Owulo Skin

Privacy Policy

Effective from: 14 October 2026

Owulo is a personalised skincare application that helps you understand your skin, track your progress, and build routines that work for you. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the Owulo app.

By creating an account or using the app, you agree to this Privacy Policy. If you do not agree, please do not use the app.

For questions or requests, contact us at support@owulo.com.

1. Information We Collect

Information you provide directly

Account and profile information: your name, email address, date of birth, and gender when you register or update your profile. If you sign in with Apple or Google, we receive the name and email address (or Apple's private relay address) that you choose to share.

Pregnancy or breastfeeding status: during onboarding we ask users who select "female" whether they are currently pregnant or breastfeeding, because some skincare ingredients are not recommended during pregnancy or while breastfeeding. This answer is stored on your profile and used only to tailor product and ingredient guidance. You can change it at any time in Settings.

Skin goals and concerns: the skin goal you choose during onboarding and the concern scores, skin type, skin tone classification and skin phase derived from your scans.

Skin analysis data: photographs of your face that you choose to take for a deep face scan or a daily check-in, and the skin analysis results produced from them. You control when and whether to submit photos. You should not upload photographs of anyone other than yourself without their consent.

Daily check-in and diary data: mood tags, routine completion logs, personal diary notes, and product usage that you enter as part of your daily skin journey.

Skincare product and routine data: products you add to your routine, photographs or screenshots of products and ingredient labels that you scan or share to Owulo, routine scan results, and product logs.

Ask Owulo messages and photos: the questions you type or dictate to Owulo's AI companion, any photos you choose to add to a message (for example a photo of your skin or of a product), and the answers you receive. Dictation is converted to text by your phone's own speech recognition; we do not receive or store audio recordings. If an Ask Owulo reply seems wrong, unsafe or offensive, you can report it from inside the chat.

Support communications: messages you send to us at support@owulo.com.

Shopping details: to show you where products can be bought near you, we need your delivery country, which is required to use shopping. You can also choose to give us your full name, phone number and delivery address, and a delivery currency. We also keep the products you put in your Bag, the orders you choose to record and the price you paid, the ratings you give products, and any product availability alerts you switch on. Owulo does not sell physical products or take payment for them: shopping links take you to independent retailers, who handle the sale and delivery under their own privacy policies.

Community content: if you use the Owulo community, we store your posts (including any photo you attach to a post), replies, votes, reports you make, members you block and your community handle. A photo you attach to a post is checked for safety before the post goes up (see Section 3) and, once posted, can be seen by other members. You can also choose to share a card, such as a Receipt, to the community or through a link. Your photo appears on a shared card only if you switch that on. Shared cards are public: anyone who has the link can see them.

Competition points and prizes: if you take part in the No Blind Buys monthly challenge, we record the points you earn (for example for scans, community posts and friends who join through your link) so that we can run the leaderboard and choose the winners, and we use the email address on your account to deliver a prize if you win. The rules are at owuloskin.com/rewards-rules.

Information collected automatically

When you use the app, we automatically collect certain technical data necessary to operate and improve the service: device type, operating system, and app version; app usage patterns and feature interactions (for example, which screens you open and which features you use); session timestamps; crash reports and diagnostic information to identify and fix errors; a push notification token so we can deliver reminders to your device; and a user identifier and device identifier used by our analytics and crash-reporting tools.

Analytics and session recordings: unless you choose Essentials only (see Section 7), we use a third-party analytics service, hosted in the European Union, to understand how the app is used. It receives your Owulo user ID, your device identifier and usage events. We may also record how the app's screens are used during a session so that we can find and fix usability problems. In these recordings your own photographs, camera views, anything you type and the messages you send to Ask Owulo are masked before they leave your device, so your face, your photographs and what you type are never captured. Other things shown on screen stay visible in the recording, such as screen titles, buttons, product pictures, your results, your name and your email address. If you choose Essentials only, the analytics service is stopped and receives nothing more.

