Privacy Policy

ScalpSaver · Last updated: June 30, 2026 · Effective: June 30, 2026

1. Scope and Eligibility

This Policy applies to all users of ScalpSaver. You must be at least 13 years old to use the Service. Users between 13 and 17 (or the age of majority in their jurisdiction) must have permission from a parent or legal guardian. We do not knowingly collect personal information from anyone under the age of 13. See Section 14 for details.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: your name and email address when you create an account.
• Profile information: any optional details you choose to add (such as hair type, goals, or notes about your routine).
• Photos & Face Data: images of your hair, scalp, or related areas that you capture or upload through the app for analysis. Photos and any inadvertently captured face data are processed ephemerally and discarded immediately after analysis — see Section 3.
• Communications: messages you send to our support team and your responses to surveys or feedback requests.

2.2 Information Collected Automatically

• Device information: device model, operating system and version, language settings, time zone, and mobile carrier.
• Usage data: features used, screens viewed, session duration, in-app actions, and crash logs.
• Identifiers: device identifiers (such as IDFA on iOS or Android Advertising ID, where permitted) and an internal account identifier.
• Approximate location: derived from IP address only; we do not collect precise GPS location.

2.3 Information We Do Not Collect

• We do not collect payment card numbers, bank account details, or other financial account information. Subscription payments are handled entirely by RevenueCat and your platform's app store (Apple App Store or Google Play). See Section 6.
• We do not collect precise GPS location.
• We do not collect Apple TrueDepth API data or any biometric mapping.
• We do not access your contacts, calendar, microphone, or files outside of photos you explicitly select or capture.

3. How We Handle Your Photos and Face Data

• Collection and Use: Photos (and any accompanying visual face data) are collected and used solely to analyze your hair density and recession patterns to provide the informational output requested within the app.
• Sharing and Disclosure: To perform the analysis, your photos are transmitted securely to our AI partner (Google Gemini API). Photos and face data are never shared with any other third parties, data brokers, or advertisers.
• Storage and Retention: We do not store your photos or face data on our servers. They are processed entirely statelessly (in transit/memory only) and are completely discarded and deleted immediately after the analysis result is generated.
• Access: Our personnel do not access your photos or face data. They are processed by automated systems only.
• No biometric identification: We do not use facial recognition or biometric identification on your photos.
• No AI/ML training: We do not use your photos to train artificial intelligence or machine learning models.
• Analysis results: The textual or numerical results generated from your photos (for example, scores, categories, or notes) may be saved to your account so you can view your history. These results do not contain the original images or any facial data.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service and its features;
• Create and manage your account;
• Process subscriptions through RevenueCat and the relevant app store;
• Communicate with you about your account, updates, security notices, and support requests;
• Send service-related and (where you have opted in) promotional emails — you can opt out of promotional emails at any time;
• Detect, prevent, and address fraud, abuse, security incidents, and technical issues;
• Analyze usage to understand how the Service is used and to improve features (using aggregated or de-identified data wherever possible);
• Comply with legal obligations and enforce our Terms of Service.

5. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

All service providers are bound by contractual obligations to protect your information and use it only for the purposes we specify.

6. Payments and Subscriptions

Subscription purchases are processed by RevenueCat, Inc. in combination with the Apple App Store or Google Play. We do not see, store, or process your payment card or bank account information. RevenueCat receives a pseudonymous user identifier and your subscription status to manage entitlements. For details on how RevenueCat handles data, see the RevenueCat Privacy Policy. For payment processing itself, refer to Apple's Privacy Policy or Google's Privacy Policy as applicable.

7. Data Retention

We retain personal information only as long as needed for the purposes described in this Policy:

• Account data — for the life of your account, plus up to 24 months after account closure to handle disputes and legal obligations.
• Photos and Face Data — not retained. Discarded immediately after analysis is complete.
• Analysis results / history — retained for the life of your account; deleted when you delete the entry or close your account.
• Support communications — up to 24 months from ticket closure.
• Usage and analytics data — up to 24 months in identifiable form; aggregated or anonymized data may be kept indefinitely.
• Server and security logs — up to 12 months.
• Records required by law — for the period required by applicable law (for example, tax records).

You can request deletion of your information at any time (see Section 10).

8. Security

We use commercially reasonable administrative, technical, and physical safeguards to protect your information, including encryption in transit (TLS) and at rest, access controls, and routine security reviews. No system is perfectly secure, however, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

9. International Data Transfers

ScalpSaver is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States and other countries where our service providers operate. For users in the European Economic Area, the United Kingdom, or Switzerland, we rely on Standard Contractual Clauses or other lawful transfer mechanisms to protect your information.

