Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") explains how xZenith Lab ("Glowi", "we", "us") collects, uses, stores, shares, and protects your personal data when you use the Glowi mobile application ("Application").

By accessing or using the Application, you acknowledge that you have read and understood this Policy. If you do not agree, please discontinue use of the Application.

2. Data Controller

The data controller responsible for processing your personal data under this Policy is xZenith Lab ("we", "us", or "our"), developer and operator of the Glowi mobile application.

For data protection inquiries, you may contact us at xzenithlabs@gmail.com.

3. Personal Data We Collect

Depending on your use of the Application, we may process the following categories of data:

• Identity and contact data: name, e-mail address, and similar account information you voluntarily provide.
• Image data: photographs and camera captures of your face submitted for skin analysis.
• Analysis data: scores, recommendations, and reports generated from your images.
• Location data: approximate location when you grant permission, used to provide UV index, temperature, and humidity information.
• Device and usage data: device model, operating system version, app version, language preference, crash logs, and interaction data necessary for security and performance.
• Transaction data: subscription status and payment-related metadata processed through app store platforms (we do not store full payment card details).

4. Purposes of Processing

Your personal data is processed for the following purposes:

• Performing AI-assisted facial skin analysis and delivering personalised recommendations.
• Operating, maintaining, and improving the Application and user experience.
• Providing environmental skin insights based on location (UV, weather, humidity).
• Managing subscriptions, billing, and customer support.
• Ensuring information security, detecting abuse, and complying with legal obligations.
• Sending service-related communications where you have opted in.

5. Legal Bases for Processing

We process personal data on the following legal bases, as applicable:

• Performance of a contract: providing the Application and requested analysis services.
• Explicit consent: processing face images, camera access, photo library access, and location data where required.
• Legitimate interests: ensuring security, preventing fraud, improving service quality, and defending legal claims, provided your fundamental rights are not overridden.
• Legal obligation: compliance with applicable laws and regulatory requests.

6. Face Images and Skin Analysis Data

Face images you submit (via camera or photo library, including multi-angle captures) are processed solely to perform AI-assisted skin analysis and to present results within the Application. During capture, your device may use on-device face detection to help align photos; this processing stays on your device and is not stored separately.

When you request an analysis, face images are transmitted to our secure servers over encrypted connections. Our servers process images in memory to deliver analysis and do not persistently store face images after processing completes. Analysis is performed using OpenAI as our AI processing provider; face images are shared with OpenAI only to perform the analysis you request and are not used by Glowi for advertising or sold to third parties.

Analysis results (scores, recommendations, and related text) may be stored locally on your device to support progress tracking. Glowi does not save face photos to your photo library unless you explicitly choose to do so outside the app.

Glowi does not provide medical diagnosis or treatment. Analysis results are informational and cosmetic in nature. We do not use your images for advertising profiling without your explicit consent.

7. Location Data

With your permission, we process approximate location data to retrieve environmental information such as UV index, temperature, and humidity from third-party weather services. Location data is not used for behavioural advertising. You may withdraw location permission at any time through your device settings; certain features may then be unavailable.

8. Sharing with Third Parties

We do not sell your personal data. We may share data only in the following circumstances:

• AI analysis provider (OpenAI): to perform face image analysis when you request a scan.
• Cloud infrastructure providers (Google Cloud / Firebase): to host and operate our backend services.
• Subscription management (RevenueCat) and Apple App Store: to manage premium subscriptions and payments.
• Service providers: analytics, customer support, and other processors bound by confidentiality and data processing agreements.
• Weather data providers: to obtain environmental information when you enable location features.
• Legal requirements: when required by law, court order, or competent authority.
• Business transfers: in connection with a merger, acquisition, or asset sale, subject to continued protection of your data.

All recipients are required to process data only for specified purposes and in accordance with applicable law.

9. International Data Transfers

Your data may be processed or stored on servers located outside your country of residence, including within the European Economic Area or other jurisdictions with adequate protection measures.

Where required, we rely on appropriate safeguards such as standard contractual clauses, explicit consent, or other mechanisms recognised under KVKK and applicable international data transfer rules.

10. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy or as required by law.

• Face images: processed transiently on our servers during analysis and not persistently stored after processing completes. Images exist only temporarily in device memory during capture and analysis sessions.
• Analysis results: stored locally on your device until you delete the app, clear app data, or remove history within the Application.
• Account and subscription records: retained for the duration of the relationship and applicable statutory limitation periods.
• Technical logs: retained for up to 12 months for security and troubleshooting.

Upon expiry of retention periods, data is securely deleted, destroyed, or anonymised.

11. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These measures include encryption in transit, access controls, secure development practices, and periodic security reviews.

No method of transmission or storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

12. Your Rights

Under applicable data protection law, including the Turkish Personal Data Protection Law No. 6698 (KVKK), you may have the right to:

• Learn whether your data is being processed.
• Request information about processing.
• Learn the purpose of processing and whether data is used accordingly.
• Know third parties to whom data is transferred.
• Request correction of incomplete or inaccurate data.
• Request deletion or destruction of data under conditions set forth by law.
• Request notification of correction or deletion to third parties.
• Object to adverse results arising solely from automated processing.
• Claim compensation for damages arising from unlawful processing.

Requests may be submitted to xzenithlabs@gmail.com. We may need to verify your identity before responding.

13. Children's Privacy

The Application is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a minor has provided us data, please contact us immediately so we can take appropriate action.

14. Changes to This Policy

We may update this Policy to reflect changes in law, technology, or our services. Material changes will be communicated through in-app notice or other appropriate means. The updated version will indicate the revision date. Continued use of the Application after publication constitutes acceptance of the updated Policy, to the extent permitted by law.

15. Contact

For questions, requests, or complaints regarding this Policy or your personal data:

Data Controller: xZenith Lab
Application: Glowi
E-mail: xzenithlabs@gmail.com

We will respond to requests within the timeframes prescribed by applicable law. You may also lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) or your local supervisory authority where applicable.