Who we are and where this policy applies
This policy is issued by Hub XP Tecnologia e Negócios Ltda., registered in Brazil under CNPJ No. 42.478.233/0001-44, with offices at Alameda Terracota, 215, suite 1017, Cerâmica, São Caetano do Sul, SP, 09531-190, Brazil (“Skinshot”, “we” or “us”), which runs the platform available at skinshot.care.
It covers three parts of the platform:
- The skin analysis and the report: the flow where you answer a short questionnaire, take a selfie and get a report with a skincare routine. It is shown under the brand of the company offering it (the “Brand”), at addresses such as
skinshot.care/en/a/<brand>, on a Brand subdomain or embedded in the Brand's website. - The Skinshot website, including the demo request form.
- The dashboard, used by Brand teams to see analyses and contacts and to manage their catalog, branding and users.
Who is responsible for your data
In the skin analysis, the Brand is the controller of the data. The Brand decides to offer the analysis to its customers, chooses whether to ask for your contact details, receives them and uses its own product catalog. The Brand's name is shown on the consent screen and in the report.
Skinshot acts as a processor: we handle that data on the Brand's behalf and under its instructions, to run the analysis, produce the report and show the results in the Brand's dashboard. The Brand is responsible for explaining, in its own privacy notice, how it uses your contact details.
Skinshot is the controller of the data on its website and in demo requests, of dashboard accounts and of the technical data we use to keep the platform secure and running.
In practice: for questions about how the Brand uses your contact details (messages, offers), contact the Brand. For anything else, or if you are not sure who to ask, write to hi@skinshot.care. We will help or pass your request on.
What data we handle
In the skin analysis
- Selfie (photo of your face). Taken with the camera or uploaded from your gallery. Before it leaves your device, the image is cropped to the guide circle and scaled down to at most 1024 × 1024 pixels. As a picture of your face, we treat it as sensitive (biometric) personal data, processed with your specific consent. See The selfie and the AI analysis.
- Questionnaire answers. Skin type (as you perceive it), up to three main concerns, goal, age range, how often you use sunscreen, whether you are pregnant, breastfeeding or trying to conceive and, if you choose to share them, allergies or sensitivities (free text up to 200 characters). Pregnancy and allergies are health data and are also treated as sensitive data.
- Analysis result. Skin type, scores from 0 to 100 (hydration, oiliness, evenness, texture, pores, redness, firmness and under-eye area), conditions observed per facial zone, a care plan and the recommended routine with items from the Brand's catalog.
- Contact details, if you choose to share them or the Brand requires them. Name, email and WhatsApp number. They are only saved if you tick the box agreeing to be contacted by the Brand. We also record whether you agreed to receive news and offers from the Brand.
- Consent record. Date and time, version and exact text of the consent screen you accepted, in the language it was shown in.
- Visit source. Campaign parameters in the link (
utm_*andref), which tell the Brand whether you came through a campaign, a content creator or a QR code. - Technical data. Language, browser identification (user agent) and a code derived from your IP address (a SHA-256 hash with a secret key). The IP address itself is not saved: the code is only used to limit the number of analyses per connection and prevent abuse. We also log the AI model used, the response time and any technical errors.
- Usage events. A random identifier created in your browser tab, not linked to your name, and events such as starting the analysis, giving consent, finishing the questionnaire, sending the photo (camera or gallery, and whether the lighting was good), providing or skipping contact details (we only record whether an email or phone number was given, never the values), viewing the report and clicking on products, cart, PDF, WhatsApp and share.
On the website and in demo requests
Name, work email, company, phone number (if provided), segment, message, language and campaign parameters from the link. We use this data to reply to your request.
In the Brand dashboard
Name, email, password (stored only as a hash), role and the Brands the person can access; invitations (email, role and expiry); sign-in sessions, with IP address and browser recorded by the authentication system; and password reset links, stored only as a hash.
What we don't do
- We do not store your selfie in databases, files or server logs.
- We do not use your photo for facial recognition or to identify you. The AI only assesses visible skin characteristics.
- We do not show your name, email or phone number in the report, the PDF or the share image.
- We do not sell personal data, and we do not use advertising cookies or third-party tracking pixels.
