Privacy Policy — Thetalook

Last updated: 26 October 2026
Version: 3.0

1. Who We Are (Data Controller)

Thetalook - ثيتالوك ("we", "the app") is a skincare and makeup app for Android phones on Google Play and iPhones on the App Store, with AI skin analysis, looks, a shop and a community.

• Entity: Thetalook
• Location: Baghdad, Iraq
• Jurisdiction: Republic of Iraq
• Privacy contact: info@thetalook.com
• Phone: +9647817107805

We are the controller of the personal data collected through the app.

2. Data We Collect

2.1 Account

• Full name, username, email address and phone number.
• Date of birth, from which we work out your age, and your governorate and district.
• Your password, which the sign-in service stores encrypted. We never see it.
• Account type: user, or creator after a request our team reviews.
• If you sign in with Google or Apple, we receive your account ID with them, your name and your email address, and Google may also send a link to your profile picture. Apple may give us a relay address instead of your real one if you choose that.

2.2 Skin Profile and Health Data

• Skin type, whether your skin is sensitive, and your skin tone.
• Allergies and the ingredients you avoid.
• Health conditions you select or write in (such as pregnancy or skin conditions), and your notes.
• Your skin scan results, and progress (before and after) photos if you add them.

This is sensitive health data. We use it only to give you your analysis, routine and alerts.

2.3 Photos and Recordings

• Skin scan photo: taken with your phone's camera or chosen from your gallery. The app asks for camera access for this.
• Your photo for generating looks and for trying on ready looks.
• Your profile photo and the photos in your posts.
• Photos and voice messages in private chats: photos up to 5 MB, voice recordings up to two minutes. The app uses the microphone only while you record a voice message.

Section 5 explains when each photo is kept and when it is deleted.

2.4 Content and Activity

• Posts, comments, likes, follows and saved items.
• Private messages, reports and your block list.

2.5 Orders (Shop)

• Recipient name, phone number and delivery address (governorate, district, nearest landmark).
• Order contents, any coupon, and the amount in Iraqi dinars (IQD).
• Cash on delivery only. We collect no bank card or e-wallet details.

2.6 Device and Diagnostics

• Your device's notification token, its operating system and language, to send you notifications.
• Crash reports: if the app crashes, we receive the crash details, your account ID, your device model and operating system, and the app version.
• Sign-in logs kept by the sign-in service, including IP addresses, to protect your account.

3. How We Use Your Data

We do not use your data for advertising, we do not sell it to anyone, and we do not use your health data for marketing.

4. Artificial Intelligence

We run AI models through Replicate:

• Skin analysis: a Google Gemini model analyses your scan photo.
• Looks: Google Gemini models and the InstantID model apply a look to your photo and write its steps. InstantID reads the features of your face in the photo so that your face stays the same in the look; we do not store these features.

What we send:

• For a skin scan: the photo, with information that carries neither your name nor your email: your age group, your skin type and tone as you entered them, and the ingredients to avoid. These ingredients are worked out from your allergies and health conditions without naming the condition.
• For looks: your photo and your choices, and the ready look's reference photo if you try one on.

Safeguards:

• According to Replicate's published policy, Replicate automatically deletes the inputs and outputs of each request after one hour.
• We do not use your photos or data to train AI models.
• A scan result is an estimated cosmetic analysis, not a medical diagnosis. If it shows signs that need a specialist, we recommend seeing a dermatologist.

5. Your Photos: When They Are Kept and Deleted

6. Storage and Security

7. Service Providers We Share Data With

We share only what the service needs, with these providers:

We do not sell your data or share it with advertisers. We may disclose data when the law requires us to.

8. Doctors, Makeup Artists and Our Team

• The team's doctor and makeup artist see only what you send them in a chat, such as a scan card you send with the "Share with the doctor" button. No doctor opens your records or photos in any other way.
• Every share starts with you, one at a time. There is no standing permission.
• Our administrators see account details, orders, posts and reports in order to run the service and the shop, and every time they view a profile is logged (section 6).

9. Private Messages

• We store text messages, photos and voice recordings so the conversation stays available.
• You can block any user, after which neither of you can message the other, and you can report them.
• When you delete your account, your messages are deleted. The other person keeps the conversation with only their own messages.

10. Minors

• The minimum age is 12, based on the date of birth entered at sign-up. We do not check it against documents.
• If you are under 18, each skin scan needs a parent's or guardian's consent. We record their name, their relationship to you, the date and the consent text.
• Scan photos of minors are always deleted after the analysis.
• A minor's account starts private and exchanges messages only with accounts it follows. Its profile is visible only to accounts it has a follow relationship with, and to other users under 18.
• We show no ads, and we do not use scan data for marketing to minors.
• If we learn that an account belongs to someone under 12, we delete it.

11. Your Rights

At any time, you can:

• Access your data: your profile, scans and orders are in the app.
• Correct it in "Edit profile". Your date of birth is entered once; to correct it, contact us.
• Delete a kept scan photo from your medical history, delete progress photos, and delete your posts and comments.
• Withdraw consent by stopping scans, deleting your photos or deleting your account.
• Delete your account in Settings → "Delete account". The account and all its data and files are deleted after 3 days, and signing in during those days cancels the deletion. You can also ask for deletion on the account deletion page.
• Get a copy of your data by email request.
• Complain to the competent authority.

Send these requests to: info@thetalook.com

12. Retention

• Your account data is kept while your account exists.
• When you delete your account, its data and files are deleted within 3 days. Orders stay as financial records, with the recipient's name, phone, district and landmark erased.
• Photos: see section 5.
• At Replicate: one hour.
• Error logs on our servers: 30 days.
• Crash reports in Firebase Crashlytics: as long as Google keeps them.

13. Storage on Your Device

The app keeps on your device only what it needs to work: your sign-in session, language and appearance, and temporary copies of images to show them faster.

We use no advertising trackers: no Google Analytics and no Facebook Pixel.

14. Transfers Outside Iraq

Your data is processed outside Iraq by our service providers: Supabase in Germany, Replicate in the United States, and Google and Apple in several countries. Each of them works under its own published data protection policy.

15. Changes to This Policy

We may update this policy. We announce any material change in the app 14 days before it takes effect, and the date of the latest update is at the top of this page.

16. Contact

For any privacy question:
📧 info@thetalook.com
📱 +9647817107805