10. Your Privacy Rights

Depending on where you live, you may have rights to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your personal information;
• Receive a portable copy of your information;
• Restrict or object to certain processing;
• Withdraw consent where we rely on it;
• Lodge a complaint with a data protection authority.

You can exercise most rights directly in the app:

• Delete your account: go to Settings → Account → Delete Account within the app. This will permanently delete your account and associated personal information, subject to limited retention required by law (such as tax records or fraud-prevention logs).
• Update your information: edit your name, email, or other profile details in Settings → Account.
• Delete history entries: remove individual analysis results from your history at any time.

You can also exercise any of your rights by emailing us at scalpsaver@yahoo.com or writing to us at the postal address in Section 17. We will respond within the timeframe required by applicable law (typically 30–45 days). We will not discriminate against you for exercising your rights.

11. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), gives you specific rights regarding your personal information.

11.1 Categories We Collect

In the past 12 months, we have collected the following categories of personal information:

• Identifiers — name, email, device identifiers, IP address;
• Customer records — account information you provide;
• Internet or network activity — usage data within the app;
• Visual information — photos/face data you submit of your hair and scalp for analysis (processed statelessly and not retained — see Section 3);
• Inferences — limited inferences drawn from app usage to personalize your experience.

11.2 Sources and Purposes

We collect these categories directly from you and automatically from your device, for the purposes described in Section 4.

11.3 Sale or Sharing of Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We have not done so in the past 12 months. We do not have actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

11.4 Sensitive Personal Information

We do not use or disclose sensitive personal information for purposes beyond those permitted under CCPA/CPRA without offering you the right to limit such use.

11.5 Your California Rights

• Right to know what personal information we collect, use, disclose, and (if applicable) sell or share;
• Right to delete personal information we have collected from you;
• Right to correct inaccurate personal information;
• Right to opt out of the sale or sharing of personal information (not applicable, as we do not sell or share);
• Right to limit use of sensitive personal information;
• Right to non-discrimination for exercising these rights.

To exercise these rights, you can:

• Delete your account directly in the app at Settings → Account → Delete Account;
• Email us at scalpsaver@yahoo.com with the subject line "California Privacy Request"; or
• Write to us at the postal address listed in Section 17.

You may use an authorized agent to make a request on your behalf, subject to verification.

12. EU / UK Residents (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation ("GDPR") and equivalent laws give you specific rights.

12.1 Data Controller

ScalpSaver is the data controller for the personal information processed through the Service. You can contact us at scalpsaver@yahoo.com.

12.2 Legal Bases for Processing

12.3 Your GDPR Rights

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent at any time without affecting prior lawful processing. You also have the right to lodge a complaint with your local data protection authority.

12.4 International Transfers

When we transfer your information outside the EEA/UK, we rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, or other approved safeguards.

13. CalOPPA Disclosures

The California Online Privacy Protection Act ("CalOPPA") requires the following disclosures:

• You can review and request changes to your personal information by signing in to your account or contacting us.
• We notify users of material changes to this Policy by posting an updated version in the app and, where appropriate, by email.
• Do Not Track signals: our Service does not currently respond to "Do Not Track" browser signals, because no industry standard for honoring them has been finalized. We do not allow third parties to collect personally identifiable information about your online activities over time and across different websites when you use our Service.

14. Children's Privacy (COPPA)

ScalpSaver is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you are under 13, do not use the Service or submit any information to us.

If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will delete that information as quickly as possible. If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at scalpsaver@yahoo.com so we can take appropriate action.

For users between 13 and 17 (or the age of majority in their jurisdiction), we recommend involving a parent or guardian and only providing information you are comfortable sharing.

15. Third-Party Services

The Service may contain links to or integrate with third-party services. We are not responsible for the privacy practices of those third parties. The third-party processors we currently rely on include:

• RevenueCat — subscription management;
• Apple and Google — app distribution and payment processing.

This list may change as our service providers change. Material changes will be reflected in updates to this Policy.

16. Changes to This Policy

We may update this Policy from time to time. When we do, we will update the "Last updated" date above. For material changes, we will provide additional notice (such as an in-app notice or email) before the changes take effect. Your continued use of the Service after changes become effective constitutes your acceptance of the updated Policy.

17. Contact Us

If you have questions, requests, or concerns about this Policy or our privacy practices, contact us at:

Email: scalpsaver@yahoo.com

Mail:
ScalpSaver
6469 Almaden Expy, Ste 80 #507
San Jose, CA 95120
United States

Please include enough detail for us to identify your account and respond to your request. We will respond within the timeframes required by applicable law.

© 2026 ScalpSaver. All rights reserved.