Privacy Policy

This is a plain-English privacy policy for Peakgenic (peakgenic.com), a product operated as part of the Opsibyte portfolio. It is written to be genuinely readable, not to bury the important parts — but it is not a substitute for legal advice, and if you have specific compliance requirements you should have a lawyer review it against your situation.

1. Who we are

Peakgenic is the data controller for the information described below. You can reach us at [email protected] for any privacy question, request, or complaint.

2. What we collect

Here is what Peakgenic handles when you sign in, join the waitlist, or analyse a photo.

• Account information — your email address, and anything else you provide when you sign up or sign in (we use passwordless / magic-link sign-in, so we never store a password).
• Waitlist information — your email address. If you separately opt in on the waitlist or sign-in form, we also collect limited first-touch and last-touch acquisition details: campaign tags, selected ad click IDs, the external referrer host, and landing page path.
• Your photo — when you choose to analyse a photo, you first see a short consent line and tap "I agree". Nothing is uploaded or analysed before that. Facial landmarks and measurements are computed on our own server. The photo (sent at low detail) and the measurements are shared with Microsoft Azure, our AI processor, to write your plan, tips, skin and style advice, and, when available, style previews. We do not store your photo. Photos are shared only with Microsoft Azure, are never sold and are never used for training.
• Your report — the measurements and report derived from your photo (your proportions map, tips, skin and style advice and plan text; no images). We keep it until you delete it.
• Payment information — card details are handled by our payment providers (Stripe on the web, Apple in the iOS app); we never see or store full card numbers.
• Device and access data — hosting logs may contain request metadata such as IP address, browser type, and timestamps. Aggregate Umami analytics runs only when a website ID is configured.
• Cookies — a small number of strictly-necessary cookies for signing you in and remembering your session. We don't use third-party advertising or cross-site-tracking cookies.

3. Why we collect it, and our legal basis

We use account data to sign you in and keep your reports, and waitlist data to send the launch updates you asked for. We use your photo, with your consent, to produce your report. The consent line in the app says the same thing in short: your photo is analysed on our servers and by Microsoft Azure AI to build your plan, tips, skin and style advice, with style previews added when they are available. We collect acquisition details only after you opt in, to measure which channels bring people to Peakgenic; the checkbox is optional, and leaving it unchecked does not affect sign-in or joining the waitlist.

4. Who we share it with

We don't sell your data, and we don't share it for advertising. We use a small set of service providers (subprocessors) to run Peakgenic, each of whom only receives what they need to do their specific job:

• Hosting & database — our own server, running a self-hosted PostgreSQL database.
• AI processing — Microsoft Azure AI is our AI processor. It receives your photo (low detail) and your measurements to write your plan, tips, skin and style advice, and, when available, style previews. It is the only party your photo is shared with.
• Email delivery — Amazon SES sends sign-in links and the emails you have opted in to.
• Payments — Stripe (web) and Apple (iOS), with RevenueCat managing iOS subscription status.

Microsoft Azure may keep a sample of inputs, including your photo, for up to 30 days solely to monitor for abuse, unless our application for modified abuse monitoring is approved.

We may also disclose data if legally required to (e.g. a valid court order), or to protect the rights, safety, or property of Peakgenic, our users, or the public.

5. Cookies & analytics

We use strictly-necessary session cookies (to keep you signed in) and privacy-respecting, aggregate analytics to understand which pages are working and which aren't. We don't run third-party ad-tracking pixels, and we don't build cross-site advertising profiles.

If you opt in to source tracking, campaign tags, ad click IDs, referrer host, and landing page path are saved in this browser's local storage and attached to the waitlist email or account you submit. We use the details to understand acquisition sources, not to target ads. If you do not opt in, those source details are not saved or attached to your email, account, or purchase. You can clear the saved browser copy below; email us to request deletion of a copy already associated with your account or waitlist entry.

6. Data retention

Photos: we do not store your photo, preview images or landmark data. They are held in memory while your photo is analysed and then discarded. Azure's own abuse-monitoring retention is described in section 4.

Reports: the report data derived from your photo is stored until you delete it. Email-list data (your email address, consent records and queued emails) is deleted immediately when you use "Delete my data". For everything else, including your account and your report or plan, email [email protected] and we will delete it on request.

Purchase records: when you delete your account, we keep your purchase records for up to 6 years, unlinked from you, because Spanish accounting law requires it.

We keep encrypted nightly backups of our database so we can recover from failures. Backups are stored in the United States and expire on a rolling schedule of up to 12 months: daily copies after 14 days, weekly copies after 8 weeks and monthly copies after 12 months. Because we clear out old copies once a week, a copy can stay up to a week past its expiry. When you delete your data it is removed from our live systems right away and drops out of backups as they expire. Backups never contain photos.

7. Your rights

Wherever you're located, you can ask us to: access the personal data we hold about you; correct it if it's wrong; delete it; export it in a portable format; or object to / restrict certain processing. If you're in the EU/UK, these are your rights under GDPR; if you're in California, similar rights exist under the CCPA/CPRA. To exercise any of these, email [email protected] — we'll respond within about 30 days.

8. Children's privacy

Photo analysis is for adults 18 and older. If you believe a minor has provided us personal data, contact us and we will address the request.

9. International data transfers

Our infrastructure and service providers may process data outside your country of residence, including in the United States. Where required, we rely on standard contractual clauses or equivalent safeguards recognized under applicable data-protection law for these transfers.

10. Security

We use industry-standard measures — encryption in transit (HTTPS/TLS), access controls, and a managed database provider with its own security practices — to protect your data. No system is perfectly secure, but we take reasonable steps appropriate to the sensitivity of what we hold, and we never ask for credentials or account access we don't need.

11. Changes to this policy

We may update this policy as Peakgenic evolves. The version at peakgenic.com/privacy always governs, and we'll update the "Last updated" date above when we make a change. For material changes, we'll make reasonable efforts to notify active users by email.

12. Contact

Questions, requests, or complaints about this policy: [email protected].