Privacy Policy
Version 2.0.1 · Effective 2026-08-14
This Privacy Policy explains what personal data Haircut Right collects when you use our service, why we collect it, how long we keep it, and the rights you have over it. It applies to the Haircut Right website operated by Filabs and any associated APIs.
We have tried to keep this document short and plain. If anything is unclear, contact us at contact@haircutright.com.
1. Who we are
The data controller for the personal data described in this policy is:
- Filabs, a SASU (société par actions simplifiée à associé unique) with share capital of EUR 1,000, registered at 60 rue François 1er, 75008 Paris, France, identified by SIREN 930 621 719 (RCS Paris).
- Contact for privacy matters:
contact@haircutright.com.
2. What data we collect
We collect only the data we need to provide the service.
- Account data — your email address, the password hash if you set a password, and the locale you use the site in.
- Uploaded content — the photo of your face that you submit for analysis, and any results we generate from it.
- Payment metadata — when you pay, we receive from Stripe the last four digits of your card, the card brand, the country of issue, and a transaction identifier. We never see or store your full card number.
- Technical data — your IP address, browser user-agent, and request timestamps. We use this for security, abuse prevention, and aggregate analytics.
The photo of your face is special-category personal data. We only process it if you give explicit consent through a dedicated checkbox at the upload step — separate from every other agreement on that page, never pre-ticked, and recorded with a timestamp. We do not use the photo to identify you or to match you against any database.
Your uploaded photo is deleted automatically 30 days after upload. You do not have to ask. The report you paid for — the analysis and the generated haircut images — is not affected and stays in your account.
3. How we use your data
Every processing activity below has a defined purpose, legal basis, and retention period.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email + password hash | Sign-in, account security | Performance of contract | Until you ask us to delete your data |
| Face photo (special-category data) | Generate the AI haircut preview you requested, and let you regenerate the images from it while it is still stored | Explicit consent | 30 days after upload, then deleted automatically |
| Consent records (timestamps) | Prove that you gave explicit consent for your photo, and that you confirmed you had the right to upload it | Legal obligation (accountability) | Until you ask us to delete your account |
| AI-generated previews | Show you the result you paid for, allow re-download, compare across sessions | Performance of contract | Until you ask us to delete it |
| Payment metadata | Process payments, issue receipts, comply with accounting law | Performance of contract + legal obligation | 10 years (accounting law) |
| Server logs (IP, requests) | Security, debugging | Legitimate interest | 90 days |
| Magic-link tokens | Passwordless sign-in | Performance of contract | Until used or expired (15 minutes) |
| Marketing consent (timestamp) | Send you a reminder email — with a discount — about your own unfinished report, only if you ticked the optional box when entering your email | Consent | Until you unsubscribe or ask us to delete your data |
Marketing emails. The only marketing email we send is a reminder about your own unfinished report, and only if you opted in via the optional checkbox shown when you entered your email. Every such email contains a one-click unsubscribe link; unsubscribing stops all marketing email immediately and permanently. Transactional emails (sign-in links, receipts, report-ready notifications) are not affected. We do not send newsletters, and we never share your email for marketing by others.
Retention of your photo, in plain terms. We keep the photo you upload for 30 days, then an automated job deletes the file from our storage. Nothing is required from you. After that the report you paid for is still fully readable, but the "before" photo no longer appears next to the results and we can no longer regenerate images from it.
You do not have to wait for the 30 days. You can withdraw your consent and have everything deleted at any time by emailing contact@haircutright.com; we will delete your data, including your uploaded photo and the generated results. Withdrawal does not affect processing already done.
4. AI processing of your photo
This is the most sensitive thing the service does, so we describe it explicitly.
Two different AI providers see your photo, for two different steps:
- Analysis — Anthropic (model: Claude). We send the photo to Anthropic, which describes face shape, hair, and other visible features and proposes the haircuts.
- Image generation — OpenAI. We send the photo to OpenAI, which edits it to show you wearing each proposed haircut. OpenAI also runs an automated safety check on the photo at upload, before anything else happens.
Both providers receive the photo itself. Nothing else about you (your email, your payment data) is sent to either.
- We do not allow your photo to be used to train any AI model. This is contractually excluded with both providers.
