Effective Date: 20 April 2026 | Last Updated: 20 April 2026 | Version 2.0
This Privacy Policy describes how The Skin Agent Pte. Ltd. ("The Skin Agent", "we", "us", or "our"), incorporated in Singapore (UEN: 202609661M), collects, uses, stores, and shares your personal data when you use The Skin Agent mobile application (the "App").
We are committed to handling your personal data responsibly and in compliance with applicable privacy laws across all markets in which we operate, including Singapore, Japan, South Korea, Thailand, Indonesia, Vietnam, the Philippines, and Malaysia.
By downloading and using the App, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the App.
IMPORTANT: The Skin Agent processes sensitive personal data including derived face scan results and heritage data. We obtain separate, explicit consent before processing either category. You may use the App without providing either type of sensitive data.
Data Controller:
The Skin Agent Pte. Ltd.
Registered in Singapore
UEN: 202609661M
Address: 2 VENTURE DRIVE #19-21 VISION EXCHANGE SINGAPORE 608526
Privacy contact: privacy@theskinagent.ai
We have appointed a Data Protection Officer (DPO) who is responsible for overseeing our compliance with applicable data protection laws, including Singapore's PDPA. The DPO can be contacted at privacy@theskinagent.ai.
Japan:We process your personal data in accordance with Japan's Act on the Protection of Personal Information (APPI). Contact us at privacy@theskinagent.ai for APPI-related requests.
South Korea:We designate a local representative for PIPA compliance. Details are available in the Korean-language supplement accessible in Settings > Legal within the App.
The table below summarises all categories of personal data we collect. Rows marked Sensitive require your explicit consent before we process them.
| Category | What We Collect | Why We Collect It |
|---|---|---|
| Identity and Account | Name, email address, password (hashed and salted) | Account creation and authentication |
| Skin Profile Data | SPEC profile (OD, SR, PN, WT axes), skin quiz responses, skin type, concerns, product sensitivities | Personalised skincare intelligence and product recommendations |
| Derived Face Scan Results (Sensitive) | SPEC skin zone scores, skin health metrics, and zone analysis outputs derived on-device. Raw face images and facial landmark coordinates are NEVER transmitted. | SPEC scan feature and longitudinal skin tracking. Explicit consent required before first scan. |
| Heritage Response Data (Sensitive) | Self-reported ethnic heritage and genetic skin characteristics for Heritage Response (HR) axis calibration | HR axis calibration only. Entirely voluntary. Skipping this has no impact on other features. |
| Coarse Location | City-level location derived from your stated city or region. Precise GPS coordinates are never requested or stored. | Climate Response (CR) axis recalculation using local weather conditions |
| Chat and Conversation Data | Free-form chat messages sent to the Derma AI assistant | Personalised AI responses. Messages processed via third-party LLM API with your explicit prior consent. |
| Usage and Product Data | Products scanned, ingredients checked, dupes searched, routines built, saved product shelf, scan history | Product recommendations, anonymised B2B cohort analytics, affiliate revenue attribution |
| Device and Technical Data | Device type, OS version, app version, crash logs, session duration | App stability, fraud prevention, and performance improvement |
| Subscription Status | Active or inactive Pro subscription status and tier only. No card numbers or payment details. | Pro entitlement verification. Payment processing handled entirely by Apple App Store or Google Play. |
Data we do NOT collect:
| Processing Activity | Legal Basis | Notes |
|---|---|---|
| Account creation and authentication | Contract performance | Necessary to provide the service |
| SPEC profile and recommendations | Contract performance | Core product functionality |
| Derived face scan results | Explicit consent | Separate consent screen before first scan. Withdrawable at any time. |
| Heritage Response (HR) data | Explicit consent | Voluntary. May be skipped entirely. |
| LLM AI chatbot processing | Explicit consent | Separate consent screen before first chat session. Withdrawable at any time. |
| Anonymised B2B cohort analytics | Legitimate interest | Aggregated data only. Minimum cohort of 50 users enforced. No individual is identifiable. |
| Push notifications | Consent | Requested at account creation. Opt-out available in device settings at any time. |
4.1 To Provide the App
4.2 To Improve the Platform
4.3 Affiliate Commerce
4.4 Clinic Discovery Referrals
5.1 How the Face Scan Works
The SPEC face scan is built on a fully on-device processing pipeline. No raw face data of any kind is ever transmitted to our servers or to any third party.