Why we use the data and on what legal basis
Every use has a legal basis under the LGPD. For sensitive data (the selfie and the health data in the questionnaire), the basis is your specific, prominent consent.
| Purpose | Data | Legal basis (LGPD) |
|---|---|---|
| Run the AI skin analysis and produce your report | Selfie and questionnaire answers | Specific and prominent consent (art. 11, I) |
| Build the routine with the Brand's products and services, avoiding actives that are not advised during pregnancy, with allergies or for sensitive skin | Questionnaire and result | Consent (art. 11, I) |
| Let the Brand contact you about your analysis | Name, email and WhatsApp | Consent (art. 7, I), given with the checkbox |
| News and offers from the Brand | Contact details and marketing choice | Consent (art. 7, I), optional |
| Prove that consent was given | Consent record | Compliance with a legal obligation (art. 7, II) and exercise of rights (art. 11, II, “d”) |
| Funnel and source metrics for the Brand (campaigns, creators, QR codes) | Usage events and visit source | Legitimate interest (art. 7, IX), with minimized data |
| Security, abuse prevention and usage limits | IP-derived code, browser and technical logs | Legitimate interest (art. 7, IX) |
| Reply to demo requests | Form data | Pre-contractual steps at your request (art. 7, V) and legitimate interest (art. 7, IX) |
| Create and protect dashboard accounts, send invitations and password reset links | Account and session data | Performance of a contract (art. 7, V) and legitimate interest in security (art. 7, IX) |
For people in the European Economic Area, the equivalent GDPR bases are explicit consent (arts. 6(1)(a) and 9(2)(a)), performance of a contract and pre-contractual steps (art. 6(1)(b)), legal obligations (art. 6(1)(c)) and legitimate interests (art. 6(1)(f)).
Where the basis is legitimate interest, you can object to that use through the channels in Your rights.
The selfie and the AI analysis
- On your device. The camera opens in the browser, no app needed. The image is cropped to the circle and scaled down before it is sent.
- Sent once. The selfie travels over an encrypted connection (HTTPS), together with your questionnaire answers, in a single request to our server.
- Analysis. The server checks the image format and size and passes it, with your answers, to the AI model through Vercel AI Gateway. The model returns a structured skin assessment. Your name, email and phone number are never sent to the AI.
- Discarded. When the request ends, the image no longer exists on the server. It is never written to a database or file, and error messages are filtered so that no image ever reaches the technical logs.
Zero retention at the AI. The integration only uses providers in Zero Data Retention mode: they process the request and do not store the image or its content after responding. Today the primary model is from Google (Gemini), with models from Anthropic (Claude) and OpenAI (GPT) as automatic fallbacks if it fails. Models may change over time, always with this same setting.
In your browser. To show your photo in the report, a copy is kept only in the tab where you took the analysis (sessionStorage) and disappears when you close it. Anyone opening the report link on another device does not see your photo. The story image only includes your photo if you turn that option on, and it is generated on your own device.
Unsuitable photo. If the image does not show a face or is not good enough, the analysis is rejected and you can take another photo. In that case we keep a record of the attempt, without the photo, with the technical reason for the rejection.
Automated decision. The result is produced automatically and is only cosmetic guidance: it has no legal effect and decides nothing about you. Even so, you can ask for information about the criteria used and request a review, under art. 20 of the LGPD.
Who we share data with
The Brand. The Brand's team sees, in its dashboard, the analyses taken through its link: questionnaire answers, result, recommendations and visit source. If you agreed to be contacted, it also sees your name, email, WhatsApp number and your choice about news and offers, and can export these contacts as a spreadsheet (CSV). Access is limited to people the Brand has invited, as managers or read-only viewers.
The Skinshot team. A small number of administrators access data when needed to run the platform, support Brands and keep things secure.
Service providers (sub-processors) that help us deliver the service:
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting and running the application; access to AI models (AI Gateway) | Application in the São Paulo region (Brazil); US-based company |
| Supabase | PostgreSQL database | São Paulo region (Brazil) |
| Google, Anthropic and OpenAI | AI models that analyze the selfie, in Zero Data Retention mode | United States and other countries where these providers operate |
| Resend | Dashboard emails (invitations and password resets) and demo request notices to our team | United States |
| Google Fonts | Fonts on the website, which your browser downloads from Google's servers | United States |
Anyone with the report link. The report lives at a unique, hard-to-guess address, is not listed by search engines and shows no contact details. Anyone with the link can open it, so only share it with people you want to see it.
Authorities, when required by law, a court order or a request from a competent authority.
We do not sell or rent personal data.
International transfers
The application and the database are in Brazil, in the São Paulo region. The AI analysis, however, is carried out by providers that may process the request in the United States or other countries, and some providers in the table above are foreign companies. If you use Skinshot from outside Brazil, your data is also transferred to Brazil.
These are international data transfers, which we carry out under the mechanisms of art. 33 of the LGPD and the ANPD regulations, such as contractual clauses with providers, and always with the safeguards described in this policy, such as zero retention at the AI.
How long we keep data
- Selfie: not stored on the server. In your browser, it stays only in the analysis tab until you close it.
- Analysis, answers, result, contact details and consent record: while the Brand uses Skinshot and the data is needed for the purposes in this policy, or until you delete it from the report or ask for deletion. When the relationship with the Brand ends, we follow its instructions to delete the data, unless the law requires us to keep it longer.