Delivery country: to suggest where you shop, we make a first guess at your delivery country from the language and region settings on your phone. We do not use GPS or your precise location for this, and you can change the country at any time in Settings.

We do not collect your precise GPS location.

2. How We Use Your Information

To provide the Owulo service: your profile, photos, and daily data power the app's core features: skin analysis and scoring, Ask Owulo, your transformation diary, routine evaluation, and streak tracking.

To personalise your experience: your skin type, concerns, goals, and history inform the advice, conversation, and product recommendations you receive.

To support shopping, community and prizes: your shopping details are used to show products and availability for your country and to keep your Bag, orders and alerts. Your community content is used to show your posts to other members and to keep the community safe. Your competition points are used to run the leaderboard, choose the winners and deliver prizes by email.

To send reminders: if you enable notifications, your reminder time preferences are used to send push notifications for your morning and evening routines.

To improve the app: we analyse usage patterns and technical data to identify issues, improve features, and deliver a better experience over time.

To communicate with you: we may contact you with important notices about the app, policy updates, or responses to your support requests.

To prevent misuse and ensure security: we use information to detect and prevent fraud, abuse, and security incidents.

To conduct research and support platform activities: where you have not opted out, we may use anonymised and aggregated information derived from app usage to improve our analysis systems, conduct skincare research, generate industry insights, and support platform activities, such as product recommendations, analytics, partnerships, and affiliate integrations. See Section 5 for details and your opt-out options.

3. How Your Data Is Processed

To deliver Owulo's features, certain data is processed by third-party systems operating under our instruction. We select providers that meet appropriate security and data protection standards, and we do not permit them to use your data for their own purposes. A list of our current service providers is available on request from support@owulo.com.

Who receives your photos, and why: we send a photo to an outside provider only to produce the feature you asked for at that moment. Each provider acts on our instructions. The types of provider, and what each one receives, are described below.

Skin analysis: when you take a deep face scan or a daily check-in, your face photo is sent to a specialist skin analysis provider, which detects skin attributes such as texture, tone, pores, redness and acne. Its results become your skin scores and scan report.

Daily check-in summary: for a daily check-in, the same face photo is also sent to our AI language model provider, together with your check-in scores, so that its AI model can write your check-in summary in plain words. For a deep face scan, the AI language model provider receives your scan scores and profile summary as text to write your report; your face photo is not sent to it for a deep face scan.

Photos you add in Ask Owulo: if you add a photo to an Ask Owulo message, it is sent to our AI language model provider with your message so that Owulo can answer you. If the photo shows a skincare product, the same provider also reads the product name from the packaging so that we can look it up in Owulo's catalogue.

Community photo safety check: a photo you attach to a community post is sent to a content safety provider, which checks it for harmful content, such as sexual or violent images, before the post can be published. A photo that fails the check is deleted straight away.

Product, label and screenshot photos: when you scan a product, your products, an ingredient label or a screenshot, the image is sent to an image recognition provider, which reads the printed text, and to our AI language model provider, which identifies the product and reads the ingredient list. These features are meant for photos of products, not photos of people.

Text sent to AI language models: the text of your Ask Owulo conversations, your skin profile summary, your concern scores and your routine and product data are sent to our AI language model provider to write personalised answers, scan summaries and product and routine assessments.

What these providers may keep: our providers are contractually or by their published terms not permitted to use your photos, or the other data we send them, to train their models. They keep your photos only briefly to deliver the service or for abuse monitoring, for no more than 30 days, unless a longer period is required by law or needed to prevent harm. In particular: the skin analysis provider deletes the original photo once processing is complete and keeps any result images for no more than 24 hours; the image recognition provider processes images in memory and does not store them; the content safety provider does not keep photos for abuse monitoring; and the AI language model provider may keep what we send it for up to 30 days to monitor for abuse.

Checks that stay on your phone: some checks, such as finding your face in the camera frame and judging light and focus before a scan, run on your phone itself. The image does not leave your phone for these checks.

