Privacy Policy

This policy explains how Oleah handles personal information in our app, on oleah.skin and in our communications. Oleah is operated by ONE EIGHT EIGHTEEN PTE. LTD., UEN 202644930W, 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914. We are responsible for deciding how your information is used. Contact our Data Protection Officer at privacy@oleah.skin.

Our Biometric Policy and Agreement and Consumer Health Data Privacy Policy give additional information about sensitive data. Their specific protections apply alongside this policy. Our Terms and Conditions govern the service; accepting them does not replace any separate consent we need. On app screens, "face scan" and "face data" mean a face scan in the table below, including face geometry, 3D face points, and scan logs that contain them.

1. Information we collect

We collect information you provide, information from your device and sign-in or payment services, and information generated when you use Oleah.

We use account and eligibility information to provide access. Other information depends on the features you use. You do not have to provide optional health details, but this may limit personalisation. Please avoid submitting another person's personal information.

2. How we use information

We use information to:

• operate accounts, subscriptions, reminders and support;
• describe how your skin looks in photos, check products, compare your own photos over time and personalise routines and conversations;
• keep your history and relevant information so Oleah can respond with context;
• investigate problems, protect the service and prevent misuse;
• run, check and fix Oleah. Oleah's team reviews chats, skin results and health details to do that. To improve Oleah and add missing products, our team uses xAI's Grok to look at product photos and chats. Our team and Grok see chats and product photos without the name and email on your account. The review happens for every account, including beta. The required consent is the agreement to it;
• respond to requests, communicate about Oleah and administer offers; and
• meet legal duties, keep necessary records and resolve disputes.

Where data protection law requires a legal basis, we use the contract for the account, the subscription, and the features you ask for. We use the required consent for health details, skin results and face measurements, including review by our team, and for our AI provider, because a contract cannot authorise that health data. We use legitimate interests only for security and preventing misuse, not for health content. We use a legal obligation for tax and accounting records. That required consent covers photos, face geometry, skin notes from photos, health details you enter, your profile, conversations, storage, processing by a third-party AI provider, and review of chats, skin results and health details by Oleah's team to run, check and fix the app, including during beta, and our team's use of xAI's Grok to look at product photos and chats, without the name and email on your account, to improve Oleah and add missing products.

3. Photos, health information and AI

Oleah uses external AI services to analyse submitted photos, messages and relevant profile, product, health and scan information. History copies of a scan black out the area below the neck when a face is detected. Most stored scan thumbnails from before 1 October 2026 have no neck-mask marker and are kept unmasked. A skin reading sends neck-masked photos and does not send an unmasked photo. A shelf or chat photo is masked before it is sent for analysis only when a face is found in it. When you add a product, Oleah does not accept a photo that shows a person. Separately storing an encrypted original does not prevent the AI service from processing the image sent to it. The Biometric Policy and Agreement explains the distinction.

Before Oleah sends anything to our AI provider, the consent screen names Anthropic, says what it reads and asks for your agreement. Oleah sends nothing to Anthropic before you agree. If you do not agree, you are signed out. We record your agreement with the time and the words you saw. The same screen names xAI's Grok, which our team uses to look at product photos and chats, without the name and email on your account, to improve Oleah and add missing products.

Each scan stores a 3D face mesh in file storage, with measurements from that mesh (angle, distance and face size) and readings over areas of the mesh. Those records support alignment and comparison of your own scans. The mesh itself is not sent to our AI provider. A skin reading sends up to 5 of today's scan photos, with the neck masked, plus up to 5 photos from the first scan and up to 5 from a matching past scan. It also sends a profile of at most 500 characters: gender, age, skin type, concerns, goals, and the answers you typed. Conditions you entered are included. It also sends shelf products and their start dates, past reads and scores, and what Oleah has learned about you. From the phone it also sends colour readings taken from the scan photos, for the whole face and for each face area: redness, brightness and texture. Oleah does not send the 3D face mesh to our AI provider. Oleah uses the mesh to find those areas in the photos and to line up your scans. It does not send your name, your email, the mesh itself, or an unmasked photo. The skin score is computed from the photos. Oleah is not designed to, and we do not intend to, use these readings to personally identify you or match your face against other individuals. Health details you share help personalise the features you request. Oleah is a wellness service, not medical care. AI outputs can be wrong, and conversations are not monitored for emergencies.

