Privacy Policy

This Privacy Policy explains how Permanent Makeup AI (“Permanent Makeup AI,” “we,” “our,” or “us”) collects, uses, retains, and shares the information you provide when you use https://permanentmakeup.ai and our related services (the “Service”).

Our Service generates illustrative previews of permanent makeup procedures using artificial intelligence. To do that, we process photographs of your face. We treat this information as sensitive and have written this policy in plain English so you can make an informed decision before you upload anything.

1. Definitions

• Input Photo: a photograph you upload of yourself for the purpose of generating a preview.
• Output Image: an AI-generated image we produce from your Input Photo, showing an illustrative preview of a permanent makeup style.
• Biometric Information: as used in this policy, refers to information derived from your photograph that can identify you. The Illinois Biometric Information Privacy Act (“BIPA”) defines this term broadly. We process photographs of you to generate Output Images; we do not extract, store, or use any face geometry, faceprint, or unique biometric identifier for identification, surveillance, or marketing purposes.
• Account Data: the email address, display name, and avatar associated with your account.

2. Information We Collect

2.1 Information you provide

• Account Data when you sign in with Google or an email magic link.
• Input Photos when you upload an image of yourself to generate a preview.
• Style preferences (the PMU type, style preset, and intensity you select).
• Payment information when you buy credits. Payments are processed by Stripe; we do not store your card number.
• Customer support correspondence when you contact us at support@mg.permanentmakeup.ai.

2.2 Information collected automatically

• Authentication cookies and session data so we can keep you signed in.
• Request logs including IP address, user agent, and a request ID for debugging and abuse prevention.
• Generation metadata such as the time and duration of a generation, the model used, and credit deductions.

We do not use advertising trackers and we do not sell your data (see Section 8).

3. Biometric Consent and Illinois BIPA

If you are a resident of Illinois or are otherwise covered by the Illinois Biometric Information Privacy Act (740 ILCS 14), the following applies in addition to the rest of this policy.

By uploading an Input Photo to the Service, you provide your explicit, written consent for Permanent Makeup AI to collect, store, and process photographs of your face for the sole purpose of generating Output Images that you have requested. This consent is required before any processing occurs and is recorded against your account at the moment of upload.

The terms of that consent:

• Purpose: we process your photograph only to produce the Output Image you requested. We do not use it to identify you, profile you, or train AI models.
• Retention schedule: Input Photos are deleted within thirty (30) days of the generation that produced your Output Image, or sooner upon your request. Output Images are retained on your account until you delete them, or until your account is deleted, after which they are removed within thirty (30) days.
• Withdrawal of consent: you may withdraw your consent at any time by deleting your photos from your dashboard or by emailing support@mg.permanentmakeup.ai. Withdrawing consent does not affect processing already completed.
• No disclosure or sale of biometric data: we do not sell, lease, trade, or otherwise profit from your photographs or any biometric information derived from them.

4. How We Use Your Information

We use the information we collect to:

• Generate the Output Images you request from your Input Photo
• Maintain your account, credit balance, and purchase history
• Process payments through Stripe
• Provide customer support
• Detect, investigate, and prevent abuse, fraud, or misuse
• Comply with our legal obligations

We do not use your Input Photos or Output Images to train any AI model.

5. AI-Generated Output Disclaimer

Output Images produced by the Service are illustrative previews generated by artificial intelligence. They are not a medical prediction, a clinical diagnosis, or a guarantee of any actual permanent makeup outcome. Real results depend on your skin, the technique and pigment your artist uses, and how your skin heals. You should treat Output Images as a planning tool for conversation with a licensed PMU artist, not as a substitute for professional consultation.

6. Sharing with Third-Party Processors

We share the minimum information necessary with the following processors so the Service can function:

• Replicate (AI inference): processes your Input Photo to generate the Output Image. Replicate is contractually prohibited from using your photo for any purpose other than fulfilling your generation request, and is required to delete it after processing.
• Supabase (database and storage): stores your Account Data, Output Images, and metadata such as credit balance and generation history.
• Stripe (payments): processes credit purchases. Card numbers are sent directly to Stripe and never touch our servers.
• Google (authentication): if you sign in with Google, your Google account email and name are shared with us for authentication only.
• Resend (transactional email): sends magic-link sign-in emails and receipts.

We do not share your information with advertisers, data brokers, or any party outside the list above.

7. Data Retention

• Input Photos: deleted within thirty (30) days of the generation that used them. We do not need them after that and we do not keep them.
• Output Images: retained on your account until you delete them or until your account is deleted. After account deletion, Output Images are removed within thirty (30) days.
• Account Data and transaction records: retained while your account is active, then for up to seven (7) years after deletion to comply with tax, accounting, and consumer protection laws.
• Logs: retained for up to ninety (90) days for debugging and abuse prevention.

8. Your Rights

8.1 Everyone

Regardless of where you live, you can:

• Access the personal data we hold about you
• Request correction of inaccurate information
• Delete individual photos, all photos, or your entire account from your dashboard
• Export a copy of your data by emailing support@mg.permanentmakeup.ai
• Withdraw your biometric consent at any time

8.2 EU / UK / EEA users (GDPR and UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation, including the right to data portability, the right to object to processing, the right to restrict processing, and the right to lodge a complaint with a supervisory authority in your country of residence.

Lawful basis: we process your information on the basis of (a) the contract between you and us to provide the Service, (b) your explicit consent for the processing of facial imagery, and (c) our legitimate interest in preventing fraud and improving the Service.

EU representative: if you would like to contact our EU representative, please email support@mg.permanentmakeup.ai and we will route your request appropriately.

8.3 California users (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request its deletion, to correct it, and to opt out of any sale or sharing of personal information.

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We have not done so in the past twelve months and we have no plans to do so.

To exercise your rights, email support@mg.permanentmakeup.ai. We will not discriminate against you for exercising any of these rights.

9. Security

Your information is stored using industry-standard encryption in transit (TLS) and at rest. Photos are stored in Supabase Storage behind access controls that limit visibility to your account. Stripe handles payment information directly. We routinely review our practices, but no system is perfectly secure; if we ever discover a breach that affects you, we will notify you in accordance with applicable law.

10. Children's Privacy

The Service is intended for adults eighteen (18) years of age or older. We do not knowingly collect information from children under thirteen (13), and we do not knowingly process Input Photos from anyone under eighteen. If you believe a minor has uploaded a photo, please contact us and we will delete it.

11. International Transfers

The Service is operated from the United States. If you access it from outside the United States, your information will be transferred to, stored in, and processed in the United States. Where required, we use standard contractual clauses or equivalent safeguards with our processors.

12. Changes to this Policy

We may update this Privacy Policy as our service and the applicable laws evolve. If we make a material change, we will notify you by email or through a prominent notice in the product before the change takes effect. The “Last Updated” date at the top of this page always reflects the current version.

13. Contact

Questions, requests, or complaints about privacy can be sent to support@mg.permanentmakeup.ai. You can also delete your photos and your account from your dashboard.