- The photo is transmitted over TLS, processed in the United States by both providers, and is not retained by them beyond what is needed to answer the request.
- Our software also contains an alternative image-generation provider (fal.ai) that is not in use. If we ever switch to it, we will update this policy and the sub-processor list below before any photo is sent there, and we will notify active users.
- The output is a probabilistic illustration, not a medical, dermatological, or styling recommendation. The preview shows one possible result of one possible haircut. Do not make irreversible decisions based on it.
If you do not want your photo processed by an AI provider, do not upload a photo. The site can be browsed without uploading.
5. Sub-processors
We share data with a small set of vendors strictly to operate the service. Each one is bound by a data-processing agreement.
| Sub-processor | Purpose | Data it receives | Location |
|---|---|---|---|
| Anthropic PBC | AI face analysis (Claude model) | Your face photo | United States |
| OpenAI | AI haircut image generation, and the automated safety check on uploads | Your face photo | United States |
| Cloudflare, Inc. (R2) | Private object storage for your uploaded photo and the generated images | Your face photo, generated images | [TO CONFIRM: bucket region] |
| Railway Corporation | Application hosting and the PostgreSQL database | Account data, session records, payment metadata, server logs | [TO CONFIRM: deployment region] |
| Stripe | Payment processing | Email address, payment metadata (never the photo) | European Union and United States |
| Resend, Inc. | Sending transactional email (sign-in links, receipts, report-ready notices) | Email address and message content | [TO CONFIRM: sending region] |
| Upstash, Inc. | Short-lived rate-limiting counters and live progress state | IP address (short-lived), session identifiers | [TO CONFIRM: database region] |
Your face photo is only ever sent to Anthropic, to OpenAI, and to our own private storage at Cloudflare. It is never sent to Stripe, to our email provider, or to any advertising or analytics service.
We update this list when it changes. Material changes — in particular any new provider that would receive your photo — are notified to active users by email before the change takes effect.
6. International transfers
Some sub-processors above are located outside the European Economic Area — in particular the two AI providers that process your photo, both of which process it in the United States. When personal data leaves the EEA we rely on the transfer mechanism set out in that provider's data processing agreement, together with the safeguards it describes. We are documenting the exact mechanism for each provider and will state it here per provider; if you need that detail before we publish it, ask us at contact@haircutright.com and we will give you the current answer in writing.
7. Your rights
If you are in the EU, the UK, or another jurisdiction with comparable data-protection law, you have the right to:
- Access the personal data we hold about you.
- Correct data that is inaccurate.
- Delete your data ("right to erasure").
- Restrict or object to certain processing.
- Receive a copy of your data in a portable format.
- Withdraw consent at any time for processing that is based on consent.
- Lodge a complaint with your local data protection authority (in France, the CNIL — cnil.fr).
These rights apply with some legal exceptions, for example we may need to keep payment records to comply with accounting law even if you ask us to delete them.
8. How to exercise your rights
To exercise any of these rights — including your right to erasure (data deletion) — email contact@haircutright.com with your request. We handle deletion requests manually: when you ask us to delete your data, we delete it, including your uploaded photo and the generated results. We respond within 30 days, and we may ask you to verify your identity before acting on a request that concerns an account.
Your uploaded photo is a special case: you never have to ask for it. It is deleted automatically 30 days after upload, whether or not you contact us.
9. Security
We protect your data with industry-standard measures: TLS in transit, encryption at rest on the object storage and database, restricted access by role, and audit logging on administrative actions. No system is completely secure; if we discover a breach affecting your data, we notify you and the relevant authority as required by law.
10. Children
The service is intended primarily for users 16 and over. Children under 16 may use the service only with the verifiable consent of a parent or legal guardian. We may request proof of parental consent before activating an account for a user under 16, and we will delete any account where consent cannot be verified.
If you are a parent or legal guardian and believe your child is using the service without your consent, contact us at contact@haircutright.com and we will delete the account and any related data.
11. Changes to this policy
We may update this policy when our practices, vendors, or legal obligations change. The version and effectiveDate at the top of this page reflect the current version. Material changes — for example a new sub-processor handling your photo, or a change to retention — are notified to active users by email.
Prior versions are archived and available on request.
12. Contact
For any question about this policy or the data we hold about you, email contact@haircutright.com.