Privacy policy
Data controller
The individual who operates PureFaceLab (Türkiye) is responsible for your personal data. For any privacy request: info@purefacelab.com. This policy has been prepared with regard to Türkiye’s Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).
What data we process
Account: name, email, language preference and an irreversible hash of your password. Care records: skin profile, journal, routine, products, reminders and the photos you upload. Photo analysis: your consent record and analysis results. Subscription: plan, status, period dates and Paddle customer/subscription IDs; your card details never reach us. Technical: IP address, browser information and session cookies, for security and troubleshooting.
Why, and on what legal basis
To provide your account, care tracking and subscription (performance of a contract); for photo analysis (your explicit consent, which you can withdraw at any time); to keep the service secure and prevent abuse (legitimate interests); and to meet legal obligations such as accounting and tax. We do not sell your data or use it for advertising. Consent for the skin profile and care journal is asked separately on first use; you can withdraw it in Account → Settings, and these records are then deleted.
Who we share it with
Only with the providers needed to run the service: Supabase (database and file storage, Frankfurt), Vercel (hosting), Resend (account emails, Ireland), Paddle (payments and invoicing; as Merchant of Record under its own privacy policy), Anthropic (only when you request an analysis and with your consent, USA), Google (if you choose Google sign-in), Cloudflare Turnstile (security check) and Google Fonts (fonts). Some providers may process data outside Türkiye and the EU; such transfers rely on the providers’ contractual safeguards and, where required, your explicit consent. We do not share your data with anyone else unless the law requires it.
How long we keep it
Your account data and photos are kept while your account is open; when you delete your account, your personal records and photos in the app are deleted. You can delete analysis results one by one. Payment and invoice records are kept by Paddle for the legally required periods. Providers’ technical logs and backups are deleted on their own schedules.
Your rights
You have the right to access, correct, delete and port your data (download it as JSON from account settings), to object to processing and to withdraw your consent (KVKK art. 11, GDPR arts. 15–22). Email your request to info@purefacelab.com; we reply within 30 days at the latest. You can complain to the Personal Data Protection Authority in Türkiye or to the data protection authority of your country in the EU.
Cookies
We only use cookies needed to keep you signed in, complete security checks and remember your language. There are no advertising or visitor analytics cookies.
Children
The service is not intended for people under 18 and we do not knowingly collect data from children. Photo analysis does not comment on photos of people who appear to be under 18.
Changes
We may update this policy; we will announce important changes on the site and, where needed, by email. Last updated: 2 October 2026.
Write to us
For questions not answered here and for requests about your data, you can email us. For account matters, writing from your registered email address makes things easier; never share your password or the links in our emails. info@purefacelab.com