Privacy Policy

Only what the self-check needs:

• Your first name and WhatsApp number. The number is verified by a one-time code, then stored encrypted. A one-way hash of it is used to recognise repeat visits.
• Your face photos (up to three angles). They are stored in a private folder that only our systems can open.
• Your answers to the questions (main concern, how long, self-rating, skin type, city, budget, and so on) and the permissions you tick.
• Payment status for the paid report: order id, amount, paid or not. Card, UPI and bank details go directly to our payment gateway, Cashfree Payments India Pvt. Ltd.; we never see them.
• Technical records: timestamps of each step, and a hashed form of your IP address used only for advertising measurement.

We do not ask for your date of birth, address, or medical diagnoses as structured fields, and we do not collect anything from your device beyond what you upload.

• To prepare your results and written report. Your photos and answers are analysed with the help of AI models to produce plain-language observations and general skincare suggestions. The scoring and routing rules are fixed, versioned logic; AI only writes the explanations.
• To send you your results on WhatsApp, which you agree to when you take the self-check.
• Only if you tick the box: to alert you when a relevant product goes on sale, and to let a partner dermatology clinic in your city contact you about a consultation.
• To process the paid report and deliver it as a link and PDF.
• To measure advertising. If you arrived from an ad, we tell the ad platform (Meta) that a self-check was completed, using a hashed phone number and hashed IP so it can count conversions. This never includes your photos, answers or results.
• To show product suggestions. Some links are affiliate links; we may earn a commission if you buy, at no extra cost to you.
• To improve the service, using anonymised results reviewed by a dermatologist for quality.

We use specialist providers, each under contract to process your data only for the purpose we set: hosting (Vercel), database (Supabase), photo storage (Google Drive), AI analysis (Anthropic and Google models, accessed through their APIs), WhatsApp messaging and phone verification (Twilio), payments (Cashfree) and advertising measurement (Meta). Some of these providers store data on servers outside India.

A partner clinic sees your name, number, results and photos only if you ticked the clinic permission. We do not sell personal data.

Your photos, answers and results are kept for 24 months from your last activity, then anonymised. Payment records are kept for as long as tax and payment rules require. If you ask us to delete your data, we do it within 7 days, except for records we are legally required to keep.

• Withdraw permissions at any time by replying STOP on WhatsApp. Every marketing and clinic permission is switched off within the hour.
• Ask for a copy of the data we hold about you, or ask us to correct or delete it, by contacting us (details below). We respond within 7 days.
• Nominate someone to exercise these rights for you if you are unable to.
• Complain to our Grievance Officer, and if unresolved, to the Data Protection Board of India.

Your phone number is encrypted at rest (AES-256) and never stored in plain text. Photos are stored in a private folder, not on a public link. Report links are unguessable and tied to the person who paid. Access to raw data is limited to the people who run the service.

We use no advertising cookies. Your browser may keep a small amount of local data so the quiz can resume if the page reloads.

The self-check is for people aged 18 and over. If you believe someone under 18 has used it, tell us and we will delete their data.

Grievance Officer: Harsh Khubchandani
Email: harsh@greenwolftechlabs.com

We acknowledge complaints within 48 hours and aim to resolve them within 7 days.

If we change how we use your data, we will update this page and, where the change affects permissions you have given, ask you again before relying on it.