Face tracking with the TrueDepth camera. On an iPhone with a TrueDepth camera, the face scan uses Apple's ARKit face tracking. It runs only while the scan screen is open. ARKit gives Oleah the position and angle of your head, the distance from the phone to your face, a 3D face mesh of 1,220 points, the position of your eyes, expression readings and a light reading. Oleah does not read the depth map. It does not use Face ID to recognise you or to sign you in. Oleah uses this data to guide you during the scan, to take each photo at the right angle and distance, to black out the area below your neck in scan photos, to find each face area in the photos, and to line up your scans so you can compare your own photos over time. Oleah does not use it to measure your health, to identify or recognise you, to match you with other people, for advertising or marketing, or to train AI models. This data is stored on your phone, inside the app, and in Oleah's private file storage with our hosting provider, Supabase, on AWS in Mumbai, India. The colour readings of each face area are stored with each scan record in Oleah's database. A scan diagnostics log in the database keeps your head angle and distance during the scan, in whole degrees and centimetres. Only you and authorised Oleah staff can access this data, for the purposes above. We do not sell it. Apart from our hosting provider, the only third party that receives anything derived from it is our AI provider, and only as follows. Anthropic does not receive the mesh, the 3D points, the head angles, the eye positions, the expression readings or the light reading. It receives your scan photos, with the area below the neck blacked out, and the colour readings of the face and of each face area. We keep this data while your account is open so you can see and compare your scans. When you confirm account deletion, the mesh, 3D points and scan log files are deleted from Oleah's file storage at once. The copies on your phone are deleted when you sign out or delete your account. The scan diagnostics log in the database is deleted within 30 days after account deletion. All of this data is deleted after 1 year without use, and each year on 1 January a review deletes what is no longer needed.

We keep conversations and relevant notes to provide history and personalisation. This is what Oleah's memory means; it is not training a language model. Removing a note does not automatically remove the conversation it came from. Contact privacy@oleah.skin to correct or delete information, including related records.

Oleah's team reviews conversations, skin results and health details to run, check and fix Oleah, including for beta users. To improve Oleah and add missing products, our team uses xAI's Grok to look at product photos and chats. Our team and Grok see chats and product photos without the name and email on your account. The required consent is the agreement to that review. Authorised personnel can also access submitted information for support, administration, troubleshooting and security.

Oleah does not train or fine-tune general-purpose AI models on your personal information. Our AI provider, Anthropic (Claude), a third-party processor based in the US, processes submitted information to deliver the requested features. Its commercial terms prohibit it from training models on that content. It does not use those inputs or outputs for training unless we send feedback on a conversation or opt into a training program. We do not. It deletes those inputs and outputs within 30 days, unless its safety systems flag the conversation or the law requires longer. A flagged conversation can be kept for up to 2 years. A safety score on a flagged conversation can be kept for up to 7 years. It does not delete a copy early because the Oleah account was deleted. Its contract can also require a longer keep to combat harmful use.