Your consent before a photo of you is analysed: Owulo analyses a photo of you only after you agree in the app. A short notice explains that photos are analysed in partnership with trusted AI providers to produce your reports, and that images are not used to train AI models. You see it in the Scan Your Face guide before your first face scan. Members who had an account before the notice was added see it once when they open the app. You agree by choosing Agree and continue, and no photo of you is sent before then. You need to agree to use face scans, daily check-ins and photos in Ask Owulo. Your choice is recorded on your account, so you are asked only once. If you do not want your photos analysed, you do not have to agree: simply do not take face scans or daily check-ins. The notice shown when the app opens has one button, Agree and continue, so a member who does not want to agree there can delete their account instead. You can withdraw your consent at any time by deleting your account in the app (Settings → Delete Account) or by emailing support@owulo.com (you can also reach us from Settings). After you withdraw it, no new photo of you is sent for analysis.

Secure cloud infrastructure: your account, structured data (profile information, scan scores, diary entries, chat messages and routine data) and photographs are stored with our cloud database and hosting provider in encrypted, access-controlled infrastructure located in the European Union.

Crash reporting: crash reports are collected by a third-party crash-reporting service so that we can find and fix errors. These reports include device and app information and an installation identifier; they are not linked to your name or email address. App performance reports (for example, how long screens take to load) are collected by the same provider unless you choose Essentials only.

Payment processing: subscription payments are processed entirely by Apple (App Store), Google (Google Play) or, for subscriptions purchased on our website, by our web payment provider. Owulo does not receive or store your payment card details. We use a third-party subscription management service to keep track of your subscription status across devices; it receives your Owulo user ID and your purchase history, not your payment details. Billing is governed by the respective terms and privacy policies of Apple, Google and our web payment provider.

Push notifications: reminders are delivered through the standard push notification services that iOS and Android use. You can turn reminders off at any time in Settings or in your device settings.

4. Facial Photographs and Biometric Data

Facial photographs are sensitive personal information and we treat them with particular care.

How photos are used: photos of you are sent only to the providers described in Section 3 (our skin analysis provider, our AI language model provider and, for community posts, our content safety provider), and only to produce the feature you asked for: your skin scores and report, your check-in summary, an answer in Ask Owulo or a community photo safety check. What each provider may keep, and for how long, is set out in Section 3. We ask for your consent before the first photo of you is sent for analysis.

We do not use your facial photographs or skin analysis data to build advertising profiles or target third-party advertisements to you.

We do not use your photos to train AI models, including our own future proprietary models, without your explicit, separately obtained consent. Where we seek this consent, it will be presented as a clear, opt-in choice during the app experience and will never be a condition of using the service.

How photos are stored, retained, and destroyed: your scan photos, and any photos you add in Ask Owulo, are kept in your private, access-controlled storage space, and only for as long as your account remains active, so that you can view your transformation history and your conversations over time. This is a core part of the Owulo experience.

If you want a single scan and its photograph deleted, email support@owulo.com from the email address on your account and we will permanently and irreversibly delete it. All photos, including photos you added in Ask Owulo, are permanently and irreversibly destroyed within 30 days of account deletion. We do not keep facial photographs for any purpose beyond delivering the features described in this policy, such as your transformation diary, and we do not disclose facial photographs to any third party except the providers described in Section 3, only to produce the feature you asked for, or where you choose to make a photo public yourself, for example in a community post or on a shared card.

How photos are transmitted: all photos are uploaded and transmitted over encrypted connections (HTTPS/TLS). We do not share your photos with any third party beyond what is described in Section 3.

5. Anonymised Data, Research and Platform Activities

We may process personal data in anonymised or aggregated form for the following purposes: improving our skin analysis and AI systems; conducting skincare and wellness research; generating aggregated industry insights shared with skincare brands, research partners, and industry organisations (for example: skin concern trends by age group, or ingredient effectiveness patterns across skin types); supporting platform activities such as product recommendations, affiliate integrations, and analytics partnerships.

