contain your face.

Secure cloud infrastructure: your account, structured data (profile information, scan scores, diary entries, chat messages and routine data) and photographs are stored with our cloud database and hosting provider in encrypted, access-controlled infrastructure located in the European Union.

Crash reporting: crash and performance reports are collected by a third-party crash-reporting service. These reports include device and app information and an installation identifier; they are not linked to your name or email address.

Payment processing: subscription payments are processed entirely by Apple (App Store), Google (Google Play) or, for subscriptions purchased on our website, by PayFast. Owulo does not receive or store your payment card details. We use a third-party subscription management service to keep track of your subscription status across devices; it receives your Owulo user ID and your purchase history, not your payment details. Billing is governed by the respective terms and privacy policies of Apple, Google and PayFast.

Push notifications: reminders are delivered via the standard push notification services provided by Apple and Google as part of iOS and Android. You can turn reminders off at any time in Settings or in your device settings.

4. Facial Photographs and Biometric Data

Facial photographs are sensitive personal information and we treat them with particular care.

How photos are used: photos you submit for skin analysis are processed by AI analysis systems solely to generate your skin report and scores. They are not retained by those systems beyond the duration of processing.

We do not use your facial photographs or skin analysis data to build advertising profiles or target third-party advertisements to you.

We do not use your photos to train AI models, including our own future proprietary models, without your explicit, separately obtained consent. Where we seek this consent, it will be presented as a clear, opt-in choice during the app experience and will never be a condition of using the service.

How photos are stored, retained, and destroyed: your scan photos are retained in your private, access-controlled storage space, and only for as long as your account remains active, so that you can view your transformation history over time. This is a core part of the Owulo experience.

You can delete individual scans from your diary at any time, which permanently and irreversibly destroys the associated photograph. All photos are permanently and irreversibly destroyed within 30 days of account deletion. We do not retain facial photographs for any purpose beyond delivering the transformation-diary feature described above, and we do not disclose facial photographs to any third party except the AI analysis systems described in Section 3, solely for the purpose of generating your skin report.

How photos are transmitted: all photos are uploaded and transmitted over encrypted connections (HTTPS/TLS). We do not share your photos with any third party beyond what is described in Section 3.

5. Anonymised Data, Research and Platform Activities

We may process personal data in anonymised or aggregated form for the following purposes: improving our skin analysis and AI systems; conducting skincare and wellness research; generating aggregated industry insights shared with skincare brands, research partners, and industry organisations (for example: skin concern trends by age group, or ingredient effectiveness patterns across skin types); supporting platform activities such as product recommendations, affiliate integrations, and analytics partnerships.

Anonymisation standard: before any data is used for the purposes above, it is anonymised to a standard that prevents re-identification, meaning it cannot be linked back to any specific individual, even through advanced profiling or inference techniques. We do not retain any key or mechanism that would allow anonymised data to be reversed to its source.

We will never share or sell your identifiable personal information for commercial gain without your explicit consent.

Your opt-out choice: you can opt out of your data being used for research and platform activities at any time by emailing support@owulo.com from the email address on your account with the subject line "Anonymised data opt-out". Opting out does not affect your access to any features.

If you opt out, your data will only be used to deliver the service directly to you.

6. Sharing Your Information

We do not sell your identifiable personal information. We share your data only in the following circumstances:

With service providers: as described in Section 3, certain data is processed by third-party systems to deliver the app's features. These providers act under our instruction only.

For legal compliance: we may disclose personal information where required by law, or where we reasonably believe disclosure is necessary to comply with a legal obligation, protect our rights, or protect the safety of our users or the public.

In a business transfer: if Owulo is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

7. Legal Basis for Processing

South African users (POPIA)

Owulo (Pty) Ltd is incorporated in South Africa and processes personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA). Our lawful grounds for processing are consent, performance of a contract, legitimate interests, and legal obligation.

For any POPIA-related queries or to exercise your rights under POPIA, contact us at support@owulo.com or lodge a complaint with the Information Regulator at inforegulator.org.za.

EU and UK users (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal information on the following legal bases under the GDPR or UK GDPR: consent, contractual necessity, legitimate interests, and legal obligation.

You have the right to object to processing based on legitimate interests. See Section 10 for how to exercise your rights.

8. Data Retention

We retain your personal information for as long as your account is active. If you delete your account, all personal data associated with your account will be permanently deleted within 30 days, except where we are legally required to retain records for a longer period.

Facial photographs and other biometric identifiers are subject to the retention and destruction rules in Section 4, which govern in the event of any conflict with this section.

Anonymised, aggregated data, processed to a standard that permanently prevents re-identification, may be retained and used indefinitely.

9. Account Deletion

You can delete your account at any time in the app via Settings → Delete Account. If you no longer have the app installed, you can request deletion by following the steps on our account deletion page or by emailing support@owulo.com from the email address on your account. Account deletion is permanent and cannot be undone.