4. Analytics and cookies

The PostHog SDK does not run in the United Kingdom, the European Union, the EEA, South Korea, or Quebec. Elsewhere, analytics are collected on the phone by the PostHog SDK. Events are tied to an account ID, with no name or email. The SDK records the IP address and the city, region, country and time zone derived from it, the phone model, the iOS version, the screen size, the language, and the app build. It records these profile tags: plan, beta, install build, onboarding done, reminders on, scan-day and shelf-size buckets, uses chat, acquisition source, sign-in method, and journey stage. It records screens and the time on each, opens and closes, the button labels tapped, rage taps, and crash and error codes. It records onboarding, sign-in, the birthday step, including the result of Apple's age check, and whether camera, photo library and notification access are allowed. For a scan it records started, finished and paused, the timing, streak days, and reads opened. For the shelf and notifications it records a product added or removed, a routine logged, and a label read, and a notification delivered or opened, with its type and the hour. For chat it records that chat was opened, that a message was sent, and whether the message had a photo. It does not record the chat text. It also records the paywall, the island, the review card, surveys, and feature flags. It does not receive chat text, photos, names, emails, or a skin score. Events stored through 11 October 2026 can still include a skin score, a postcode or coordinates. Those events are kept with the other analytics events. They are deleted when you delete your account. You can turn analytics off in Settings, Privacy & my data, with Share usage data.

Screen recordings. If you are 18 or over, the app may record how a few screens look while you use them: the last setup steps, the plans pages, Settings pages (including account deletion and widgets) and our policy pages. In New Zealand, Switzerland and Japan this can happen without asking. In the United States, Australia and Canada it happens only after you tap Allow when the app asks. It never happens in the United Kingdom, the European Union, the EEA, South Korea or Quebec. Every word, number, text box and image in a recording is masked with a solid block on your phone before it is sent, and your touches, typing and network activity are not recorded. The app never records your face scans, your camera, shelf or product photos, your chats, your health answers, your scores or your skin reads. Recordings go to PostHog in the United States and are deleted after 30 days. You can turn screen recordings off or on in Settings, Privacy & my data, under Help us improve Oleah.

Crash and error reports, and server records of AI request counts, cost and timing, may also be tied to the account. Crash reports go to PostHog where its SDK runs, and to Oleah's own error log. They are distinct from stored conversations.

Our website uses cookies and similar technologies for site operation and analytics. We obtain consent where required and honour applicable opt-out rights. Browser controls can block or remove cookies, although some features may then work differently. A browser Do Not Track setting does not itself change our processing; legally recognised opt-out signals are handled where required.

On oleah.skin, PostHog, Google Analytics and Fastlane measure visits, and Cloudflare Turnstile checks forms for bots. These services may collect information about visits over time and across sites. We do not authorise the use of face data or health content for advertising. Contact us for information about the website services in use and to exercise an applicable objection or opt-out.

5. Who receives information

On oleah.skin, the routine check sends the products you enter to Google's Gemini API. A voice answer in a feedback form goes to Groq to be transcribed and to Google's Gemini API to sort it.

Providers acting for us receive information for the services they provide. Each service provider handles the personal data it receives from Oleah under its own terms and, where they apply, its standard data processing terms. Some also have independent responsibilities, such as payment administration, security, abuse prevention or compliance with law. Apple, Google and RevenueCat handle sign-in, payment and subscription status and do not receive a face scan, chats or health details. Under their terms, our AI provider, the host and PostHog use that data to provide their services to Oleah, except our AI provider may keep a flagged conversation and a safety score to enforce its usage policy as this policy describes. They may not train models or use the data for ads. We disclose sensitive information only as permitted by law and the relevant consent. Contact privacy@oleah.skin for our current recipient list, processing locations or information about a particular disclosure.

We may also disclose information to professional advisers under confidentiality duties, where legally required, or as lawfully necessary to protect rights and safety. A business transfer remains subject to applicable law, existing privacy commitments and any required consent. We obtain your consent before transferring face data to a buyer; if you decline, it is deleted subject to applicable legal requirements.

We do not sell your personal information. We do not use your face data for advertising.

6. International processing and protection

Our company is in Singapore, our primary storage is in Mumbai, India, and providers or authorised personnel may process information in the United States and other countries where they operate. Our AI provider stores the content it processes in the United States. Laws there may differ from those where you live, including rules on government access.

