Data Processing Annex

Last updated: 2026-09-23

This annex sets out the Article 28 GDPR terms under which HairReflect processes your customers’ photos on your shop’s behalf. It is part of the Terms of Service and applies for as long as your shop has a HairReflect subscription. Keep a copy of this page for your records — your shop is the data controller, and this annex is the paperwork that says who does what.

1. Parties and roles

Controller: your shop — the business holding the HairReflect subscription. Processor: Marios Demosthenous, trading as HairReflect, established in Cyprus at Syrou 13B, Lakatamia, Cyprus, contact mariosdemosthenous11@gmail.com. Shop-owner account data (your email, branding, billing) is outside this annex; for that data HairReflect is itself the controller, as described in the Privacy Policy.

2. Subject matter and duration

Subject matter: processing of photographs of the shop’s customers, the AI-generated previews made from them, and — for customers who ask for their pictures or opt in to hear from the shop — their email address and marketing consent, all to provide the HairReflect try-on service and, where opted in, the shop’s own marketing. Duration: the term of the shop’s subscription, plus the retention windows in clause 10 for imagery and contact data from visits during the term.

3. Nature and purpose of the processing

• Capture one photo of a customer (a retake replaces it) on the shop’s tablet, or on the customer’s own phone through the shop’s link.
• Send the photo to the image-generation and review sub-processors in clause 8 to create previews of the chosen looks and check them, and show those previews to the customer during the consultation. A preview our review rejects is never shown to the customer; it is kept under the same 30-day window so the failure can be understood and fixed.
• If the customer requests it, make their preview(s) available via a shared link for 24 hours — or, for a link in a reminder email the customer opted into, up to 7 days — and never beyond the 30-day limit in this clause.
• If the customer asks for their pictures by email, or ticks a box to hear from the shop, capture their email address and send mail accordingly — the pictures because they asked, marketing only if they opted in.
• Retain the photo and previews for up to 30 days after the visit, solely for internal quality assurance: verifying that generations succeeded, identifying hairstyles that produce visual defects, and fixing them.
• Delete automatically after 30 days, or earlier on request.

HairReflect never uses Customer imagery to train AI models, never uses it for marketing, and never discloses it beyond the sub-processors in clause 8, whose paid API terms are described there. Contact data is used only to send what the customer asked for or opted into, is never sold, and is never shared with another shop.

4. Types of personal data and data subjects

Data: facial photographs and AI-generated preview images, still with no name, contact detail, or account identifier attached to them. Where a customer asks for their pictures or opts in to hear from the shop, a separate contact record holds their email address and consent choice — held apart from the imagery. The contact record itself carries no reference to any photo, and the dashboard never shows a customer’s pictures. One narrow exception is worth stating plainly: for as long as a share link stays alive (24 hours, or up to 7 days for a reminder-email link), the record of “we emailed this address these pictures” (and a rating left from that same link) still names that link, so someone with direct database access could follow it back to the visit it came from. That link is what lets us honour “stop mailing me” and “delete everything about me” at all. It is deleted with the share link after 24 hours; the imagery is deleted after 30 days at the latest. Data subjects: the shop’s customers, including minors accompanied by an adult — obtaining a parent’s or guardian’s agreement is the shop’s responsibility as controller, addressed further in clause 5.

5. The shop’s own obligations as controller

Contact data does not change who the controller is — your shop still is, for its own customers’ data, same as for their photos. That comes with obligations HairReflect cannot discharge for you:

• Campaign content is yours. What a marketing email says, and whether it is accurate and lawful, is your responsibility as the sender the recipient recognises.
• No outside lists. Only contacts captured through HairReflect’s own consent flow may be mailed through it. The product refuses an uploaded list — there is no import feature — but the obligation to only ever mail people who consented through HairReflect is yours regardless of what the product allows.
• Not soliciting from children. Same responsibility as for photographs in clause 4: obtaining an email address from a minor is on you to prevent, as the business in front of the customer.
• Answering your own customers. When a customer asks you directly for access to or erasure of their data, you are the one who must answer. Your dashboard is the tool for that — it shows, and lets you delete, a customer’s record without needing us.

6. Documented instructions

HairReflect processes customer imagery, and any contact data a customer gives us, only on the shop’s documented instructions. The instructions are exactly the behavior described in clause 3 — generate previews, show them, retain up to 30 days for quality assurance, delete; and, for contact data, send what the customer asked for or opted into, and delete on the schedule in clause 10. If we believe an instruction from you conflicts with data-protection law, we will tell you before acting on it.

