Privacy Policy
UK GDPR and Data Protection Act 2018 · United Kingdom
Last updated: October 2026
1. Data Controller (UK GDPR Art. 13)
Peak, represented by Haris Mirza
Wohlrabedamm 30, 13629 Berlin, Germany
Email:
This Policy complies with: UK GDPR (retained EU law, EU Withdrawal Act 2018), Data Protection Act 2018 (DPA 2018), and Privacy and Electronic Communications Regulations 2003 (PECR).
2. Personal Data We Collect
• Email address and encrypted password
• Name and gender
• Profile photo and hair photos (front, side, back)
• Hair length measurements in millimetres, moodboard images
• AI hair preview images (displayed only, not stored)
• Hairline and crown photos from Hair Score — only if you have explicitly agreed to keep them
• Booking data (date, time, salon details)
• Payment and subscription data (Apple/RevenueCat)
• Push notification tokens, Hair-ID (8-char), device data
• Your messages to us: in-app feedback and salon suggestions (text, plus name, email address, Hair-ID, role and language)
3. Special Category Data (UK GDPR Art. 9, Schedule 1 DPA 2018)
Hair and profile photos may contain biometric data (special category under Art. 9 UK GDPR). Processing is based solely on your explicit consent, withdrawable at any time.
Hairline and crown photos from Hair Score are only kept if you explicitly agree before your first hairline scan. They serve solely your own comparison (starting photo and later photos), are visible in the app only to you — salons have no access — and can be deleted one by one or all at once. You can withdraw your consent at any time under Settings → Privacy → Hairline photos; all kept photos are then deleted immediately. Without consent we do not store the scan photo; it is only transmitted for the analysis (section 7).
Photos showing your face (“face data”). For the Hair Score, the hairstyle preview, a new look and an Explore post, you take or select a photo yourself; it usually shows your head and therefore often your face. For the Hair Score you can instead use a photo your salon took at an appointment, if you have agreed to this. HairID does not recognise you by your face: no facial recognition or identification takes place, no facial geometry, facial landmarks or biometric templates are created, Face ID, Touch ID and ARKit are not used, and no camera depth data is used. The photo is sent only as an image to our AI processor (section 7), solely for these purposes: (1) Hair Score and hair analysis: assessing visible hair traits; (2) hairstyle preview and new look: checking whether a face is visible and a short description in words (face shape, approximate age, gender presentation, skin tone, beard or glasses) so that the preview fits you; from Premium upwards your photo itself is edited and only the hairstyle is changed, otherwise an example image is generated from the description; the description and the preview image are not stored; (3) Explore: checking whether a haircut is visible and whether the picture complies with our community guidelines, and suggesting the view, style keywords and audience (women or men). Our server keeps the photo in memory only for the duration of the request. Photos are stored only if you choose so yourself: hairline and crown photos (only with your consent, see above), your profile photo, your haircut photos and looks, and posts you publish on Explore; before and after photos your salon takes at an appointment are part of your haircut history (section 7). Before the app sends a photo to the AI processor for the first time, it asks for your explicit consent. You can withdraw it at any time under Settings → Photo analysis; after that the app sends no more photos until you consent again. Storage location and retention: section 6; recipients: section 7; deletion: section 9. We do not pass face data to advertisers or data brokers, do not use it for advertising and do not sell it.
4. Lawful Bases (UK GDPR Art. 6)
• Contract performance — all app features (Art. 6(1)(b))
• Consent — photos, AI features, push, location (Art. 6(1)(a))
• Legitimate interests — security, fraud prevention, handling your feedback and salon suggestions (Art. 6(1)(f))
• Legal obligation — tax and accounting (Art. 6(1)(c))
5. Automated Decision-Making (UK GDPR Art. 22)
Hair Score and hair analysis derive an algorithmic estimate from your hair photo; the hairstyle preview generates an image from it (with your own face from Premium upwards, otherwise an example image based on a short description of your photo). When you publish on Explore, an algorithm checks the picture for a visible haircut and for breaches of the community guidelines (details on photos showing your face: section 3). The product scanner algorithmically matches a product's ingredients to your hair profile (a tendency, \"suits / does not suit\"). This is not a legally binding decision and not a medical assessment. No significant-effect profiling takes place.
6. Data Storage & Retention
Photos and the app's database are held with Google Cloud (Firebase) in the EU: photos in region europe-west1 (Belgium), the database in the EU multi-region eur3 (Belgium and the Netherlands); our server also runs in region europe-west1 (Belgium). Photos you submit for AI analysis are kept by our server in memory only for the duration of the request; they are stored only in the cases listed in section 3. Recipients outside the EU are listed in section 7.