The European Commission has not found the United States, India or Singapore adequate for this transfer. For transfers requiring safeguards, we use an applicable lawful transfer mechanism, such as approved contractual protections. Our AI provider's data processing addendum includes the EU standard contractual clauses and the UK addendum. You may request a copy of the safeguards relevant to your data at privacy@oleah.skin. For Australian users, we do not ask you to waive Australian Privacy Principle 8. If you are in New Zealand, our host and our AI provider are outside New Zealand. You can ask privacy@oleah.skin how they are required to protect your information.

We use administrative, technical and organisational safeguards appropriate to the information, including access restrictions and protections for stored and transmitted data. No system is completely secure. We respond to security incidents and notify affected people and authorities when required by law.

7. Retention and deletion

We retain account information, conversations, saved notes, scans and results while needed to provide your account history and requested features. An open account does not override a legal retention limit, a valid deletion request or the end of a processing purpose. The Biometric Policy and Agreement sets out the additional deadlines for face data.

Account deletion. When you confirm deletion in the app, original face photos are deleted then, on the phone and in their encrypted storage. Face geometry, 3D face points, and scan logs that contain them are deleted as soon as deletion is confirmed. A sweep also deletes them about every 10 minutes. They are not kept for the 30-day restore window. They are stored in file storage, not in the database. The scan diagnostics log with head angle and distance is in the database and is deleted within 30 days after account deletion. File storage is not backed up. Signing in does not cancel deletion. Only Restore my account, chosen within 30 days, restores the account. That restore applies only to non-biometric account data. It does not bring back original face photos, face geometry, 3D face points, or those scan logs. Other non-biometric account data is deleted after 30 days. The PostHog person profile and the events tied to the account are deleted with that purge. This is different from a request to exercise a statutory erasure right, which we handle within the applicable legal deadline. The Biometric Policy and Agreement states the further deadlines for face geometry.

Withdrawing consent deletes the account, and that ends the collection purpose. Face geometry, 3D face points, and scan logs that contain them are deleted as soon as deletion is confirmed. Scan records, the forecast, face files, including chat photos stored with those face files, and shelf photos are deleted on a sweep about every 10 minutes. Shelf photos are deleted within about 10 minutes of that withdrawal. The analysis job is deleted after 48 hours. During those 48 hours it can hold a photo or health text. It does not keep face-geometry records after the purpose ends. Deleting the Oleah account does not remove a waitlist entry or a website shelf-audit photo.

Deleting the app or your Oleah account does not cancel an App Store subscription. Cancel separately in your Apple account settings.

Other retention is determined as follows:

• Diagnostics: in-house session-detail rows are dropped after 90 days. Shelf-read rows are dropped after 30 days. Analysis jobs are dropped after 48 hours. Error rows with no account id are kept for as long as needed to investigate the fault.
• Support, forms and communications: while needed to handle the request, provide the requested feature or communication, and resolve related issues. We retain a limited suppression record to honour an unsubscribe request.
• Consent, Terms and purchase records: limited records are generally retained for six years after account closure for consent and contract evidence, and five years after purchase for accounting. An under-16 consent record is deleted with that account and is not kept for six years. Different periods apply where law requires them. This does not authorise retaining conversations, face data or health content under those labels.
• Backups: Face geometry, 3D face points, and scan logs that contain them are stored in file storage, not in the database. The scan diagnostics log with head angle and distance is in the database and is deleted within 30 days after account deletion. File storage is not backed up. Other database backups age out in about 8 days. A database backup that still holds other records is restricted to recovery and required legal purposes; deletion is reapplied if a backup is restored.
• Provider copies: the subscription customer record held by RevenueCat, Inc. remains after account deletion. It is kept for subscription administration, and only for the purchase-record period of five years after purchase. The account purge does not delete that record. The PostHog person profile and the events tied to the account are deleted when you delete your account. New events do not include a skin score. Events stored through 11 October 2026 can still include a skin score, a postcode or coordinates. Those events are kept with the other analytics events until the account is deleted. Other providers may keep copies under their own retention terms. Our AI provider deletes inputs and outputs within 30 days, unless its safety systems flag the conversation or the law requires longer. A flagged conversation can be kept for up to 2 years. A safety score on a flagged conversation can be kept for up to 7 years. It does not delete a copy early because the Oleah account was deleted. Its contract can also require a longer keep to combat harmful use.