- Usage events: events linked to an analysis (such as report views and clicks) are deleted with it. Anonymous funnel events, which are not linked to an analysis or a person, are kept for aggregate metrics.
- Deletion credential in your browser: until you delete the analysis or clear your browser data.
- Demo requests: as long as needed to reply and follow up on the business conversation, or until you ask for deletion.
- Dashboard accounts: while the account is active. Sessions expire within 7 days, invitations after 7 days and password reset links after 1 hour.
- Technical logs kept by our hosting providers: for short periods set by those providers, for security and troubleshooting.
Your rights and how to exercise them
Under the LGPD (art. 18), you can ask for:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
- portability of your data to another provider;
- deletion of data processed on the basis of your consent;
- information about who we share your data with;
- information about the option of not giving consent and what that means;
- withdrawal of consent, at any time;
- objection to processing based on legitimate interest;
- review of decisions made solely through automated processing (art. 20).
If you are in the European Economic Area or another country, you also have the rights granted by your local law, such as the GDPR rights of access, rectification, erasure, restriction, portability and objection.
Delete your analysis from the report
In the report, use “Delete my data”. The option appears in the browser you used for the analysis, because only that browser holds the deletion credential; this way, someone who receives the report link cannot delete it. Deletion is permanent: it removes the analysis, answers, result, your contact details, the consent record and the events linked to it, and the report link stops working. Only an audit entry with the report code remains; it holds no report content or contact details.
Other requests
If you took the analysis on another device or want to exercise another right, contact the Brand (the controller) or write to hi@skinshot.care. To find your analysis safely, we may ask for the report link and the email or phone number you provided. We reply within the legal deadlines and, when the request is for the Brand to handle, we forward it and support the response.
Withdrawing consent does not affect what was done before. Without consent for the photo, the analysis cannot be done. Without agreeing to be contacted, you still get your report as usual, unless the Brand requires contact details to run the analysis.
You can also lodge a complaint with Brazil's National Data Protection Authority (ANPD) at gov.br/anpd, or, in the European Economic Area, with the data protection authority of your country.
Security
We apply technical and organizational measures in proportion to the risk, including:
- encrypted connections (HTTPS) on every page and request;
- the selfie is processed in memory only and never saved;
- IP addresses kept only as an irreversible code generated with a secret key;
- passwords stored as hashes; invitation and password reset links stored only as hashes and with limited validity (password links can be used once);
- the report deletion credential is cryptographically signed and kept only in the browser of the person who took the analysis;
- dashboard access by invitation only, separated by Brand and by role (manager or viewer);
- usage limits per connection and per Brand to curb abuse;
- reports excluded from search engines and free of contact details.
No system is completely immune to failure. If a security incident could create relevant risk or harm, we will notify the Brand, the ANPD and the people affected, as required by art. 48 of the LGPD.
Under-18s
The analysis is for adults aged 18 and over only. The questionnaire asks for your age range before the selfie: anyone who says they are under 18 sees a closing screen, and no photo is sent. The server also refuses any analysis with that answer.
The dashboard and the website are intended for adult professionals. If we learn that we hold a minor's data without the authorization required by law, we will delete it.
Cosmetic guidance, not medical advice
The analysis assesses visible skin characteristics from a photo and your answers. It is cosmetic guidance: it is not a medical diagnosis, not a medical device, and it does not replace a visit to a dermatologist or other health professional. If you notice signs such as spots that change shape or color, bleeding, pain or persistent irritation, see a doctor. More in the Terms of Use.
Stores, links and third-party services
The report may take you to the Brand's store (for example, a Shopify store), to WhatsApp or to other websites. Purchases and conversations happen on those services, under their own privacy policies. On WhatsApp, the message comes pre-filled with the items and the report link, and you decide whether to send it.
Product links carry source parameters (utm_source=skinshot, utm_medium, utm_campaign and the report code in ref) so the Brand knows the visit came from the analysis. Product images may be loaded from the Brand's store servers.
Changes to this policy
We may update this policy to reflect changes in the service or the law. The date at the top shows the version in force, and significant changes will be highlighted on this page. Every analysis asks for your consent before the photo, and we keep the exact version of the text you accepted.
Contact and data protection officer
Skinshot: Hub XP Tecnologia e Negócios Ltda., CNPJ 42.478.233/0001-44, Alameda Terracota, 215, suite 1017, Cerâmica, São Caetano do Sul, SP, 09531-190, Brazil.
Data protection officer (DPO, “encarregado”): Felipe Maffezzolli, at hi@skinshot.care.
For questions about how a Brand uses your contact details, you can also contact the Brand directly.