Privacy Policy — Thetalook

Last Updated: April 20, 2026
Version: 2.2

1. Who We Are (Data Controller)

Thetalook ("we", "the app") is a personal beauty intelligence platform delivered as a Progressive Web App (PWA) at: https://thetalook.com.

• Entity: Thetalook
• Address: Iraq - Baghdad
• Jurisdiction: Republic of Iraq
• Privacy contact: info@thetalook.com
• Phone: +9647817107805

We act as the data controller for all personal data collected through the app.

2. Data We Collect

2.1 Account

Name, email, phone (Iraq format), age (12–70), governorate, district, username, bcrypt-hashed password.

2.2 Skin Profile

Skin type, sensitivity level, allergy ingredients, Fitzpatrick tone (I–VI), self-declared dermatological conditions.

2.3 Photos & Media

• Selfies uploaded for AI skin analysis
• Before/after medical tracking photos
• Profile avatar
• Community post images
• DM image attachments (max 5 MB)

Important: the app never accesses your device camera directly. All images are picked from your gallery.

2.4 Voice Messages

Voice notes in DMs (max 60 seconds).

2.5 Usage Telemetry

Scan counts, look generation counts, engagement events, login records, IP addresses (security).

2.6 Order Data

Recipient name, phone, shipping address (governorate, district, landmark), cart contents, IQD totals.
Cash on Delivery (COD) only — we never store credit card or wallet data.

3. How We Use Your Data

• AI skin analysis (selfie + skin profile)
• Monthly look generation (selfie + preferences)
• Personalized product recommendations
• Doctor / MUA communication via direct messages (user-initiated only)
• Marketplace fulfillment
• Public community feed
• Security & fraud prevention

We do not run targeted advertising, and we do not sell your data.

4. AI Processing Disclosure

Thetalook uses Google Gemini models via the Lovable AI Gateway:

• Gemini 2.5 Pro — skin scan analysis
• Gemini 2.5 Flash + Flash-Image — monthly look generation

Safeguards:

• Your photo is sent to the AI provider only for the duration of processing, then deleted on their side.
• Your data is not used to train AI models.
• Analysis results are stored in your private user space (RLS-protected).
• You can request deletion of past AI outputs at any time.

5. Storage & Security

6. Third-Party Sharing

No advertisers. No data sale. No data brokers.

7. Doctor & MUA Communication

• No doctor or MUA has any direct or automatic access to your medical history, photos, scan results, or profile. Ever.
• There is no shared-permission system, no standing consent, no role that grants any external party read access to your records.
• The only way information reaches a doctor or MUA is when you yourself send it as a regular message in a Direct Message (DM) conversation — one item at a time, by your explicit action.
• Each share is a discrete event you initiate; there is no ongoing authorization.
• Once sent, the message is treated like any other DM message (storage, deletion, blocking, reporting all apply).

8. Direct Messaging

• Text, voice, and image messages are stored to enable conversation history.
• Limits: 5 MB images, 60-second voice notes.
• When you send a scan result or medical image to a doctor or MUA, it is treated as any other DM message — you can delete it from your side at any time.
• You can block any user (blocked_users, bidirectional) and report abuse via user_reports.

9. Children's Data

• Minimum age: 12.
• Users under 18 must use the app under parental supervision.
• We never serve targeted ads to minors and collect no marketing data on them.
• Accounts found to belong to children under 12 are deleted on detection.

10. Your Rights

You may at any time:

• Access your stored data.
• Correct it via "Edit Profile".
• Export a copy by email request.
• Delete your account fully — handled by the admin-delete-user Edge Function which cascades across 23+ tables.
• Delete messages you sent to a doctor or MUA from the conversation at any time.
• Lodge a complaint with the competent authority.

Requests: info@thetalook.com

11. Retention

• Account data is kept while the account is active.
• On deletion request: 30-day grace period before permanent purge.
• AI provider does not retain processing artifacts.
• Email send logs are retained 90 days for diagnostics.

12. Cookies & Local Storage

We use only strictly necessary storage:

• Auth session
• Selected language (Arabic/English)
• Cart and wishlist contents

No third-party tracking cookies. No Google Analytics. No Facebook Pixel.

13. International Data Transfers

Because we use global cloud providers (Supabase, Google AI), your data may be processed outside Iraq. All providers comply with internationally recognized standards (GDPR / SOC 2 frameworks).

14. Changes to This Policy

We may update this policy. Material changes will be announced in-app at least 14 days before they take effect. The latest version always carries the update date at the top.

15. Contact

Privacy inquiries:
📧 info@thetalook.com
📱 +9647817107805

© 2026 Thetalook. All rights reserved.