Privacy Policy

KrisOriginals Pvt. Ltd (CIN U51909HR2018PTC074470), trading as HairOriginals, of Plot No. 220, Udyog Vihar, Phase IV, Sector 18, Gurugram, Haryana – 122015, India, is the controller of the personal data described here. Privacy requests go to aniket.kushwaha@hairoriginals.com.

Purchases on the HairOriginals storefront are governed by the storefront privacy policy. Where the two documents differ on the handling of photos you upload to this app, this policy applies.

The core feature requires a photo of your face. A facial image processed to generate a likeness is treated as biometric / special-category data under the EU/UK GDPR (Article 9) and under US state biometric laws including the Illinois Biometric Information Privacy Act. We process it only on your explicit consent, which you give by ticking the consent box before uploading. The box is unticked by default and is asked again for each new photo, so consent is never assumed from a previous try-on. You can withdraw consent at any time by requesting deletion.

Your uploaded photo is stored, not discarded after processing, so your past try-ons remain visible in “My Looks”. Both the original photo and each generated image are retained until you request deletion or the retention period below elapses.

We do not use your photo to train any AI model, and we do not use it for facial recognition, identification, or matching you against any database.

• Phone number — used to sign you in via one-time code, and as your account identifier.
• Name and email — only if you provide them when requesting a stylist consultation.
• Device and usage data — a hashed device fingerprint, a hashed IP address, and a device cookie. These exist to meter free try-on credits and prevent abuse; this is strictly necessary to run the service.
• Try-on activity — which products you viewed, tried, and saved, plus any feedback or rating you submit.

• Google (Gemini API) — receives your uploaded photo and the product image in order to generate the try-on. Processing occurs on Google infrastructure, which may be outside your country.
• Supabase — database, authentication, and image storage.
• Digicuro CRM — if you request a stylist consultation, your contact details and links to your generated looks are sent so a stylist can follow up.
• SMS providers — your phone number is sent to the provider that delivers your one-time code (Nimbus for Indian numbers, Twilio elsewhere).
• Meta — if you accept analytics cookies, we send advertising measurement events. Email and phone are hashed before sending; your IP address is sent to Meta as part of this.

Transfers outside your region rely on the relevant provider's standard contractual clauses or equivalent safeguards.

We do not share mobile opt-in information or SMS consent with any third party or affiliate for marketing purposes, and we never sell your mobile number. The number you give us is used to deliver your one-time sign-in code and to identify your account. It is disclosed only to the SMS provider that carries that message, and only for that purpose.

The advertising measurement described above never transmits your number in readable form — it is hashed irreversibly before it leaves our systems, is used only to match existing ad interactions, and is not sent at all unless you accept analytics cookies.

You receive one message per sign-in attempt; we do not send marketing SMS. Reply STOP to any message to opt out, or HELP for help. Message and data rates may apply. Opting out blocks future verification codes, so you will not be able to sign in by SMS afterwards.

We do not sell, rent, or trade your personal data, and we never disclose it to anyone in exchange for money or other valuable consideration. That covers your photos, your generated looks, your phone number, and your try-on history. We have no data-broker relationships and we do not license your data to anyone.

The companies named above are service providers working on our instructions. They may use your data only to deliver the specific service we have asked them for, and not for their own purposes. Your photo goes to Google to generate your try-on and for nothing else — not to train their models, and not to build a profile of you.

To be straightforward about the one exception: if you accept analytics cookies, we send advertising measurement events to Meta. No money changes hands, but some US state privacy laws still classify that as “sharing” for cross-context behavioural advertising, so we would rather name it than let you find out later. Decline cookies and it never happens. If you have already accepted and want to undo it, clearing this site's data in your browser resets the choice and we will ask you again.

We are established in India and the app is operated from there, but it is available to users elsewhere. Where you are in the EEA, the UK, or a US state with its own privacy or biometric statute, we apply the protections that law gives you — including the consent, access, and deletion rights set out below — regardless of where we are based.

A device cookie is set to track your free credits — this is strictly necessary and is not optional. Analytics and advertising scripts (Meta Pixel, Vercel Analytics) load only after you accept where consent is required, and never before. Declining leaves the app fully functional.

Photos, generated images, and account data are kept while your account is active. If you request deletion we remove them within 30 days, except where we are required to retain records by law.

To ask for deletion, email aniket.kushwaha@hairoriginals.com from the address or phone number on your account, or contact the Grievance Officer below. Deleting your photos does not affect any order you have placed on the storefront.

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your data, to object to processing, and to withdraw consent at any time without affecting prior processing. EEA/UK users may also complain to their local supervisory authority.

To exercise any of these, email aniket.kushwaha@hairoriginals.com. We respond within the period required by applicable law.

The app is not intended for anyone under 16, and we do not knowingly collect data — least of all facial images — from anyone below that age. If you believe someone underage has used the app, contact us and we will delete the data.

Under the Digital Personal Data Protection Act 2023, Indian users may contact our Grievance Officer, Mayank Sharma, at feedback@hairoriginals.com or +91 9267993875.