This policy explains how PeakLooks (“we”) handles your personal data under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and its rules. We are the data fiduciary for the data described here.
What we collect
- Your face photo, taken with your camera or uploaded by you.
- Your answers: first name, age, sex, city, skin tone, skin type, skin and hair concerns, height and weight (optional), body build, activity level, training equipment, diet, protein and water intake, junk-food habits, sleep, skincare and sunscreen habits, hair-wash frequency, self-care budget and similar lifestyle details.
- Payment status. Payments are handled by Razorpay. We never see your card, UPI or bank details. We receive confirmation that a payment succeeded, the plan, and an order reference.
- Your email address, only if you choose to give it, so we can send you your PDF.
- A short-lived cookie that records your paid plan.
Why we use it
- To read your photo and answers and produce your PDF report, and the after-photo preview on the Full plan.
- To confirm you paid and give you the plan you bought.
- To email you your PDF once, if you gave an email address. We do not use it for marketing.
- To meet legal and tax obligations.
We do not sell your data. We do not use your photo for advertising. We do not use your photo to train AI models.
Your photo and consent
We ask for your photo only to produce your report. By adding a photo and continuing, you consent to us processing it for that purpose, including sending it to the AI provider named below. You can withdraw consent at any time (see “Your rights”). Withdrawing does not affect processing already done, and we cannot produce a report without a photo. You must be 18 or older to use PeakLooks; we do not knowingly process the data of children.
Who we send it to
- DeepInfra (AI inference provider, United States). Your photo and your answers are sent to DeepInfra’s servers so that AI models can analyse the photo, write the report and, on the Full plan, create the after-photo preview. Processing happens outside India. DeepInfra handles that data under its own terms and privacy policy.
- Razorpay, our payment processor. It collects and processes your payment details under its own privacy policy.
- Cloudflare, which stores our research library. Your photo is not sent there. The text of your concerns may be used to search the research library.
- Resend, our email provider, only if you gave an email address. Your email and the PDF (which contains your photo and answers) pass through it once to reach your inbox.
- Vercel, which hosts this website and runs our servers.
We may also disclose data where the law or a court requires it.
How long we keep it
- Photo and answers: processed in memory while your report is built. We do not save them to our database or disk, and we do not keep a copy of your report. Before you pay they stay only in your own browser tab and are cleared when you close it or after your report is made. Once the report is delivered, download it; we cannot recover it for you.
- Order cookie: expires after 2 hours or when your report is delivered.
- Payment and order records: kept by us and Razorpay for as long as tax and accounting law requires.
- Your email address and the PDF we email you: used for that one send and not stored by us. A copy stays in your own inbox, and the email provider may keep delivery logs for a short time.
DeepInfra may keep requests for a short time on its own systems, for example for abuse monitoring. We do not control that period; check its policy for current details.
Your rights
Under the DPDP Act you can:
- ask for a summary of the personal data we process and who we share it with;
- ask us to correct or complete your data;
- ask us to erase your data, or withdraw your consent;
- nominate someone to exercise these rights for you if you die or cannot act;
- raise a grievance with us and, if we do not resolve it, complain to the Data Protection Board of India.
To use any of these rights, or to raise a grievance, follow the steps on our data rights & grievances page or email [email protected].
Security
We use encrypted connections, signed order cookies, and we avoid storing your photo at all. No system is perfectly secure. If a breach affects your data we will tell you and the Data Protection Board as the law requires.
Cookies
We set one cookie, to remember your paid plan for a short time. We do not use advertising or analytics cookies.
Changes
If we change this policy in a way that matters we will update the date above and, where the law requires, ask for your consent again. See also our Terms of service.
Contact
PeakLooks, TODO: registered postal address, India. Email: [email protected].