Anonymisation standard: before any data is used for the purposes above, it is anonymised to a standard that prevents re-identification, meaning it cannot be linked back to any specific individual, even through advanced profiling or inference techniques. We do not retain any key or mechanism that would allow anonymised data to be reversed to its source.

We will never share or sell your identifiable personal information for commercial gain without your explicit consent.

Your opt-out choice: you can opt out of your data being used for research and platform activities at any time by emailing support@owulo.com from the email address on your account with the subject line "Anonymised data opt-out". Opting out does not affect your access to any features.

If you opt out, your data will only be used to deliver the service directly to you.

6. Sharing Your Information

We do not sell your identifiable personal information. We share your data only in the following circumstances:

With service providers: as described in Section 3, certain data is processed by third-party systems to deliver the app's features. These providers act under our instruction only.

With advertising partners: on our website only, unless you choose Essentials only (and, for visitors in Europe, only if you choose Accept), the advertising pixels described in Section 7 send information about your visit to Meta, TikTok and, if we run Google ads, Google.

For legal compliance: we may disclose personal information where required by law, or where we reasonably believe disclosure is necessary to comply with a legal obligation, protect our rights, or protect the safety of our users or the public.

In a business transfer: if Owulo is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

7. Cookies, Analytics and Advertising

Owulo uses cookies and similar technologies, such as the storage on your device or in your browser, in the app and on our website (app.owuloskin.com). If you visit our website from Europe (the European Economic Area, the United Kingdom or Switzerland, which we judge from your browser's time zone), we ask you to choose Accept or No thanks the first time you open it (No thanks is the same as Essentials only), and nothing in the two optional groups below runs until you choose Accept; if you do not choose, Owulo behaves as if you chose Essentials only. Everywhere else, and in the iPhone and Android apps, the two optional groups below are on unless you choose Essentials only, which you can do at any time under Settings → Privacy choices.

Essential (always on): these are needed for Owulo to work and cannot be switched off. They are: your sign-in session, kept in your device's secure storage (in the app) or in your browser's local storage (on the website); your settings and preferences, including a record of your privacy choice; a push notification subscription, only if you allow notifications; a security check by a bot protection provider when you create an account or sign in with email, which stops automated sign-ups (it runs in the background with nothing to click, and the provider handles the technical data it collects under its own privacy terms); crash reports in the app, so we can find and fix errors; and payment fraud prevention on our website. For fraud prevention, our web payment provider sets two cookies on our website, one kept for one year and one kept for 30 minutes, and uses them to detect and prevent fraudulent payments, as described in its own privacy terms.

Product analytics (in the app, optional): unless you choose Essentials only, the analytics service described in Section 1 measures how the app is used, and app performance reports are collected, so that we can see which features help and fix what does not. If you choose Essentials only, neither runs.

Advertising pixels (on our website, optional): unless you choose Essentials only (and, for visitors in Europe, only if you choose Accept), we load advertising pixels from Meta (Facebook and Instagram) and TikTok, and the Google tag if we run Google ads. They let these companies know that your browser visited our website, using cookies such as _fbp, _ttp and _gcl_au, so that we can measure our adverts and show them to people who might be interested. These companies process this information under their own privacy policies and may combine it with other information they hold about you. We never send them your photographs, your skin analysis, your health information or anything you write in Owulo. If you choose Essentials only, the pixels are not loaded. The iPhone and Android apps do not contain advertising pixels or advertising SDKs.

Changing your choice: you can change your choice at any time in the app under Settings → Privacy choices. The change applies straight away: choosing Essentials only stops analytics, withdraws consent in any advertising pixel already loaded and deletes its cookies from our website. You can also clear cookies and site data in your browser settings. If you are signed in, we keep a record of your choice, the date you made it and the version of the notice you saw, so that we can show what you agreed to and so that you are not asked again on another device.

