1Who We Are and Who This Policy Is For
AL UMA ALRAQAMI COMPUTER SYSTEMS DESIGN (License No. 1183327), doing business as "Face Age" ("we," "us," or "our"), provides an AI skin and face analysis solution to businesses. Businesses use Face Age through our Panel (panel.getfaceage.com), our API, our JavaScript SDK, and our Shopify application (together, the "Services").
This Policy explains how we handle personal information for which we are the controller, meaning we decide why and how it is used. It applies to:
- Businesses and Shopify merchants that sign up for the Services, and the people who use the Panel or API on their behalf;
- Visitors to our websites, including getfaceage.com.
- People who contact us, request a demo, subscribe to our updates, or attend our events.
2Our Two Roles
Face Age plays two different roles, depending on whose data it is.
| Data | Our role | What governs it |
|---|---|---|
| Business accounts, Panel and API users, billing, support, our own marketing, our website visitors | Controller | This Privacy Policy |
| Data about a business's own customers ("shoppers") collected through the SDK, API or Shopify app, including photos, skin and face metrics, quiz answers and contact details | Processor, acting only on the business's instructions | The business's own privacy notice, and our Data Processing Agreement with that business |
We do not use shopper data for our own purposes. We do not sell it, use it to train or improve our models, combine it across businesses, or use it for our own marketing. Section 11 explains what this means for shoppers.
3Information We Collect
3.1 Account and Panel Information
- Account holder details: full name, email address, mobile phone number, and password (stored only as a bcrypt hash);
- If you sign in with Google, LinkedIn, or GitHub: your provider ID and the profile details that provider shares with us (typically name and email);
- Access credentials: API keys and authentication tokens issued to your business, which expire or can be revoked;
- Preferences: marketing-email opt-in status, language, and notification settings.
3.2 Business Information
Business name, website and domain, contact email and phone, physical address, business size, logo, and, for Shopify merchants, your Shopify shop ID and store details needed to run the app.
3.3 Payment Information
Payments are processed by Stripe and, where offered. We never receive or store your full card number. We keep the payment provider's customer reference, the payment method type, the last four digits of the card, and your subscription or trial status.
3.4 Usage and Device Information
When you visit our websites or use the Panel, we collect your IP address, browser and device information, pages and features used, and error and diagnostic data. We also keep records of your account's usage of the Services (for example, analysis volumes) to bill you and support you. These usage records are counts and metadata, not shopper photos or results.
3.5 Communications
When you contact support, request a demo, or reply to our emails, we keep the content of that correspondence and your contact details.
4How We Use Your Information
- Create and manage your account, and authenticate access to the Panel and API;
- Provide, operate, and support the Services for your business;
- Process payments, manage subscriptions, and keep financial records;
- Respond to support requests and other inquiries;
- Send service and administrative messages, and, where you have opted in, marketing messages;
- Protect the Services, detect and prevent fraud and abuse, and enforce our Terms of Use;
- Understand how businesses use our Panel and websites so we can improve them;
- Comply with legal obligations, including tax and lawful requests from authorities.
We do not sell personal information.
5Legal Bases for Processing (EEA, UK, and Similar Laws)
| Purpose | Data | Legal basis |
|---|---|---|
| Account setup, providing the Services, billing, support | Account, business, payment, and usage data | Performance of a contract (Art. 6(1)(b)) |
| Security, fraud prevention, abuse monitoring | IP address, device data, logs | Legitimate interests (Art. 6(1)(f)) |
| Improving our websites and Panel | Website and Panel usage data | Legitimate interests (Art. 6(1)(f)), or consent where required for cookies |
| Marketing emails | Name, email, engagement data | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Tax, accounting, and legal requests | Account, billing, and log data as relevant | Legal obligation (Art. 6(1)(c)) |
The legal basis for analyzing a shopper's photo is decided by the business that uses Face Age, not by us. Our Data Processing Agreement requires businesses to obtain shoppers' explicit consent before the camera or upload feature activates.
8International Transfers
Face Age is operated by a company established in the United Arab Emirates. Our core systems are hosted in the European Union, at Hetzner Online GmbH data centers in Germany, and our file storage is with AWS in Stockholm, Sweden. Some providers, such as Stripe, are in the United States, and our team may access data from outside the EU to provide support and operate the Services. Where personal information from the EEA, UK, or Switzerland is transferred to a country without an adequacy decision, we use Standard Contractual Clauses or another valid transfer mechanism.
9How Long We Keep Information
| Data | Retention |
|---|---|
| Account and business profile | For the life of the account. On deletion, fields are erased, except your email address, domain, which we keep for 24 months for fraud prevention |
| Payment and invoice records | For the period required by financial and tax record-keeping law |
| Support correspondence | 5 years after the conversation ends |
| Marketing contacts | Until you unsubscribe or withdraw consent |
| Security and application logs | 30 days |
| One-time login and verification codes | About 2 minutes, then purged |
| Data export files | A limited download window, then deleted |
10Security
We protect personal information with organizational and technical measures. These include password and one-time code hashing, encryption of integration credentials, encryption in transit (HTTPS/TLS) for all traffic, encryption at rest for files stored with AWS, and access controls limiting who can view data. No system is completely secure, but we work continuously to strengthen these protections.
11If You Used Face Age on a Brand's Website
If you took a skin analysis or quiz on a brand's website or Shopify store, that brand is responsible for your data. It decided to offer the analysis, chose which features to turn on, and asked for your consent. Face Age provides the technology and processes your data only on the brand's behalf and instructions.
- Read the brand's privacy notice. It explains what the brand collects, why, and for how long.
- Contact the brand to exercise your rights. If you contact us instead, we will pass your request to the brand within 10 business days and help it respond.
- What we do with your data: we analyze your photo to produce the results the brand requested. By default, your photo is deleted once the analysis is complete. If the brand has turned on its results-history feature, your recent photos and results are saved in your own browser and, on Shopify stores, in the brand's Shopify customer records. Face Age does not keep them on its servers.
- What we never do: we do not sell your data, use your photo or results to train or improve our models, combine your data across different brands, or use it for our own marketing.
Our Biometric Data Policy explains how long facial data is kept and how it is destroyed.
12Children
The Services are offered to businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children as a controller. Businesses that make the analysis available on a storefront children may visit must apply age checks and obtain parental consent where the law requires, under our Data Processing Agreement.
13Your Rights
Depending on where you live, you may have the right to access your personal information, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. You may also complain to your data protection authority.
- Panel users can export their account data and delete their account directly in the Panel. Deletion is confirmed with a one-time code sent to your registered email.
- Anyone else covered by this Policy can email [email protected]. We will verify your identity and respond within 30 days.
- Shoppers should contact the brand they used, as explained in Section 11.
We may decline all or part of a request where the law allows, for example to keep records we are legally required to retain.
14EU and UK Representatives
Because Face Age is established outside the EU and UK, we have appointed representatives under Article 27 of the GDPR and UK GDPR:
- EU representative: S.Reza Movahedi, [email protected]
- UK representative: S.Reza Movahedi, [email protected]
15Changes to This Policy
We may update this Policy from time to time. The effective date at the top will change, and we will tell business customers about material changes by email or in the Panel before they take effect.
16Contact Us
- Email: [email protected]
- Post: AL UMA ALRAQAMI COMPUTER SYSTEMS DESIGN, PROPERTY INVESTMENT OFFICE 4 - S1 516-0,Dubai Investment Park First, Dubai, United Arab Emirates