Where law permits or requires retention for a legal duty or claim, we retain only the necessary information, restrict its use and delete it when that basis ends. We do not promise that all copies disappear at the instant an account is closed.

8. Your rights and choices

You can withdraw consent only by deleting your account in Settings. Oleah then stops sending your data to Anthropic. Tap Delete Account. Use Privacy & my data for available export tools and links to our policies. Email privacy@oleah.skin to request access, a copy, correction or deletion; object to or restrict processing; or ask about recipients. Deleting the account is the withdrawal. A feature may stop working if the withdrawn processing is necessary for it. Privacy and billing requests remain available.

We may verify your identity using information reasonably needed for the request. An authorised agent may act for you where permitted. We respond within the period required by applicable law, generally within one month or 30 days, or within 45 days where that statutory period applies. Any permitted extension will be explained within the initial deadline. We do not restart a statutory response period simply because verification is needed where the law prohibits doing so.

Requests are normally free. Any permitted fee or refusal for excessive or unfounded requests will be explained. We do not unlawfully discriminate against you for exercising your rights.

If we refuse a request, email privacy@oleah.skin with Appeal in the subject. We explain our decision within 45 days or any shorter applicable period. You may also complain directly to the appropriate authority.

• EEA and UK: you may have rights to portability, restriction and objection, including objection to direct marketing. You may complain to your local data protection authority or the UK's Information Commissioner's Office. You can complain to us at privacy@oleah.skin. We acknowledge that complaint within 30 days. Consent can be withdrawn without affecting earlier lawful processing. Where relevant information is necessary for a requested feature, not providing it may prevent that feature from working.
• Australia, Canada and Singapore: you may contact the OAIC, the Office of the Privacy Commissioner of Canada or the relevant provincial authority, or Singapore's PDPC, respectively. Local access, correction, consent and complaint rights apply.
• United States: applicable state law may provide access, correction, deletion, portability, sensitive-data, appeal and opt-out rights, including rights concerning sale, targeted advertising or significant automated decisions. We use health details, face scans and chats to provide Oleah, to keep it secure, and to check and fix the service. We do not use them for purposes beyond those. We do not sell them. A skin result is an automated estimate. It is not a decision about your legal rights. You can ask for a person to review it at privacy@oleah.skin. Our focused health and biometric notices explain additional rights.

You must be at least 16 to use Oleah. Oleah is not offered in Quebec or Korea. To check this, Oleah uses your App Store country and phone region. For Quebec, our server also reads the province of your internet connection from our website host, without storing your IP address. If a birthday shows that someone is under 16, we block the app at once, delete face geometry at once, and delete that account and the rest of its data within 30 days. If you believe we hold information from a child or an ineligible user, contact privacy@oleah.skin. If your iPhone shares an age range through Apple's Declared Age Range, Oleah uses it only for this age check. If it shows you are under 16, a birthday that says otherwise is not accepted.

9. Communications

We send service communications needed for your account and respond to requests. Where permitted, we also send news, invitations and other communications about Oleah. You can unsubscribe from promotional messages at any time; necessary service messages may continue.

For relevant professional or creator contacts, we may obtain contact and professional information from public sources, referrals or direct correspondence. We use it to assess relevance, communicate about Oleah and manage responses and preferences. Our communications systems may record delivery, opens and link interactions. The applicable marketing and privacy rules govern these activities, and you may object by replying or contacting privacy@oleah.skin.

10. Changes and contact

We publish updated versions of this policy and notify you of material changes. We obtain fresh consent before using existing face or health data for a new purpose that requires it. Updating a notice does not itself grant us consent.

Privacy and our Data Protection Officer: privacy@oleah.skin. Support, billing and legal notices: care@oleah.skin. Postal address: ONE EIGHT EIGHTEEN PTE. LTD., 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914.