8. Legal Basis for Processing

South African users (POPIA)

Owulo (Pty) Ltd is incorporated in South Africa and processes personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA). Our lawful grounds for processing are consent, performance of a contract, legitimate interests, and legal obligation. We rely on your consent to send photos of you for AI analysis (Section 3). Product analytics, app performance reports and advertising pixels rely on our legitimate interests in improving and promoting Owulo, and you can object at any time by choosing Essentials only in Settings → Privacy choices (Section 7).

For any POPIA-related queries or to exercise your rights under POPIA, contact us at support@owulo.com or lodge a complaint with the Information Regulator at inforegulator.org.za.

EU and UK users (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal information on the following legal bases under the GDPR or UK GDPR: consent, contractual necessity, legitimate interests, and legal obligation. Sending photos of you for AI analysis relies on your explicit consent (Section 3). Advertising pixels and product analytics on our website rely on your consent (Section 7). In the iPhone and Android apps, product analytics and app performance reports rely on our legitimate interests in improving Owulo, and you can object at any time by choosing Essentials only in Settings → Privacy choices.

You have the right to object to processing based on legitimate interests. See Section 11 for how to exercise your rights.

9. Data Retention

We retain your personal information for as long as your account is active. If you delete your account, all personal data associated with your account will be permanently deleted within 30 days, except where we are legally required to retain records for a longer period.

Facial photographs and other biometric identifiers are subject to the retention and destruction rules in Section 4, which govern in the event of any conflict with this section.

Anonymised, aggregated data, processed to a standard that permanently prevents re-identification, may be retained and used indefinitely.

10. Account Deletion

You can delete your account at any time in the app via Settings → Delete Account. If you no longer have the app installed, you can request deletion by following the steps on our account deletion page or by emailing support@owulo.com from the email address on your account. Account deletion is permanent and cannot be undone.

Deleting your account permanently removes: your profile and account information; all facial photographs, product photographs, scan images and photos you added in Ask Owulo or to community posts from our storage; your full scan history and skin scores; your Ask Owulo history; your transformation diary and daily check-in records; your routine and product data; your shopping details, Bag, recorded orders, ratings and availability alerts; your community posts, replies, votes, reports, blocks and handle, and the cards you shared; your competition points and prize records; your streak history and milestone records; and your push notification token. Your analytics identifier is deleted from our analytics service on request.

When you delete your account we delete your personal data, including your photos, scans, chats, posts and delivery details. Before we do, we keep one anonymised statistical record, such as an age range, gender, skin type and tone, country, your skin goal, how many scans and check-ins you made, which catalogue products were in your routine, whether you subscribed, and how your scores changed month by month. It holds no name, email, account ID, date of birth, exact dates, photos or anything you wrote, so it cannot be linked back to you or anyone else. We use these records only to improve Owulo and to produce aggregate skincare insights.

Deletion is processed within 30 days of your request. If you signed in with Apple, Owulo also asks Apple to revoke Owulo's access to your Apple account when your account is deleted.

Subscription management: deleting your account does not automatically cancel an active subscription. You must cancel your subscription separately before deleting your account to avoid future charges: through your App Store account settings if you subscribed on iPhone, through Google Play subscription settings if you subscribed on Android, or on our cancellation page (or in the app under Settings → Subscription) if you subscribed on our website.

11. Your Privacy Rights

Depending on where you live, you may have the following rights regarding your personal information. To exercise any of these rights, contact us at support@owulo.com. We will respond within 30 days.

Right to know: request information about what personal data we hold about you, where it comes from, and how it is used.

Right to access and portability: request a copy of the personal data we hold about you, in a structured, machine-readable format where applicable.

Right to correction: request that we correct inaccurate or incomplete information.

Right to deletion: request permanent deletion of your personal data. You can also do this directly via Settings → Delete Account.

Right to restrict processing: request that we limit how we use your data in certain circumstances.

Right to object: object to processing based on legitimate interests, including use of your data for research or platform activities.

