Privacy Policy

1. Important Notice: Not a Medical Service

Aesthetix App provides AI-generated visual simulations for entertainment and informational purposes only. It does not provide medical advice, diagnosis, or treatment recommendations, and is not a substitute for consultation with a licensed medical or aesthetic professional. Results shown in the App are simulated approximations and do not guarantee any real-world outcome.

2. Information We Collect

a) Information You Provide Directly

• Account Information. When you create an account, we collect your email address, or, if you choose to sign in with Apple or Google, we receive basic profile information (such as your name and email address) from those providers as authorized by you.
• Photos.When you use the App’s core feature, you take or upload a photograph of yourself. This photo is processed to generate a simulated visualization based on your selected treatment type (e.g., Botox or filler), treatment zone (e.g., cheeks, jawline), and intensity level (e.g., subtle, balanced, defined).
• Purchase Information.When you purchase in-app credits, our subscription and purchase management provider, RevenueCat, processes transaction information necessary to complete your purchase, such as purchase history and credit/subscription status. We do not directly collect or store your payment card details; these are handled by Apple’s or Google’s payment systems and RevenueCat.

b) Information Collected Automatically

• Device and Usage Data. We and our service providers may automatically collect information such as device type, operating system, app version, unique device or advertising identifiers, crash logs, and general usage patterns (e.g., features used, session length, in-app interactions).
• Analytics Data. We use Microsoft Clarity to better understand how users interact with the App. Clarity may collect interaction patterns, navigation paths, and session behavior to help us improve the App experience (see Section 7). Your uploaded photos and any AI-generated visualizations are masked/blocked from Clarity session recordings and are never transmitted to or shared with Microsoft Clarity.
• Advertising and Conversion Data.Our website uses the TikTok Pixel, an analytics and advertising technology provided by TikTok Inc. and its affiliates (“TikTok”). The TikTok Pixel may collect information such as your IP address, browser and device information, pages viewed, and actions you take on our website (e.g., page views and button clicks), and may link this information to a TikTok account or advertising identifier associated with your device. We use this data to measure the performance of our TikTok advertising campaigns, attribute conversions to those campaigns, and build custom or lookalike advertising audiences. Your in-app photos and AI-generated visualizations are never shared with TikTok. See Section 7 for details on managing this tracking.
• Camera Permission. The App requests access to your device camera and/or photo library solely so you can take or select a photo for the treatment simulation feature. We do not access your camera or photo library at any other time or for any other purpose without your action.

c) Information We Do Not Collect

• We do not request or collect precise geolocation data.
• We do not knowingly collect personal information from children (see Section 13).

3. Facial Photos and Sensitive Data

We use your photo to provide the AI-based visual simulation you request, subject to the processing and safety practices described below. We do not use it to identify, verify, or authenticate you, and we do not create or store a biometric template, facial signature, or other identifier derived from your photo for identification purposes.

Because facial photographs may be sensitive under applicable law, we request your explicit, affirmative consent before sending an image for AI processing. The App identifies the AI providers and requires you to tap “Agree & Generate Preview” before processing begins. The image you select, which may be an uploaded photo or a previous generated result, is sent with editing instructions based on your selected treatment, zones, and intensity to fal.ai (FAL AI). FAL AI routes the request to OpenAI, the underlying AI model provider, to generate your visualization. The current model is GPT Image 2.5. Processing also includes applicable provider safety checks. See Sections 6 and 8 for provider use and retention details.

You may delete individual photos at any time within the App, or withdraw consent and request full deletion of your photos and account data at any time by contacting us at info@oxamind.com or via the in-app account deletion option (see Section 8).

EU/UK Representative

Where required by Article 27 of the GDPR and/or UK GDPR, OXAMIND LLC [has appointed / is in the process of appointing] a representative in the European Union and in the United Kingdom to serve as a point of contact for data subjects and supervisory authorities. Contact details: [Insert EU representative name/contact] / [Insert UK representative name/contact].

4. How We Use Your Information

We use the information described above to:

• Create and manage your account;
• Generate the AI-based treatment visualizations you request;
• Process in-app credit purchases and manage your credit/subscription balance;
• Maintain, troubleshoot, and improve the App’s functionality and performance;
• Understand aggregate usage trends through analytics;
• Communicate with you about your account or transactions;
• Detect, prevent, and address technical issues, fraud, or abuse;
• Comply with legal obligations.