• Account data: until deletion + 30 days
• Hair photos & profile data: until deleted by you
• Photos you submit for AI analysis (Hair Score, hairstyle preview, new look, Explore check): with us only during the request; with the AI processor 30 days at most (section 7)
• Hair Score hairline and crown photos: until you delete them, withdraw consent or delete your account; per series, the starting photo and at most the 24 most recent photos are kept
• Feedback & salon suggestions: until your account is deleted
• Booking data: 6 years (HMRC guidance)
• Payment data: 6 years
• Technical log data: max. 90 days
7. International Transfers (UK GDPR Chapter V)
The EU (including our Google Cloud servers in Belgium and the Netherlands) has an adequacy decision under UK law. Other transfers:
• OpenAI Ireland Ltd. (Ireland): AI features — Hair Score, hair analysis, hairstyle preview (including the check whether a face is visible and a short description of the face in words), checking pictures for Explore, queue insights, product scanner (reading a packaging photo, product identification), care assessment and product suggestions. Transferred: the relevant head or hair photo or packaging photo, your hair profile data, the ingredients of scanned products and, in the salon view, customer names and times from today's appointment list. Our contracting party is OpenAI Ireland Ltd.; the data is also processed outside the UK and the EU, in particular in the USA, under the International Data Transfer Addendum to the EU Standard Contractual Clauses. OpenAI does not use this data to train its models and deletes it after 30 days at most (abuse monitoring).
• RevenueCat, Inc. (USA): International Data Transfer Agreements (IDTAs)
• Apple Inc. (USA): IDTAs
• Functional Software, Inc. / Sentry (USA): Crash and error reports so we can fix problems quickly (legitimate interests, UK GDPR Art. 6(1)(f)). Transferred: device type, operating system, app version, the technical error trace and a pseudonymous user ID — no names, email addresses, photos or messages. Stored in the EU, deleted after 90 days at most. IDTAs.
• Resend (USA): Sends booking confirmations and appointment emails, and your feedback and salon suggestions to our team. Transferred: name, email address, appointment details or your message with Hair-ID. IDTAs.
• Your feedback and salon suggestions go only to the HairID team, never to salons — not even to the salon you suggest. Only you and the HairID team can read them.
• Google Places/Geocoding (Google Ireland Ltd.): Nearby salon search. Transferred: GPS coordinates and search queries.
• Salons, with your explicit consent: a salon can only see your hair profile if you book an appointment with it yourself or give it your HairID code, for example by showing your QR code for scanning or telling them the code. Your HairID code is your permission: without it, a salon cannot add an appointment to your account. Only share it with salons you want to show your profile to. Once you have shared it, the salon and its staff can see your name, profile photo, HairID, hair profile data, saved hairstyles and style briefs, your moodboard and your haircut history with photos, products used and care notes, including entries from other salons. Salons cannot see your Hair Score or your hairline and crown photos. Products from your shelf only if you have shared them individually. Access continues after the appointment so the salon can look after you on your next visit. You can withdraw it from any salon individually at any time: Settings → Privacy → My salons → Remove. After that the salon can no longer see your hair profile, neither through earlier appointments nor with your code; the appointments themselves and what the salon documented at your visits stay with the salon. If you book that salon yourself again later or allow it again there, access applies again. So that you can also remove salons that only used your code, we store which salon last opened your profile with your code (only the salon and the time).
• Publishing appointment photos, only with your separate consent: if you have switched on “Share my haircuts publicly” under Settings → Privacy, the salon may show after photos of your completed appointments with it on Explore and in its portfolio — visible to signed-in HairID users. Your name and HairID never appear; what is shown is the photo, the salon and the style details the salon chose. Team members only share photos of appointments they carried out themselves, on behalf of the salon; only the salon owner adds photos to the portfolio. Switching it off withdraws your consent for the future: shared posts go offline immediately, portfolio entries made from your photos are deleted, and copies saved by other users are removed. The same happens if you delete your account.
We do not sell your personal data.
8. Your Rights (UK GDPR Arts. 15–22, DPA 2018)
• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction (Art. 18)
• Portability (Art. 20)
• Objection (Art. 21)
• Automated decision-making rights (Art. 22)
• Withdrawal of consent (Art. 7(3))
Direct requests to:
We respond within one calendar month.
Supervisory Authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
https://ico.org.uk · Tel: 0303 123 1113
9. Data Deletion
10. Minimum Age
HairID is for persons 16 and over only. We comply with the UK Children's Code (Age Appropriate Design Code) and do not knowingly collect data from minors.
11. Changes
Material changes notified with 30 days' notice by push or email. October 2026.
This website
This section applies to hair-id.com only. For the app, see the text above.
Hosting. The site is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. On each request Vercel processes technically necessary server logs: IP address (stored truncated), date and time, the address requested, browser type. The legal basis is Art. 6(1)(f) UK GDPR / GDPR (secure, reliable operation). Logs are deleted after 30 days at the latest. Transfers to the USA rely on the Standard Contractual Clauses.
Location. Only when you tap “Near me” on “Find a salon” does your browser ask for your location. We round it to about one kilometre, use it for that one search only and never store it.
No cookies, no tracking pixels. The site sets no advertising or analytics cookies. Your language and country choice and the entry question are stored locally in your browser (localStorage) and never leave your device.
Booking and signing in. If you book through hair-id.com/s/… or sign in, your details go to our server (Google Cloud Run, region europe-west1) and to Firebase (Google Ireland Ltd.) — the same processing as in the app, described above.
Your rights. Access, rectification, erasure, restriction, portability and objection: hairidapp@gmail.com.