Right to withdraw consent: where processing is based on your consent, withdraw it at any time. For analytics and advertising, choose Essentials only in Settings → Privacy choices. For the analysis of photos of you, email support@owulo.com or delete your account (Section 3). This does not affect the lawfulness of processing before withdrawal.

We will not discriminate against you for exercising any of these rights.

12. International Data Transfers

The third-party systems we use to deliver the service may process data on servers located outside your country of residence, including in the United States (for example, our AI language model provider) and the European Union.

Where data is transferred internationally, we rely on the contractual commitments and data protection standards of those providers to ensure your information is handled appropriately. By using the app, you acknowledge that your data may be processed in other jurisdictions.

13. Security

We implement appropriate technical and organisational security measures to protect your personal information, including encrypted data transmission (TLS) between the app and our servers, access controls limiting data access to authorised personnel only, secure session management and authentication, and regular review of our security practices.

No method of electronic transmission or storage is 100% secure. In the event of a confirmed data breach affecting your personal information, we will notify you as required by applicable law.

14. Children's Privacy

Owulo is not intended for children under the age of 13. We do not knowingly collect personal information from anyone under 13. If you are between 13 and 17, your parent or legal guardian should review this policy.

If you believe a child under 13 has provided us with personal information, contact us at support@owulo.com and we will delete it.

15. Supplemental Disclosure, California and US State Residents

This section applies to residents of California and other US states with applicable consumer privacy laws, including the CCPA as amended by the CPRA, and similar laws in Texas, Virginia, Colorado, Connecticut, and Washington and Utah.

Categories of personal information we collect: identifiers (name, email address); demographic information (date of birth, gender); biometric data or characteristics (facial photographs processed solely to provide your skin analysis, scores, check-in summaries and the Ask Owulo answers you ask for, see Sections 3 and 4); health-related information, including consumer health data (skin condition data derived from analysis, and pregnancy or breastfeeding status where you provide it); internet and app activity information; inferences drawn from the above (skin scores, concern profiles).

Do we sell your personal information? No. We do not sell your personal information as defined under applicable US state privacy laws.

Do we share your information for targeted advertising? Only on our website, and not if you choose Essentials only. The Meta, TikTok and Google advertising pixels described in Section 7 then receive information about your visit to our website, which some US state laws treat as "sharing" for cross-context behavioural advertising. To opt out of this sharing, choose Essentials only at any time in Settings → Privacy choices, and it stops straight away. We never use your facial photographs, skin analysis data or health information for advertising, and the iPhone and Android apps do not share your information for advertising.

Right to limit use of sensitive personal information: your biometric data and health-related information are "sensitive personal information" / "consumer health data" under applicable law. We use this data only to provide the service you requested. You may request that we limit use of this data to service-delivery purposes only by contacting support@owulo.com.

Your California rights: in addition to the rights described in Section 11, California residents have the right to know, request deletion, correct, limit use of sensitive personal information, not be discriminated against, and appeal a denied privacy request by contacting support@owulo.com.

Submitting a request: email support@owulo.com with the subject line "Privacy Request, [Your State]". We will verify your identity and respond within 45 days, extendable by a further 45 days where reasonably necessary.

Shine the Light (California Civil Code § 1798.83): we do not disclose personal information to third parties for their direct marketing purposes.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the app or by email. The "Effective date" at the top of this document will reflect when it was last updated.

Continued use of the app after an updated policy takes effect constitutes your acceptance of the changes.

17. Contact and Complaints

For privacy questions, to exercise your rights, or to raise a concern: email support@owulo.com. Owulo (Pty) Ltd | Incorporated in South Africa.

If you are not satisfied with our response, you may lodge a complaint with the data protection authority in your country or region: South Africa (Information Regulator, inforegulator.org.za); European Union (your national data protection authority); United Kingdom (Information Commissioner's Office, ico.org.uk); United States (your state Attorney General's office, or the FTC at ftc.gov).

Your Skincare Auditor