5. Legal Basis for Processing (GDPR/UK GDPR)

Where GDPR or UK GDPR applies, we rely on:

• Consent — for processing your photograph and any other sensitive personal information, and for non-essential analytics or tracking.
• Contractual necessity— to create your account, process purchases, and deliver the App’s core features.
• Legitimate interests— to maintain and improve the App’s security and performance, where not overridden by your rights.
• Legal obligation — where processing is required to comply with applicable law.

You may withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out beforehand.

6. How We Share Your Information

We do not sell your personal information. We may share information with:

• fal.ai (FAL AI)— our AI processing intermediary, which receives the selected input image and editing instructions and routes them to OpenAI. Generated results return through FAL AI to our backend for storage and delivery to you. We use encrypted connections and configure generated media as private, with a requested expiration of 300 seconds (5 minutes), so our backend can retrieve the result. We also disable persistent storage of request and response payloads in FAL AI’s platform. These controls do not establish deletion of every provider copy or operational record and do not control OpenAI’s retention. FAL AI’s API Services Terms restrict use of client content to create, train, or develop its products or services, subject to the exclusions stated in those terms. See FAL AI’s API Services Terms.
• OpenAI — the underlying AI provider for the current image-editing model, GPT Image 2.5, accessed through FAL AI. OpenAI processes the input image and editing instructions and generates the result. OpenAI states that API data is not used to train or improve its models by default, unless the API customer explicitly opts in. Its standard API controls allow abuse-monitoring logs containing customer content to be retained for up to 30 days, with longer retention where required by law or reasonably necessary to protect its services or others from harm. Image inputs may also be retained for manual safety review when flagged for potential child sexual abuse material. The controls applicable to requests routed through FAL AI depend on its arrangement with OpenAI; we do not promise zero retention or deletion by OpenAI within 5 minutes. See OpenAI’s API data controls.
• RevenueCat — our subscription and purchase management provider, to manage and process in-app purchases, subscriptions, and credit balances.
• Microsoft Clarity — to provide analytics regarding App usage and interaction patterns. Photos and AI-generated visualizations are masked and are never sent to or accessible by Microsoft Clarity.
• TikTok — through the TikTok Pixel embedded on our website, TikTok receives information about your visit (such as pages viewed and actions taken) so we can measure advertising performance, attribute conversions to our TikTok ad campaigns, and build advertising audiences. TikTok acts as an independent controller of this data under its own privacy policy. Photos and AI-generated visualizations are never sent to or accessible by TikTok.
• Apple Inc. and Google LLC — as the platforms through which you download the App and make in-app purchases, each of which independently processes certain data under its own privacy policy.
• Cloud service and infrastructure providers — we use reputable third-party cloud infrastructure to host, store, and secure App data (including account credentials and stored photos) on our behalf, under contractual confidentiality and security obligations.
• Legal and safety disclosures — where required to comply with a legal obligation, protect our rights, or respond to lawful requests from public authorities.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to standard confidentiality protections.

Each named third party maintains its own privacy policy governing how it processes data; we encourage you to review these where publicly available.

7. Cookies and Tracking Technologies

The App and any associated web properties may use cookies, SDKs, or similar technologies for authentication, analytics, and purchase processing. Where required (e.g., under Apple’s App Tracking Transparency framework), we will request your permission before any tracking used for cross-app or cross-site advertising purposes. You can manage tracking permissions through your device settings at any time.

Our website also uses the TikTok Pixel, a cookie-based and device-identifier-based advertising and conversion-tracking technology, to measure the effectiveness of our TikTok advertising and to build advertising audiences, as described in Sections 2 and 6. This is a form of cross-site tracking for advertising purposes and, depending on your jurisdiction, may constitute “sharing” of personal information for cross-context behavioral advertising under the CCPA/CPRA. You can opt out by: (i) using your browser’s cookie and tracking-protection settings to block third-party advertising cookies and identifiers, (ii) adjusting your ad preferences directly through your TikTok account settings, or (iii) contacting us at info@oxamind.com to exercise the rights described in Section 10. Where consent for such tracking is required by applicable law, we will obtain it before the TikTok Pixel is activated.

8. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy:

• Photos during AI processing— our 5-minute expiration setting applies to generated media covered by FAL AI’s media lifecycle control. It does not establish a 5-minute retention limit for input images, OpenAI processing, safety-review copies, or other provider records. Request and response payload storage is separately disabled on FAL AI’s platform. OpenAI’s standard abuse-monitoring and safety-retention practices are described in Section 6. Deleting a photo or account from the App does not necessarily immediately delete records retained by providers for security, abuse prevention, or legal compliance.
• Account data and photos — retained for as long as you maintain your account. You may delete individual photos at any time within the App. If you delete your account, all associated data — including your account information, stored photos, and credit/purchase history — is permanently deleted from our systems, except where certain records must be retained for legal, tax, or accounting purposes as described below.
• Purchase records — retained as required for accounting, tax, and legal compliance, and as required by Apple, Google, or RevenueCat, our subscription and purchase management provider. These records are retained by RevenueCat independently of your account and are not deleted when you delete your Aesthetix App account, where legally required.
• Analytics data — Microsoft Clarity retains session recording data for a default period of up to 30 days from the time of recording, generally in aggregated or pseudonymized form, unless a different retention configuration applies. Photos and AI-generated visualizations are masked within session recordings and are not retained by or shared with Microsoft Clarity.
• Advertising and conversion data— data collected through the TikTok Pixel is retained by TikTok in accordance with TikTok’s own privacy policy and retention practices, which we do not control. You may manage or limit this retention through your TikTok account settings or your browser’s tracking controls, as described in Section 7.

You may request earlier deletion of your data as described in Section 10.

9. International Data Transfers

Because the App is available worldwide and our service providers (including FAL AI, OpenAI, Google, Microsoft Clarity, and TikTok) may operate and store data in countries other than your own — including the United States — your information may be transferred to, stored, and processed in jurisdictions with different data protection laws than your own. Where required by GDPR/UK GDPR, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent mechanisms.

10. Your Privacy Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Deleteyour personal information (“right to erasure”);
• Restrict or object to certain processing;
• Data portability — receive your data in a portable format;
• Withdraw consent at any time, where processing is based on consent;
• Opt out of the sale/sharing of personal information and of targeted advertising or profiling (CCPA/CPRA);
• Non-discrimination for exercising your privacy rights;
• Lodge a complaint with your local data protection authority.

To exercise these rights, contact us at info@oxamind.com. We will respond within the timeframe required by applicable law.

California Residents: Under the CCPA/CPRA, you have the right to know, delete, correct, and opt out of the sale/sharing of personal information, and to limit use of sensitive personal information (which may include your photograph). We do not sell personal information for monetary consideration.

Canada (PIPEDA): You may request access to and correction of your personal information as recognized under Canadian federal privacy law.

Brazil (LGPD): You have rights of confirmation, access, correction, anonymization, portability, and deletion of personal data, and may lodge complaints with the ANPD.

Australia (Privacy Act 1988): You may access and seek correction of your personal information and lodge complaints with the Office of the Australian Information Commissioner (OAIC).

11. Apple App Store Disclosures

In accordance with Apple’s App Store Review Guidelines and privacy “Nutrition Label” requirements, we disclose the categories of data collected as summarized in this Policy, including contact information, user content (photos), identifiers, usage data, and purchase information. Where the App uses tracking as defined by Apple’s App Tracking Transparency (ATT) framework, we will request your explicit permission via the system-level prompt before any such tracking occurs.

12. Google Play Data Safety Disclosures

In accordance with Google Play’s Data Safety requirements, we disclose that the App collects and/or processes: personal information (email, account identifiers), photos, financial/purchase information, app activity, and device/diagnostic information, as described throughout this Policy. Data is transmitted securely and, where applicable, encrypted in transit.

13. Children's Privacy and Minimum Age

The App is intended for use only by individuals who are at least 18 years old. We do not knowingly permit use of the App by, or collect personal information from, anyone under 18. By creating an account, you represent and warrant that you meet this minimum age requirement.

If we become aware that we have inadvertently collected personal information from someone under 18, we will take steps to delete it and terminate the associated account promptly. Parents or guardians who believe a minor has provided us with personal information may contact us at info@oxamind.com.

OXAMIND maintains this 18+ eligibility rule for Aesthetix App because of its facial-photo and aesthetic-treatment visualization features. It applies regardless of any different minimum age a third-party provider may permit for other services or applications.

14. Data Security

We implement reasonable technical and organizational measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including encryption in transit and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. We will post the revised Policy with an updated “Last Updated” date and, where required by law, provide additional notice or obtain renewed consent for material changes.

16. Contact Us

OXAMIND LLC
Email: info@oxamind.com