Privacy Policy

Last updated: [DATE].

1. Why should I read this Privacy Policy

This Privacy Policy ("Policy") explains how MB Gilus Kadras, trading as "SkinLooker" ("company", "we", "us", "our") handles your Personal Data when you: visit our website ("Website"); purchase our Services; use our mobile application ("App"); or otherwise interact with us (support, social media, etc.).

We are committed to processing your Data lawfully, fairly, and transparently in accordance with the General Data Protection Regulation (GDPR), the ePrivacy Directive 2002/58/EC, the UK GDPR, and any other applicable data protection laws. Specific national requirements are addressed in the Regional Addenda at the end of this Policy.

If you do not agree with our practices, please refrain from using the Website, purchasing our Services, or submitting your Data to us. This Policy is effective as of [DATE]. We may update this Policy occasionally; updates take effect upon publication.

2. Who is responsible for protecting your Personal Data

We are: MB Gilus Kadras, your Personal Data Controller.
Company code: 305520470 · VAT code: LT100013068619 · Registered address: [ADDRESS — pending]
Our support e-mail address: support@skinlooker.com

3. For what purposes and what Data do we collect

Lawful basis: we only process your Data where we have a lawful basis under applicable law — normally contract, consent, legal obligation, or legitimate interest.

Marketing: we only use your Data for marketing if you've clearly consented or we have another valid legal basis.

No sale of Data: we never sell your Data to anyone for monetary value.

Children's data: SkinLooker is not intended for minors. We do not knowingly collect Personal Data from minors without appropriate consent, and will delete any such data promptly if we become aware of it.

4. From what sources do we get your Data

Directly from you — when you place an order, take the skin/ingredient quiz, contact support, or fill out forms. Automatically via technology — when you visit the Website/App, through cookies and similar technologies. From third parties — hosting, payment, analytics, and error-monitoring providers.

5. Do we share your Data with others

We may share limited Data with: Service Providers (Data Processors) who support our business functions under Data Processing Agreements (e.g. hosting, payments, analytics, error monitoring, customer support, e-mail delivery); public authorities and other independent Data Controllers where legally required; other corporate entities or auditors in the context of a merger, acquisition, or restructuring; and other third parties only with your explicit consent where legally required.

6. How long do we keep your Data

Detailed retention periods for each processing purpose are set out in Section 13. Once the applicable period expires, we securely delete or irreversibly anonymize your Data.

7. How do we ensure the security of your Data

We apply technical and organisational measures to prevent unauthorised access, loss, misuse, alteration, or disclosure of your Data, including: collecting Data only for lawful purposes; limiting access to authorised staff; encrypting sensitive data; performing regular backups and activity logging; and monitoring our systems for threats. No system is entirely risk-free — please use a strong, unique password and be cautious with links claiming to be from us.

8. Do we transfer your Data internationally

We mainly store and process Data within the European Economic Area (EEA). Some processors (e.g. analytics, error-monitoring, or payment infrastructure) may be located outside the EEA. Where that is the case, we rely on an EU adequacy decision, or on Standard Contractual Clauses (SCCs) together with supplementary technical and contractual safeguards.

9. Do we use automated decision-making or profiling

Your scan/ingredient results are generated using our ratings methodology and shown to you directly for your own informational use — they are not used to make any automated decision about you (e.g. denial of a service) within the meaning of Art. 22(1) GDPR.

10. What are your rights

Right to be informed; right of access; right to rectification; right to erasure ("right to be forgotten"); right to restrict processing; right to data portability; right to object; right to withdraw consent; right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or your local supervisory authority. These rights are subject to the usual legal limitations (e.g. where we must retain data for legal compliance or dispute resolution).

11. How to exercise your rights or contact us

Email support@skinlooker.com with your question, which right you wish to exercise (if any), and enough information to identify you. We aim to respond within one month; complex requests may take an additional month, and we'll tell you if that applies.

12. Regional addenda

This Addendum supplements the Global Policy above and applies where your Data is subject to the laws of your country of residence; it overrides the Global Policy only where local law requires.

United Kingdom (UK)

If you are a UK resident, processing of your Data is subject to the UK GDPR and the Data Protection Act 2018, carrying the same categories of rights as Section 10. International transfers from the UK rely on UK adequacy regulations or the UK IDTA/Addendum to the EU SCCs. Supervisory authority: Information Commissioner's Office (ICO), ico.org.uk.

Australia

If you are an Australian resident, processing is subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), including rights to access and correction and to interact anonymously where lawful. Supervisory authority: Office of the Australian Information Commissioner (OAIC), oaic.gov.au.

