Privacy Policy

1. Who we are

This Privacy Policy explains how Currier Media Inc. ("Currier Media," "we," "us" or "our") collects, uses, discloses and protects personal information when you use the GlowX mobile app (the "App"), our website at glowx.app (the "Site"), and our related services and support (together, the "Services").

Currier Media Inc. is a company incorporated in British Columbia, Canada. We are responsible for the personal information described in this policy, and we have designated a Privacy Officer who is accountable for our compliance with it. You can reach our Privacy Officer using the details in Section 14.

By using the Services, you acknowledge that you have read this policy. Where we rely on your consent, we will ask for it clearly, and you can withdraw it at any time as described below.

2. Information we collect

Information you give us

• Photos. The selfies and other photos you take or upload for analysis.
• Profile and preference information. Answers you give in the App, such as your beauty goals, skin type, hair type, style preferences and age range.
• Account information. If you create an account or sign in (for example, with Sign in with Apple or Google), your email address, name and sign-in identifiers.
• Messages. When you contact us by email or through our contact form: your name, email address and the content of your message.
• Cancellation and refund requests. When you email us to cancel or ask for a refund: your email address, your message and, if you subscribed through PayPal, your PayPal subscription ID.

When you email us or use our contact form, we use automated tools, including AI service providers, to read your message, look up your purchase with our payment processors and write a reply, so we can respond faster. Our AI providers process your message only to help us answer it and are not permitted to use it to train their models. A person on our team reviews these conversations and can always step in.

Information collected automatically

• Device and app information. Device model, operating system and version, app version, language, time zone and app-specific identifiers.
• Usage information. Features you use, screens you view, scans you run, session times and in-app events (for example, starting a trial or subscription).
• Diagnostics. Crash reports and performance data.
• Network information. Your IP address and the approximate location (country or region) we can infer from it. We do not collect precise GPS location.
• Advertising identifiers. On iOS, your device's advertising identifier (IDFA) only if you allow it through Apple's App Tracking Transparency prompt. On Android, your Android advertising ID, subject to your device settings. We also receive information about the ad or campaign that led you to install the App.
• Site logs. When you visit the Site, our hosting provider records standard server logs (such as IP address, browser type and pages requested). The Site does not use advertising cookies or third-party tracking scripts.

Information from third parties

• App stores and payment processors. Apple, Google, Stripe and PayPal send us information about your purchase and subscription, such as the product, price, currency, transaction ID, subscription status and country. For purchases on our Site, this may also include your billing name and email. We never receive or store your full payment card number.
• Advertising and attribution partners. Information about the campaign that led you to the App, such as the ad network and campaign name.

3. Your photos and face data

In this policy, "Face Data" means the photos you submit, any images we generate from them (such as predicted "after" visualizations), and information we derive from them about your appearance. That includes your face shape and proportions, skin tone and texture, eye and hair color, and the scores and estimates in your analysis.

How we use Face Data

We use Face Data only to:

• generate your analysis, recommendations, plan and visualizations;
• show you your results and progress history in the App; and
• keep the Services secure and working, for example by investigating a failed scan when you ask us for help.

What we never do with Face Data

• We don't use Face Data to identify you or to recognize you across photos, and we don't create biometric templates for identification ("facial recognition").
• We don't sell, rent or trade Face Data.
• We don't use Face Data for advertising or share it with advertising partners.
• We don't use your photos or Face Data to train AI models, and we only use AI service providers that are not permitted to use them to train their own models.
• We don't use Face Data to make decisions that have legal or similarly significant effects on you.

Who processes Face Data

To create your results, your photo is sent over an encrypted connection to our cloud infrastructure and AI processing providers. They process it only on our behalf and under contracts that limit its use to providing the Services.

Your consent

Your device will ask for permission before the App can use your camera or photo library. Before your first scan, we ask you to agree to this policy and to the processing of your Face Data as described here. Where the law requires express or written consent to collect information about facial geometry (for example, in Illinois, Texas and Washington), we obtain that consent before any scan. You can withdraw consent at any time by stopping use of the scan features and asking us to delete your Face Data.

How long we keep Face Data

We keep Face Data only as long as we need it for the purposes above. You can delete your photos and results in the App where that option is available, or by emailing support@glowx.app. We complete deletion requests within 30 days. In any case, we permanently destroy Face Data no later than 12 months after your last use of the App, or sooner where the law requires, unless we are legally required to keep it longer. Copies in secure backups are overwritten on our regular backup cycle.

Photos of other people

Only submit photos of yourself. Don't upload photos of anyone else without their permission, and never upload photos of anyone under 17.

4. How we use information

• To provide the Services: running scans and delivering your analysis, plan and recommendations.
• To personalize your experience: tailoring tips and product suggestions to your preferences and results.
• To process purchases and manage subscriptions: including verifying and processing cancellation requests.
• To communicate with you: answering support requests and sending service messages such as cancellation confirmations. With your permission, we also send push notifications such as plan reminders.
• To improve the Services: understanding how features are used, using usage and diagnostic data (not Face Data) in aggregated or de-identified form wherever possible.
• To measure our marketing: understanding which ad campaigns lead to installs and subscriptions (see Section 6).
• For safety, security and legal reasons: preventing fraud and abuse, enforcing our Terms of Service, and complying with the law.