Deleting your account permanently removes: your profile and account information; all facial photographs, product photographs and scan images from our storage; your full scan history and skin scores; your Mirror Chat history; your transformation diary and daily check-in records; your routine and product data; your streak history and milestone records; and your push notification token. Your analytics identifier is deleted from our analytics service on request.

Deletion is processed within 30 days of your request.

Subscription management: deleting your account does not automatically cancel an active subscription. You must cancel your subscription separately before deleting your account to avoid future charges: through your App Store account settings if you subscribed on iPhone, through Google Play subscription settings if you subscribed on Android, or on our cancellation page (or in the app under Settings → Subscription) if you subscribed on our website.

10. Your Privacy Rights

Depending on where you live, you may have the following rights regarding your personal information. To exercise any of these rights, contact us at support@owulo.com. We will respond within 30 days.

Right to know: request information about what personal data we hold about you, where it comes from, and how it is used.

Right to access and portability: request a copy of the personal data we hold about you, in a structured, machine-readable format where applicable.

Right to correction: request that we correct inaccurate or incomplete information.

Right to deletion: request permanent deletion of your personal data. You can also do this directly via Settings → Delete Account.

Right to restrict processing: request that we limit how we use your data in certain circumstances.

Right to object: object to processing based on legitimate interests, including use of your data for research or platform activities.

Right to withdraw consent: where processing is based on your consent, withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

We will not discriminate against you for exercising any of these rights.

11. International Data Transfers

The third-party systems we use to deliver the service may process data on servers located outside your country of residence, including in the United States and the European Union.

Where data is transferred internationally, we rely on the contractual commitments and data protection standards of those providers to ensure your information is handled appropriately. By using the app, you acknowledge that your data may be processed in other jurisdictions.

12. Security

We implement appropriate technical and organisational security measures to protect your personal information, including encrypted data transmission (TLS) between the app and our servers, access controls limiting data access to authorised personnel only, secure session management and authentication, and regular review of our security practices.

No method of electronic transmission or storage is 100% secure. In the event of a confirmed data breach affecting your personal information, we will notify you as required by applicable law.

13. Children's Privacy

Owulo is not intended for children under the age of 13. We do not knowingly collect personal information from anyone under 13. If you are between 13 and 17, your parent or legal guardian should review this policy.

If you believe a child under 13 has provided us with personal information, contact us at support@owulo.com and we will delete it.

14. Supplemental Disclosure, California and US State Residents

This section applies to residents of California and other US states with applicable consumer privacy laws, including the CCPA as amended by the CPRA, and similar laws in Texas, Virginia, Colorado, Connecticut, and Washington and Utah.

Categories of personal information we collect: identifiers (name, email address); demographic information (date of birth, gender); biometric data or characteristics (facial photographs processed solely for skin analysis and scoring, see Section 4); health-related information, including consumer health data (skin condition data derived from analysis, and pregnancy or breastfeeding status where you provide it); internet and app activity information; inferences drawn from the above (skin scores, concern profiles).

Do we sell your personal information? No. We do not sell your personal information as defined under applicable US state privacy laws.

Do we share your information for targeted advertising? No. We do not share your personal information with third parties for targeted or cross-context behavioural advertising, and we do not use your facial photographs or skin analysis data to build advertising profiles.

Right to limit use of sensitive personal information: your biometric data and health-related information are "sensitive personal information" / "consumer health data" under applicable law. We use this data only to provide the service you requested. You may request that we limit use of this data to service-delivery purposes only by contacting support@owulo.com.

Your California rights: in addition to the rights described in Section 10, California residents have the right to know, request deletion, correct, limit use of sensitive personal information, not be discriminated against, and appeal a denied privacy request by contacting support@owulo.com.

Submitting a request: email support@owulo.com with the subject line "Privacy Request, [Your State]". We will verify your identity and respond within 45 days, extendable by a further 45 days where reasonably necessary.

Shine the Light (California Civil Code § 1798.83): we do not disclose personal information to third parties for their direct marketing purposes.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the app or by email. The "Effective date" at the top of this document will reflect when it was last updated.

Continued use of the app after an updated policy takes effect constitutes your acceptance of the changes.

16. Contact and Complaints

For privacy questions, to exercise your rights, or to raise a concern: email support@owulo.com. Owulo (Pty) Ltd | Incorporated in South Africa.

If you are not satisfied with our response, you may lodge a complaint with the data protection authority in your country or region: South Africa (Information Regulator, inforegulator.org.za); European Union (your national data protection authority); United Kingdom (Information Commissioner's Office, ico.org.uk); United States (your state Attorney General's office, or the FTC at ftc.gov).

Your Digital Mirror