Canada

If you are a Canadian resident, processing is subject to PIPEDA and applicable provincial law, including rights to access, correction, and consent withdrawal. Marketing messages comply with Canada's Anti-Spam Legislation (CASL). Supervisory authority: Office of the Privacy Commissioner of Canada (OPC), priv.gc.ca; Québec residents may also contact the CAI.

United States

If you are a U.S. resident, your Data may be subject to state privacy laws (CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, and others as applicable), including rights to know/access, deletion, correction, opt-out of sale/sharing and targeted advertising, data portability, and limiting use of sensitive Data. We honor recognised universal opt-out signals (e.g. Global Privacy Control) where required. California residents may contact the California Attorney General, oag.ca.gov/privacy/ccpa.

13. Detailed information about the processing of your Personal Data

13.1 To process and fulfil your order

• When: when you purchase a SkinLooker plan via the Website or App.
• Data: name, email, payment method details (via Stripe — we never see your full card number), IP address, device type.
• Legal basis: GDPR Art. 6(1)(b) — contract, to complete your purchase.
• Retention: order/payment records retained for 10 years (tax & accounting obligations).
• Recipients: Stripe (payment processor, EEA/US); intra-group companies (none currently).

13.2 To manage your account

• When: when you create and use your SkinLooker account.
• Data: email, password (hashed), account settings, device/log data.
• Legal basis: GDPR Art. 6(1)(b) — contract, to provide the Services.
• Retention: while you use the Services; accounts inactive for 24 consecutive months may be scheduled for deletion.
• Recipients: hosting/infrastructure providers.

13.3 To provide the skin quiz and ingredient scan results

• When: when you complete the skin-type quiz or scan a product label.
• Data: quiz answers (skin type, concerns, sensitivity), scanned product/ingredient data, scan history.
• Legal basis: GDPR Art. 6(1)(b) — contract, to generate your personalized report.
• Retention: while your account is active; see our Terms of Service for account deletion.
• Recipients: none outside our own processing infrastructure.

Scan results and quiz answers are never used for medical diagnosis, are not shared with third parties for their own purposes, and are not subject to automated decision-making that produces legal effects on you.

13.4 To process payments and comply with legal obligations

• When: when handling payments, subscriptions, and refunds, and for tax/accounting compliance.
• Data: payment token, transaction amount/date, invoice data.
• Legal basis: GDPR Art. 6(1)(b) contract / Art. 6(1)(c) legal obligation.
• Retention: 10 years (accounting/tax law).
• Recipients: Stripe; accounting service providers.

13.5 To provide customer support

• When: when you contact support@skinlooker.com or use in-app help.
• Data: name, email, correspondence history, purchase details.
• Legal basis: GDPR Art. 6(1)(b) contract / Art. 6(1)(f) legitimate interest.
• Retention: 3 years after your inquiry is closed.
• Recipients: support/helpdesk platform provider.

13.6 To send transactional communications

• When: order confirmations, billing notices, cancellation confirmations.
• Data: name, email, delivery/open status.
• Legal basis: GDPR Art. 6(1)(b) — contract. This is not marketing and cannot be opted out of.
• Retention: communication logs kept for 1 month unless legally required longer.
• Recipients: email delivery provider.

13.7 To send direct marketing

• When: newsletters, promotions, and feedback requests, where you've consented.
• Data: name, email, consent log, open/click data.
• Legal basis: GDPR Art. 6(1)(a) consent, or Art. 6(1)(f) soft opt-in for existing customers.
• Retention: 3 years from consent date, unless you opt out earlier.
• Recipients: email marketing platform provider.

You may object or withdraw consent at any time via the unsubscribe link in any email, or by emailing support@skinlooker.com.

13.8 To monitor Website/App performance and fix errors

• When: when you use the Website/App — product analytics and crash/error reporting.
• Data: IP address, device/browser type, pages/screens visited, session behaviour, error logs and stack traces.
• Legal basis: GDPR Art. 6(1)(a) consent (analytics cookies) / Art. 6(1)(f) legitimate interest (error monitoring, security).
• Retention: per Cookie Policy for analytics; error logs typically retained up to 12 months.
• Recipients: PostHog (product analytics), Sentry (error monitoring).

13.9 To defend and protect our legal rights

• When: if we become party to legal proceedings, or suspect fraud or unlawful use of our brand/Services.
• Data: relevant account, order, and correspondence records.
• Legal basis: GDPR Art. 6(1)(f) — legitimate interest, establishment/defence of legal claims.
• Retention: duration of proceedings, plus 10 years.
• Recipients: legal advisers, courts, and relevant authorities, where applicable.