Privacy Policy

Last updated: 2026-09-23

This policy is for two kinds of people: the person who tries on a look — in the salon or on their own phone (sections 1–8), and the shop owners who subscribe to HairReflect (section 9). It is written in plain words on purpose.

1. Who is responsible for your data

HairReflect is operated by Marios Demosthenous, trading as HairReflect, established in Cyprus at Syrou 13B, Lakatamia, Cyprus. Contact: mariosdemosthenous11@gmail.com.

For the photo taken during your consultation, the shop you visited is the data controller — it decides to offer the try-on to you. HairReflect processes that photo on the shop’s behalf, under a data processing annex. For shop owners’ account data (section 9), HairReflect is the controller.

2. If you tried on a look: what we collect

During a consultation — on the salon’s tablet or on your own phone through the salon’s link — one photo of you is taken (a retake replaces it) and previews of the looks you choose are generated from it. That is all. No name, no contact details, no account — we do not know who you are, and the photo is not linked to your identity by us.

3. How long we keep it, and why — the 30 days

• During your visit, the photo is used solely to generate and show the previews. It disappears from the screen when the consultation ends.
• After your visit, a copy of the photo and the generated previews is kept for up to 30 days, used solely for internal quality assurance: checking that generations succeeded, finding which looks produce visual defects, and fixing them.
• Never for AI training. We never use your photos to train AI. Our AI providers, OpenAI and Google, receive them only to create and check your preview, under their paid business API terms, which exclude using your photos to train or improve their models.
• Never for marketing, never sold. Your imagery is not used in advertising or marketing, and it is not shared with anyone beyond the processors listed in section 6.
• Automatic deletion. After 30 days it is deleted automatically. You can have it deleted earlier: ask the shop where you had your consultation, or email mariosdemosthenous11@gmail.com.

The legal basis for the 30-day retention is legitimate interest (Article 6(1)(f) GDPR): keeping the service working properly by diagnosing and fixing defective generations. The safeguards that balance this are the short retention window, the quality-assurance-only use, the no-training commitment, and the easy path to earlier deletion.

4. The “take it with you” link

If you ask to keep your previews — by scanning the QR code, or through a link we email you — the shared link is available for 24 hours, or, for a link in a reminder email you agreed to receive, up to 7 days. It never outlives the 30-day limit above; then it is deleted.

5. If you gave us your email

If you asked to receive your try-on pictures, or ticked a box to hear from the shop, we now hold your email address. Two different things can follow from that, and each has to stand on its own.

Two purposes, two bases. Sending you the pictures you asked for happens because you asked for them — that request is the basis, and it is not marketing. Marketing email happens only if you separately ticked an unticked box for it — consent under Article 6(1)(a) GDPR — and only from the one shop where you ticked it. Consent to one is never treated as consent to the other.

The shop is the controller, we are the processor. Your address belongs to the salon you visited, the same way your photo does. HairReflect sends the mail on their behalf. It is never handed to another shop, and two shops using HairReflect never see each other’s contact lists.

How to stop. Every email we send you — pictures or marketing — carries an unsubscribe link. One tap stops that shop’s marketing email, immediately. It does not stop pictures you ask for at the shop yourself: those are sent because you asked for them, and you can only ever get them by asking again.

What we keep, and for how long. These numbers are promises the product is built to keep automatically:

• No visit from you for 24 months, and the contact is deleted.
• The shop’s subscription ends, and the contact is deleted 90 days later.
• You asked only for pictures and never ticked the marketing box — the contact is deleted after 30 days.
• If you leave a written comment with your rating, it is wiped after 30 days — the same clock as the photos it belongs to. The plain 1–5 score itself has no name attached, and we keep it: it is how a shop sees whether its cuts are landing over time. The 1–5 preview rating and any comment you add are shown to the salon’s staff together with your preview.

The asymmetry, stated honestly. The “take it with you” link above tells you your pictures are deleted after 24 hours (or up to 7 days for a reminder link). Your email address is not on that clock. We would rather say that plainly than have you find out on your own: we keep your address, not your pictures.

6. Who processes the data

Only these providers touch data, and only for the purpose stated:

• OpenAI — creates the preview: your photo (reduced in size) and the shop’s own reference photo of the look are sent to OpenAI’s image service for that one purpose; OpenAI is also the backup reviewer if Google is unavailable. Under the API terms we use, OpenAI does not use it to train its models.
• Google (Gemini API) — checks the result: your photo and the generated preview are sent to Google to confirm the preview still looks like you and to read your current hair, and Google is the backup generator if OpenAI is unavailable. Under the paid API terms we use, Google does not use it to train its models or to improve its products.
• Finding your face in the photo happens on the tablet or phone itself, or on our own server. Only if that fails is a small copy sent to Google (or, as a backup, OpenAI) for the same purpose, under the same terms.
• Vercel — hosting; our servers run in Frankfurt, Germany (EU).
• Vercel Blob — image storage, where the 30-day copies live.
• Neon — database, hosted in the EU (eu-central-1, Frankfurt).
• Stripe — payments, for shop owners only. We never see or store card numbers. No customer photos go anywhere near Stripe.
• Resend — email delivery, for shop owners and, since you may now give us your email, for you too. If you asked for your try-on pictures, or ticked a box to hear from the shop, Resend is who sends that mail — see “If you gave us your email” above for what that means.

We do not sell data, and we do not share it with anyone else.

7. Children

The service is used in shops by the general public, including minors accompanied by an adult. A minor’s photo is processed exactly the same way — previews, up to 30 days for quality checks, then deletion. Making sure a parent or guardian agrees before a minor’s photo is taken is the responsibility of the shop, as the business in front of the customer.

The try-on is meant for customers aged 16 and over. Younger customers should use it only with a parent or guardian present, and the tablet and phone screens say so before any photo is taken. We never ask for, or record, anyone’s age.

The email address, if you give us one, is asked for on your own phone or — on the shop’s tablet — only while your previews are being made. In both places the request is worded for an adult giving their own address, and says so. Soliciting an email address from a child is the shop’s responsibility to prevent, as the controller for its own customers.

8. Your rights

Under the GDPR you can ask for access to your data, correction, erasure, restriction of processing, objection (including to the 30-day quality-assurance retention — if you object, we delete), and portability. To exercise them, ask the shop where you had your consultation, or email mariosdemosthenous11@gmail.com. One honest practical note: because no name is attached to any photo, we will need the shop and the approximate time of your visit to find your imagery — and after 30 days there is nothing left to find. If you gave us your email, we can find that contact record directly.

If you are unhappy with how a request was handled, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy).

9. Shop owners: your account

If you run a shop with a HairReflect subscription, we hold: your email address, your shop branding, and the usage counts needed for billing. The legal basis is the contract between us. Stripe holds your payment details; Resend delivers our emails to you. Account data is kept while your account exists. To close your account or ask about your data, email mariosdemosthenous11@gmail.com.

10. Cookies

We use only functional cookies: keeping a shop owner signed in and keeping a tablet session running. There are no advertising cookies and no third-party tracking cookies.

11. Changes and contact

If this policy changes in a way that matters, the “Last updated” date above changes with it, and shops are told by email so they can inform their customers. Questions: Marios Demosthenous, trading as HairReflect · Syrou 13B, Lakatamia, Cyprus · mariosdemosthenous11@gmail.com.