At Twacha Labs, your privacy is fundamental to how we build and operate our platform. This policy explains how we collect, use, and protect your personal information when you use our skin analysis services.
Information We Collect
Account Information: When you create an account, we collect your email address and basic profile details (name, skin goals) to personalise your experience and authenticate your identity.
Facial Images: When you use our scan feature, your facial images are captured and transmitted securely to our analysis pipeline. Images are encrypted in transit using TLS and processed through our AI vision model hosted by a third-party provider (currently OpenAI). Images are not used to train third-party models. We do not sell your facial images.
Lifestyle Data: Before each scan, you may optionally log lifestyle factors (sleep, water intake, diet, exercise). This data is used to provide context alongside your scan results. Logging lifestyle data is entirely optional.
Usage Data: We collect anonymised analytics about how you interact with our service to improve the user experience, such as feature usage patterns and session data.
How We Use Your Information
We use your information to:
- Provide skin analysis estimates, scoring, and suggestions
- Track visible changes in your skin over time
- Send you scan results and account notifications
- Improve our analysis using anonymised, aggregated data
How Your Photos Are Processed
When you take a scan, your photos are sent to our server and forwarded to our AI analysis provider (currently OpenAI) for processing. The provider analyses the image and returns estimated skin metrics. According to OpenAI's API data usage policy, images submitted via the API are not used to train their models.
If you have not opted into research, your images are deleted from our storage after analysis is complete. If you have opted in, images are retained in encrypted storage for the purpose of improving our analysis accuracy.
Data Security
Your data is protected by the following measures:
- TLS encryption for all data in transit
- Encrypted database storage (AES-256 at rest via Supabase)
- Row-level security policies ensuring users can only access their own data
- Images can be deleted at any time through your settings
- Regular review of access controls and security practices
Data Retention
We retain your scan history, scores, and profile data for as long as your account is active. You can request deletion of your data at any time through your dashboard settings or by contacting us. Upon account deletion, all personal data — including scan results and profile information — will be permanently removed within 30 days.
Your Rights
Under UK GDPR, you have the right to:
- Access your personal data at any time through your dashboard
- Request correction of inaccurate data
- Request deletion of your data and account
- Export your data in a portable format
- Opt out of non-essential communications
Third-Party Services
We use the following third-party services to operate our platform:
- Supabase — authentication, database, and file storage
- Vercel — application hosting and deployment
- OpenAI — AI-powered image analysis (current provider; facial images are sent to this service)
- Stripe — payment processing for premium subscriptions
These partners are contractually bound to protect your data. We share only the minimum data necessary for each service to function. We do not sell your personal data to any third party.
Contact Us
If you have questions about this Privacy Policy or want to exercise your data rights, contact us at founder@twachalabs.io