Privacy Policy

1. Who we are and who this applies to

Facializer AI is a software-as-a-service platform that businesses (such as medical spas and e-commerce merchants, collectively “Merchants”) install to offer an AI-powered skin analysis tool to their own customers and website visitors (“End Users”). This policy covers both:

• Merchants who create an account or install our app through the Shopify App Store, the GoHighLevel Marketplace, or directly; and
• End Users who submit a photo for skin analysis through a Merchant’s branded page, store, or widget.

Where a Merchant uses Facializer AI to process the personal data of their End Users, the Merchant is the data controller and Facializer AI acts as a data processor on the Merchant’s behalf. For our own website and account data, Facializer AI is the controller.

2. Information we collect

We collect the following categories of information:

• Facial images. When an End User uploads or captures a photo for analysis, that image is transmitted to our AI system to generate a skin analysis. Because these images depict a person’s face, they may constitute biometric or sensitive personal information under some laws. We process them only to perform the requested analysis.
• Skin analysis results. The output generated from an image, such as detected skin concerns, an estimated skin-age range, and recommended treatments or products.
• Lead / contact information. Name, email address, and phone number that an End User provides to receive their results or to be contacted by the Merchant.
• Merchant account & business data. Business name, contact email, store or location domain, branding settings, service and product catalogs, and configuration you provide.
• Integration & authentication data. OAuth access tokens and related identifiers for connected platforms (Shopify, GoHighLevel, Klaviyo) that you authorize us to connect. These are stored encrypted at rest.
• Billing data. Subscription tier, usage counts, and billing status. Card payments are handled by our payment processors (Stripe, Shopify Billing, or GoHighLevel); we do not store full card numbers.
• Technical & usage data. IP address, device and browser type, pages viewed, and similar log data collected automatically to operate and secure the service.

3. How we use information

• To perform AI skin analysis and return results to the End User;
• To deliver leads and analysis results to the Merchant and, where the Merchant has enabled it, to sync them to the Merchant’s connected CRM or marketing tools;
• To recommend relevant treatments or products from the Merchant’s catalog;
• To provide, maintain, secure, and improve the service;
• To process subscriptions and enforce usage limits; and
• To comply with legal obligations and respond to lawful requests.

We do not sell personal information, and we do not use facial images to train third-party or general-purpose AI models. Images are used only to produce the requested analysis.

4. AI processing

Skin analysis is performed using AI vision models. Depending on configuration, images may be processed by Google’s Gemini API or by a self-hosted open model. Images are transmitted securely for the sole purpose of generating the analysis and are not retained by the model provider to train their models beyond what is necessary to return a result.

5. Service providers & sub-processors

We share personal information with a limited set of vendors that help us operate the service, each bound to protect it and use it only for the services they provide to us:

• Google Cloud / Firebase — hosting, database, and image storage;
• Google Gemini — AI image analysis (where enabled);
• Shopify — for Merchants who install via Shopify (app hosting context, billing, customer sync);
• GoHighLevel — for Merchants who install via the GoHighLevel Marketplace (CRM sync, billing);
• Klaviyo — email delivery, where a Merchant connects it;
• Stripe — payment processing, where applicable.

We may also disclose information to comply with the law, enforce our agreements, or protect the rights, safety, and security of our users and the public.

6. Data retention & deletion

We retain personal information only as long as needed to provide the service and for legitimate business or legal purposes. Leads and analysis results are retained for the Merchant until the Merchant or the End User requests deletion, or until the Merchant’s account is closed.

For Merchants installed through Shopify, we honor Shopify’s mandatory data protection webhooks: a customer data-request is logged and fulfilled, a customer redaction request permanently deletes that customer’s associated records, and a shop redaction request deletes the shop’s data upon uninstall. End Users and Merchants may also request access to or deletion of their data by contacting us at developers@envisionwc.com.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, or restrict the processing of your personal information, to object to processing, and to data portability (for example under the GDPR or CCPA/CPRA). End Users should direct requests to the Merchant that collected their data; you may also contact us and we will assist the relevant Merchant. We do not discriminate against you for exercising these rights.

8. Security

We use industry-standard safeguards to protect personal information, including encryption in transit (HTTPS/TLS), encryption of sensitive integration tokens at rest (AES-256-GCM), access controls, and tenant data isolation. No method of transmission or storage is completely secure, but we work to protect your information and to notify affected parties of incidents as required by law.

9. Cookies

We use strictly necessary cookies to keep you signed in and to operate the embedded app securely within Shopify and GoHighLevel. We do not use cookies to sell your data.

10. International transfers

We operate on cloud infrastructure that may process data in the United States and other countries. Where required, we rely on appropriate safeguards for cross-border transfers of personal information.

11. Children

Facializer AI is not directed to children. End Users must be at least 18 years old (or the age of majority in their jurisdiction) to submit a photo for analysis. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice.

13. Contact us

If you have questions about this policy or how your data is handled, contact us at developers@envisionwc.com. For help using the product, visit our Support page.