7. Confidentiality and security

People authorised to process customer imagery are bound by confidentiality. Measures in place:

• Encryption in transit (HTTPS/TLS) for all photo uploads and preview delivery.
• Hosting in the EU: servers in Frankfurt (Vercel), database in eu-central-1 (Neon).
• Per-shop isolation of imagery — one shop can never see another shop’s sessions.
• Access to retained imagery is limited to what quality assurance requires.
• No payment data held by HairReflect — Stripe holds it.
• Automatic deletion of imagery within 30 days of the visit.

8. Sub-processors

The shop authorises these sub-processors, each for the stated purpose only:

• OpenAI — image generation: the customer photo (reduced in size) and the shop’s own reference photo are sent to OpenAI’s image API; OpenAI is also the backup reviewer if Google is unavailable. Under the API terms we use, photos are not used to train OpenAI’s models.
• Google (Gemini API) — quality review of every generated preview (the photo and the preview are sent to confirm identity and read the customer’s current hair), and backup image generation if OpenAI is unavailable. Under the paid API terms we use, photos are not used to train Google’s models or to improve Google’s products.
• Face detection is performed on the customer’s or shop’s device or on our own servers; only if that fails is a reduced copy sent to Google (or, as a backup, OpenAI) for the same purpose, under the same terms.
• Vercel — hosting (Frankfurt, Germany, EU).
• Vercel Blob — image storage for the retention window.
• Neon — database (EU, eu-central-1).
• Stripe — payments for the shop’s subscription only; customer imagery never reaches Stripe.
• Resend — email delivery: sends the pictures a customer asked for, and any marketing email they opted into, on the shop’s behalf.

We will inform you before adding or replacing a sub-processor that handles customer personal data — imagery or contact data alike. You may object on reasonable data-protection grounds; if we cannot resolve the objection, you may cancel your subscription.

9. Assistance, and personal data breaches

We assist you with customer requests — access, erasure, objection — for imagery and contact data alike. Imagery still carries no name, so for that you provide the visit details (session and approximate time) needed to locate it; a contact record can be found directly by the email address on it. If we become aware of a personal data breach affecting your customers’ imagery or contact data, we will notify you without undue delay so you can meet your own obligations as controller.

10. Deletion

• Customer imagery is deleted automatically no later than 30 days after the visit.
• Earlier deletion happens on request — from you or from the customer directly.
• If your subscription ends, any remaining customer imagery is deleted within that same 30-day window at the latest. Nothing is kept afterwards.
• Customer contact records follow the schedule in the Privacy Policy: 24 months without a visit, 90 days after your subscription ends, or 30 days for a contact who only asked for pictures and never opted into marketing — whichever applies first.
• Deletion does not leave nothing behind, and it is worth being exact about what stays and why. In every case the address itself is replaced by a one-way hash — the plain address is gone from the contact record, from the delivery log, and from any campaign recipient list.
• Kept after every deletion, however it was triggered: a consent receipt. It records what the customer agreed to, in which language, on which date, and under which version of the wording — with no name, address, or photo, only that hash. Article 7(1) GDPR requires a controller to be able to demonstrate that consent existed; that duty does not end because the contact record has been aged out or erased. Kept for as long as that could be asked about.
• Kept after every deletion: the redacted delivery log — that a message of a given kind was sent on a given date, with the recipient reduced to the same hash. It is what answers “did this actually go out”, and what a spam complaint is investigated with.
• Kept only when someone asked to be forgotten, or the shop removed them: a do-not-contact record (Article 17(3)(e) GDPR), so that a later visit cannot silently recreate the same contact and mail them again. It carries no name, email, or photo — only enough to enforce that instruction. A contact deleted merely because a clock ran out (24 months quiet, 90 days after your subscription ends, 30 days for a pictures-only contact) gets NO such record: nobody objected, so nothing is held against them, and a later visit is treated as an ordinary new one.
• Not yet reachable: messages already delivered by our email provider still hold their original recipient address and content on that provider’s systems. Our provider exposes no interface for deleting a delivered message, so this has to be handled with them directly on request rather than automatically.

11. Demonstrating compliance

On request, we will make available the information reasonably necessary to demonstrate compliance with this annex, and answer your questions about the processing at mariosdemosthenous11@gmail.com.

12. Contact

Marios Demosthenous, trading as HairReflect · Syrou 13B, Lakatamia, Cyprus · mariosdemosthenous11@gmail.com