Step 1: Face Detection and Mesh Generation via MediaPipe Face Mesh. The App uses MediaPipe Face Mesh to detect the face and generate a 3D mesh of 468 facial landmark coordinates entirely on your device. The landmark coordinates and the camera image never leave your device.
Step 2: Skin Region Extraction. From the MediaPipe mesh, the App identifies skin zones corresponding to the six SPEC axes. These zones are cropped from the camera frame in memory on your device.
Step 3: On-Device Skin Classification via EfficientNet and ONNX Runtime. The cropped skin zone images are passed to a lightweight EfficientNet model, which runs on-device via ONNX Runtime without any server calls.
Step 4: SPEC Score Transmission. Only the final SPEC axis scores (six numerical values) leave your device. These are transmitted over TLS 1.2 or higher encryption.
What stays on your device:
What leaves your device:
5.5 Third-Party AI Disclosure
The Derma AI chatbot processes your natural language messages using a third-party large language model (LLM) provider. We obtain your explicit consent before your first chat session. Chat messages sent to the LLM contain your text input only. Your SPEC profile, face scan results, email address, and account identifiers are never included in LLM API calls. The LLM provider does not train on your messages.
You may initiate deletion of your account and all associated personal data directly within the App. No external steps or emails are required.
To delete your account:
You may also request deletion by emailing privacy@theskinagent.ai with the subject line "Account Deletion Request".
We do not sell your personal data to any third party. We do not use your data for advertising.
We share data only with service providers necessary for app functionality: Apple App Store/Google Play for subscription processing, RevenueCat for in-app purchase management, cloud infrastructure providers (AWS or GCP), and weather API providers for CR axis recalculation.
B2B data sharing: Beauty brand clients receive anonymised, aggregated cohort reports only. These reports contain no names, email addresses, device identifiers, or any other data capable of identifying an individual user. A minimum cohort threshold of 50 users is enforced.
We retain your personal data for as long as your account is active. When you delete your account:
The Skin Agent is headquartered in Singapore. Your data may be processed in Singapore and in other countries where our cloud infrastructure providers operate, primarily in Asia Pacific regions.
Where we transfer personal data outside your country of residence, we ensure appropriate safeguards are in place including standard contractual clauses and data processing agreements with all sub-processors.
You have rights over your personal data under applicable law, including: access, correction, deletion, withdrawal of consent, and data portability where required by law.
How to Exercise Your Rights:
The App does not use advertising tracking identifiers (IDFA on iOS, GAID on Android). We do not track users for advertising purposes. No third-party advertising SDKs are embedded in the App.
The Skin Agent is not directed at persons under the age of 18. We do not knowingly collect personal data from anyone under 18 years of age. If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@theskinagent.ai.
Our App Store privacy nutrition labels accurately reflect the data practices described in this policy. Health and Fitness data, Sensitive Info (derived face scan results, Heritage Response data), User Content (chat messages), and Usage Data are linked to your identity for App Functionality purposes.
We may update this Privacy Policy to reflect changes in our practices, technology, or applicable law. When we make material changes, we will update the Effective Date and notify you via in-app notification. For changes involving sensitive data processing or new third-party AI providers, we will request fresh explicit consent.
For any questions, to exercise your rights, or to make a complaint:
Email: privacy@theskinagent.ai
Address: 2 VENTURE DRIVE #19-21 VISION EXCHANGE SINGAPORE 608526
Response time: Within 30 calendar days of receipt
If you are not satisfied with our response, you may lodge a complaint with your local data protection authority (PDPC in Singapore, PPC in Japan, PIPC in South Korea, or the relevant authority in your market).
The Skin Agent Pte. Ltd. | Singapore | Version 2.0 | 20 April 2026