Privacy Policy

This Privacy Policy explains how Face & Color (“Face & Color”, “we”, “us”) collects and uses personal data when you use faceandcolor.com (the “Service”), who processes it, how long we keep it and what rights you have.

Who is responsible

Face & Color is operated by Chen Zhe, an individual based in the People’s Republic of China, who is the controller of your personal data. Privacy questions and requests: support@faceandcolor.com. We have not appointed a data protection officer.

Photos and facial geometry (biometric data)

Facial geometry can be biometric information under laws such as the Illinois Biometric Information Privacy Act (BIPA), Texas CUBI and Washington’s My Health My Data Act. This is how we handle it:

• On-device tools. When you use a tool (color analysis, face shape detector, undertone test, drape test, symmetry, golden ratio, canthal tilt), your photo is loaded into your browser and analyzed there. The photo, the facial landmarks and the measurements are not uploaded to us. You can check this in your browser’s developer tools (Network tab).
• AI features. The AI analysis, style report and try-ons upload a photo only after you have signed in, bought a plan and separately agreed to biometric processing (you confirm you are 18 or older and that the photo is of you). Your browser crops the photo to head and shoulders first. The crop is checked for NSFW content, sent to our AI provider and used only to create your analysis, report and try-ons.
• Retention. Photos and generated images are deleted from our systems within 24 hours; download what you want to keep. Our AI provider deletes uploaded photos within 24 hours and, under its own policy, keeps generated images for up to 14 days and request logs for up to 2 months. Report text and palettes contain no biometric data and stay in your account until you delete them.
• No other use. We never sell, lease or trade biometric data, and we don’t use it for identification, advertising or model training.

Full details: Biometric Privacy Notice.

What we collect

• Account data — your name, email address and profile picture. If you sign up with email, we store your password only as a secure hash. If you sign in with Google, we receive your name, email address and profile picture from Google, along with the sign-in tokens it issues; we never receive your Google password.
• Photos and generated images — only for the AI features, as described above.
• Consent records — when and what you agreed to before a photo was uploaded.
• Purchases — your plan, the credits granted to you and spent, the products you bought and order references. Payments are processed by Waffo (see below); we receive the payment status, the amount and the email address you paid with, never your full card details.
• Support messages — what you send us by email or in support tickets.
• Technical data — the IP address and browser information recorded with each sign-in session, short-lived counters keyed by IP address that limit abuse of sign-in and sign-up, and request logs used for security and to keep the Service running.
• Safety records — when our content checks block a prompt, a photo or a result, a record with your account ID and the reason.

Why we use it

• To provide the Service: run the tools and AI features, and keep your account, credits, reports and purchases in order (performance of our contract with you).
• To process payments and manage subscriptions (performance of our contract with you).
• To answer your messages and support requests (performance of our contract and legitimate interests).
• To tell you about important changes to the Service, your account or our policies (legitimate interests).
• To prevent abuse and fraud and keep the Service secure, including checking prompts, photos and results for NSFW content (legitimate interests).
• To see how our pages are used, with privacy-friendly analytics (legitimate interests).
• To process biometric data for the AI features (your explicit consent, which you can withdraw before upload).
• To meet legal obligations, such as tax records (legal obligation).

We don’t sell your personal data, including “selling” as defined by laws such as the CCPA. We don’t use it for advertising, and we don’t use your photos, reports or messages to train AI models.

Who processes it

We share data only with service providers that help us run Face & Color, under terms that limit their use of it:

• Cloudflare — hosting and our database. Cloudflare also routes email sent to our support address.
• kie.ai — runs the AI models we use: Google’s Gemini to check photos and write your season and face-shape analysis, and Nano Banana to make hairstyle, hair color and makeup try-ons. It receives your cropped photo and our prompts, only to produce the results, and keeps them for the periods described above.
• fal.ai — an NSFW image classifier that checks every photo before it is processed and every generated image before it is shown to you.
• Waffo Pancake — our payment processor and Merchant of Record, which processes payments, handles tax and issues receipts. Waffo receives your email address and payment details directly and acts as an independent controller for that data under its own privacy policy. Card data is never stored on our servers.
• Google — “Sign in with Google”. Our support mailbox is hosted on Gmail, so emails you send to support@faceandcolor.com are stored there.
• Plausible Analytics — privacy-friendly website analytics that we run ourselves. It doesn’t use cookies and doesn’t track you across sites.
• jsDelivr and Google Cloud Storage — public CDNs your browser downloads the on-device face models from; they see your IP address when it does.

When we turn on account emails (such as email verification and password reset), they are sent through Cloudflare Email.

We may also disclose data if the law requires it, to protect people’s safety or our rights, or as part of a sale or reorganization of the business, in which case we’ll tell you first and the buyer must keep protecting it.

Cookies and similar storage

We use essential cookies that keep you signed in and protect sign-in requests, a cookie that remembers your language, and browser storage for preferences such as the color theme and your acknowledgement of our on-device notice. These are needed for the Service to work. We don’t use advertising or cross-site tracking cookies, and our analytics doesn’t use cookies.

Emails

We email you only to answer your messages or about your account, purchases or changes to our policies; receipts come from Waffo. We don’t send marketing emails. If we ever do, they will need your consent and include an unsubscribe link.

How long we keep it

• Photos and generated images — deleted from our systems within 24 hours (our AI provider’s own retention is described above).
• Report text and palettes — kept in your account until you delete them or your account.
• Account data — until you delete your account, then removed within 90 days. Deleted data can remain in the automatic backups of our database for up to 30 more days, until those backups expire.
• Support messages — up to 2 years after the conversation ends.
• Sign-in sessions and abuse-prevention counters — sessions until they expire or you sign out; counters are short-lived.
• Consent and safety records — kept with your account until it is deleted, longer only where needed for legal reasons.
• Purchase records — as long as tax and accounting laws require.

To have your reports or your whole account deleted, email support@faceandcolor.com from your account email.

Your rights

Depending on where you live (for example under the GDPR, UK GDPR or California law), you have the right to:

• know what data we collect and how we use it;
• access and get a copy of your personal data;
• correct data that is inaccurate or incomplete;
• have your data deleted;
• restrict how we process it in certain cases;
• receive your data in a machine-readable format;
• object to processing based on legitimate interests;
• withdraw consent where we rely on it.

You can update your name and profile picture in your account settings. For anything else, email support@faceandcolor.com from your account email and we’ll respond within 30 days. You can also complain to your local data protection authority.

International transfers

Our providers may process data outside your country, including in the United States. Where required, transfers are protected by safeguards such as the European Commission’s Standard Contractual Clauses.

Security

All traffic to the Service uses HTTPS, passwords are stored only as hashes, and access to our systems is limited to what is needed to run the Service. No system is perfectly secure: if a breach affects your personal data, we will notify you and, where required, the relevant authority within 72 hours of becoming aware of it.

Children

The Service is for adults 18 and older. We don’t knowingly process photos or personal data of minors, and AI generation is refused when a photo shows more than one person or appears to show a minor. If you believe a child has given us personal data, contact us and we’ll delete it.

Changes

We’ll post any update here with a new date and announce material changes on the site at least 15 days before they take effect. Continuing to use the Service after that means you accept the updated policy.

Contact

Privacy questions and requests, support and feedback: support@faceandcolor.com. We usually reply within 2 business days.