If you are in the European Economic Area, the United Kingdom or Switzerland, our legal bases are: performance of our contract with you (to provide the Services and process purchases); consent (for Face Data, push notifications and, on iOS, tracking under App Tracking Transparency); our legitimate interests (to secure and improve the Services and measure our marketing in a privacy-respecting way); and legal obligations (for example, tax and accounting records).

5. How we share information

We do not sell your personal information for money. We share personal information only as follows:

• Service providers. Companies that help us run the Services, including cloud hosting and storage, AI processing (for your analysis and for answering support messages), analytics and crash reporting, subscription management, email delivery and customer support. They may use your information only to provide services to us.
• App stores and payment processors. Apple, Google, Stripe and PayPal process payments under their own privacy policies.
• Advertising and attribution partners. Limited device and event data (such as your advertising identifier where permitted, and install and purchase events) to measure our ad campaigns. We never share photos or Face Data with these partners.
• Legal and safety. When we believe in good faith that disclosure is required by law, or is necessary to protect the rights, property or safety of our users, the public or Currier Media.
• Business transfers. In connection with a merger, acquisition, financing, reorganization or sale of assets, subject to the protections in this policy.
• With your consent or at your direction, for example when you choose to share your results.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

6. Advertising and analytics

We advertise GlowX on other platforms, such as social media, and use analytics and attribution tools in the App to understand which campaigns lead to installs and subscriptions. These tools may collect your advertising identifier (where permitted), IP address, device information and in-app events.

Your choices:

• iOS: we only access your IDFA if you tap "Allow" on the App Tracking Transparency prompt. You can change this anytime in Settings › Privacy & Security › Tracking.
• Android: you can reset or delete your advertising ID, or opt out of ad personalization, in Settings › Privacy › Ads (wording varies by device).
• By email: email support@glowx.app with the subject "Do Not Sell or Share" and we will stop sharing your information for advertising measurement.

Under some U.S. state laws, this kind of advertising measurement may be considered "sharing" or "targeted advertising," and the choices above let you opt out. The Site does not use advertising or analytics cookies, so there is nothing to opt out of on the Site.

7. International transfers

We are based in Canada, and our service providers may store and process information in the United States and other countries. When your information is outside your home country, it is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities.

We protect information transferred outside your country with contractual and organizational safeguards. For transfers from the European Economic Area, the United Kingdom or Switzerland, we rely on adequacy decisions (including the European Commission's decision recognizing Canada) or on Standard Contractual Clauses or equivalent mechanisms.

8. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, or as required by law:

9. How we protect information

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit (TLS), access controls that limit access to people who need it, and service providers with strong security practices. No method of transmission or storage is completely secure, so we can't guarantee absolute security. If a breach affects your personal information, we will notify you and the relevant regulators as required by applicable law.

10. Your choices and rights

• Access and correction: ask for a copy of your personal information, or ask us to correct it.
• Deletion: delete your photos and results in the App where available, or ask us to delete your personal information.
• Withdraw consent: withdraw consent at any time. Some features, like scans, won't work without it.
• Push notifications: turn them off in your device settings.
• Advertising: see your choices in Section 6.
• Subscriptions: deleting the App does not cancel your subscription or delete your data. See how to cancel.

How to make a request

Email support@glowx.app with the subject "Privacy Request," or use our contact form. Please send it from the email address associated with your use of GlowX, or include details that help us find your information (such as a purchase receipt). We will verify your identity before acting on your request and respond within 30 days, or within the time required by the law that applies to you. You can use an authorized agent where the law allows. Requests are free unless they are clearly unfounded or excessive.

If we decline your request, we will explain why. Where your local law gives you a right to appeal, reply to our decision with the subject "Appeal" and we will review it.

11. Region-specific information

Canada

We handle personal information in accordance with British Columbia's Personal Information Protection Act and, where it applies, the federal Personal Information Protection and Electronic Documents Act. You have the right to access and correct your personal information and to withdraw consent. If you have a concern, please contact us first. You may also complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.

European Economic Area, United Kingdom and Switzerland

Currier Media Inc. is the controller of your personal information. You have the right to access, correct, delete, restrict or port your personal information, to object to processing based on our legitimate interests, and to withdraw consent at any time without affecting earlier processing. You may also lodge a complaint with your local data protection authority.

United States

Depending on your state (including California, Colorado, Connecticut, Virginia, Texas, Oregon and others with comprehensive privacy laws), you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• correct inaccurate information;
• delete your personal information;
• opt out of the "sale" or "sharing" of personal information and of targeted advertising (see Section 6); and
• not be discriminated against for exercising these rights.

We use sensitive personal information, including Face Data, only to provide the Services you request and for other purposes permitted by law, so we don't offer a separate right to limit its use. We do not engage in profiling that produces legal or similarly significant effects.

California notice. In the past 12 months, we have collected the following categories of personal information:

We collect this information from you, your device, app stores, payment processors and advertising partners, for the purposes in Section 4, and keep it as described in Section 8. We do not knowingly sell or share the personal information of consumers under 16.

12. Children

GlowX is intended for people 17 and older and is not directed to children. We do not knowingly collect personal information from anyone under 17. If you believe a child has given us personal information, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. When we do, we will change the effective date above. If we make material changes, we will let you know in the App, on the Site or by email before they take effect. Where the law requires it, we will ask for your consent again.

14. Contact us

Questions, requests or concerns about this policy or our privacy practices? Contact our Privacy Officer:

Currier Media Inc.
Attn: Privacy Officer
British Columbia, Canada
Email: support@glowx.app
Online: glowx.app/contact