Privacy Policy
1. Who We Are
Precision Skin LLC SPC is a company registered in the United Arab Emirates. We operate the Agent Portal as a software service enabling retail outlets and their agents to manage personalised skincare orders and AI-assisted skin analysis for their clients.
For data protection purposes, Precision Skin LLC SPC acts as a data processor when handling client personal data submitted through the Portal. The retail outlet (agent) acts as the data controller for their clients' data.
2. Data We Process
Through the Portal, the following categories of personal data may be collected and processed:
- Identity data: client name, date of birth
- Contact data: email address, phone number
- Biometric/health data: facial photographs and AI-derived skin condition scores (hydration, pigmentation, texture, redness, etc.)
- Transaction data: order details, payment status, product formulations
- Agent account data: agent email, outlet name, login activity
Skin analysis scores derived from facial images may constitute biometric data or health-related data under applicable law (including UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection and GDPR where applicable). We treat all such data with the highest level of care.
3. Legal Basis for Processing
We process personal data on the basis of:
- Contract performance: to fulfil orders placed through the Portal
- Legitimate interests: to operate and improve the Portal
- Consent: for biometric skin analysis data, which must be obtained by the retail outlet prior to submission
It is the retail outlet's responsibility to obtain valid, informed consent from clients before their data — especially facial photographs — are submitted to the Portal.
4. How We Use Data
Data entered into the Portal is used exclusively to:
- Generate personalised skincare formulations based on AI skin analysis
- Manage production batches and order fulfilment
- Provide the retail agent with order history and client management tools
- Improve the accuracy and performance of our AI skin analysis models (in aggregate and anonymised form only)
We do not sell, rent, or share personal data with third parties for marketing purposes.
5. Data Storage & Security
All data is stored in Supabase-hosted infrastructure with encryption at rest and in transit (TLS 1.2+). Access is restricted to authorised EXACT personnel and the submitting retail outlet only. We apply role-based access controls and maintain audit logs of data access.
Facial photographs submitted for skin analysis are stored securely and are accessible only to the relevant retail outlet and EXACT operations staff as necessary for order fulfilment.
6. Data Retention
Client data is retained for the duration of the retail outlet's commercial relationship with EXACT plus a period of 3 years thereafter, unless a shorter retention period is required by law or requested by the data subject. Agents may request deletion of specific client records via privacy@exactcosmetics.com.
7. Data Subject Rights
End clients whose data is processed through the Portal have the right to access, rectify, erase, or port their personal data. Such requests should be directed to the retail outlet in the first instance, who may then engage EXACT to fulfil them. Requests can also be submitted directly to privacy@exactcosmetics.com.
8. International Transfers
Some personal data processed through the Portal is transferred to and processed in jurisdictions outside the United Arab Emirates. In particular:
- Data storage: Client and order data is stored on infrastructure operated by Supabase, Inc., which may store data on servers located outside the UAE.
- AI skin analysis: Facial photographs submitted for skin analysis are transmitted to an AI processing provider operating outside the UAE. This provider processes the image solely for the purpose of generating skin condition scores and may retain the data temporarily during processing. Images are not retained by the AI provider beyond the completion of the analysis.
By submitting client data through the Portal, the retail outlet confirms it has informed clients that their data — including facial photographs — may be processed outside the UAE, and has obtained any consent required for such transfer under applicable law. We require all third-party processors to maintain appropriate technical and organisational security measures.
9. Governing Law
This Privacy Policy is governed by the laws of the United Arab Emirates. Any disputes arising in connection with it shall be subject to the exclusive jurisdiction of the courts of Abu Dhabi, UAE.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Continued use of the Portal following notification of changes constitutes acceptance of the revised policy.
11. Contact
For privacy-related queries, contact our Data Protection Officer at privacy@exactcosmetics.com.