Our Commitment
Vellaya AI is built on a foundation of user trust. We are committed to handling your personal data — including photos you upload for skin and hair analysis — with transparency, care, and strict security practices. This Privacy Policy explains exactly what we collect, why we collect it, who receives it, how long it is retained, and the rights available to you.
Introduction
This Privacy Policy governs the collection, use, storage, and disclosure of personal data by Vellaya AI ("Vellaya", "we", "our", "us") through its mobile and web application (the "App").
By accessing or using the App, you acknowledge that you have read and understood this Policy. If you do not agree, please discontinue use of the App.
1. Information We Collect
We collect only the information necessary to deliver a personalised and functional experience.
a. Account Information
- Full name and email address
- Login credentials, whether via direct email registration or a supported social login provider
b. Face, Skin, Hair & Scalp Images ("Face Data")
To use our AI-powered analysis features, you may voluntarily upload photographs of your face, skin, hair, or scalp ("Face Data").
Face Data may include:
- Facial skin appearance
- Skin texture
- Acne visibility
- Pigmentation visibility
- Redness visibility
- Hair appearance
- Hair density visibility
- Scalp visibility
- Other cosmetic characteristics visible within submitted images
Consent required — Face Data is collected only when:
- You voluntarily capture or upload an image
- You grant camera and/or photo library permissions where required
- You explicitly initiate an image-based analysis
- You provide consent for AI-powered image processing
The App does not collect facial images automatically and does not access your camera or photo library without your permission.
To improve the relevance and accuracy of analysis results, uploaded images may be processed together with information you provide, including age, gender, allergies, pregnancy or nursing status, lifestyle information, cosmetic goals, geographic region, and environmental conditions.
c. Analysis & Metrics Data
We generate and store analysis information derived from submitted images, including:
- Hydration indicators
- Acne observations
- Pigmentation indicators
- Skin texture assessments
- Hair density observations
- Scalp health observations
- AI-generated insights and recommendations
- Historical trend and progress information
d. Location & Environmental Data
- Approximate geographic location
- Regional weather and environmental information
- UV index, humidity, climate, and seasonal factors
This information is used solely to improve the relevance of recommendations and analysis results.
e. Device & Usage Data
- Device type
- Operating system
- Application version
- Feature usage information
- Crash reports and diagnostic logs
- Performance analytics
2. How We Use Your Data
We use collected information solely for the following purposes:
- Performing AI-powered skin, hair, and scalp analysis
- Generating cosmetic insights and personalised recommendations
- Maintaining your historical scan timeline and progress tracking features
- Improving recommendation quality using environmental and location factors
- Maintaining account functionality and security
- Detecting fraud, abuse, and technical issues
- Complying with legal and regulatory obligations
We do not sell personal data.
We do not rent, lease, or trade uploaded images.
We do not use uploaded images for behavioural advertising.
We do not use uploaded images to train consumer-facing AI models without obtaining any permissions required by applicable law.
Important Medical Disclaimer
Vellaya AI is not a medical device and does not provide medical advice, diagnosis, or treatment. All analysis results are cosmetic estimations only. Always consult a qualified doctor or dermatologist before making any health-related decisions.
3. Data Retention and Handling of Face Data
Reasons for Sharing Face Data
To provide AI-powered skin analysis, your uploaded facial photographs are securely transmitted over encrypted HTTPS/TLS connections to the Google Gemini API (Google LLC) provided by Google. This processing is performed solely to generate the analysis and recommendations you request within the application.
Third-Party Processing and Security
Google acts as our third-party service provider for AI image analysis. In accordance with Google Cloud's Data Processing Addendum and Gemini API service documentation:
- Data is encrypted both in transit and at rest using industry-standard security measures.
- Customer content submitted through the Gemini API is not used to train Google's public AI models without customer permission or instruction.
- Google processes submitted images only to provide the AI analysis services you request.
For additional information, please refer to Google's documentation: Google Gemini zero data retention.
Retention of Face Data by Third-Party Providers
Data Retention Policy: Images uploaded for skin analysis are processed transiently. Your face data is stored by the third-party API Google Gemini API (Google LLC) only for a brief period (up to 24–48 hours) for standard caching and transient system performance purposes, or up to 55 days strictly for security and abuse-monitoring compliance as required by Google's developer terms.
Google does not permanently retain your images beyond these operational safety requirements, and your face data is never sold or shared with any other third parties.
Retention of Data Within Our Application
Your data in our app: Your uploaded facial photographs, AI analysis reports, and scan history remain associated with your account until you delete an individual scan or request deletion of your account.
Individual Scan Deletion
Your right to delete scans: You may delete any individual skin or hair scan at any time from within the application. When an individual scan is deleted:
- The associated facial photograph is permanently removed from our active systems.
- The corresponding skin or hair analysis report is permanently deleted.
- The deleted scan is removed from your scan history.
This action applies only to the selected scan and does not affect your remaining scans or your account.
4. Data Sharing & Third-Party Services
What Face Data does the app collect?
Voluntarily uploaded facial, skin, hair, and scalp images for cosmetic analysis.
Planned uses of collected Face Data
- Perform AI-powered cosmetic analysis
- Generate personalised skin/hair insights and recommendations
- Provide scan history, progress tracking, and comparisons
- Improve service quality (only with aggregated, non-identifiable data where permitted)
Sharing of Face Data
Who receives your Face Data: Face Data is shared only with:
- Google LLC (Google Generative Language API – Gemini)
Who receives your Location Data:
- OpenWeatherMap – to fetch accurate weather, UV index, and environmental data relevant to your location
- Geocode.maps.co – to convert latitude/longitude into usable location context (city/region level)
- SerpAPI – to provide relevant product suggestions based on analysis results
Before sending any data: The App shows a clear permission prompt and informs you that the image will be sent to the above third-party AI service for processing.
Protection by Third Parties: All third-party providers are contractually required to provide the same or equivalent level of data protection as required by applicable privacy laws (GDPR, CCPA, etc.). Data is transmitted using industry-standard HTTPS/TLS encryption.
Retention of Face Data
- Failed scans: Automatically and permanently deleted shortly after failure.
- Successful scans: Retained only while your account is active to enable history and progress tracking.
- You can delete individual scans yourself at any time through the App.
- Account deletion: All Face Data and account details are soft-deleted and can be recovered by contacting mindhatch.ca/contact.
- Permanent deletion: All Face Data can be permanently deleted by contacting mindhatch.ca/contact.
Storage Location: Data is stored securely on servers with restricted access. We require service providers to process data only for authorised purposes and in accordance with applicable privacy and security requirements.
Data transmitted to these providers is protected using industry-standard HTTPS/TLS encryption.
5. Facial Image & Biometric Data Disclaimer
No Facial Recognition. No Biometric Identification.
The image analysis performed by Vellaya AI is limited strictly to cosmetic assessments, such as skin texture, tone, visible skin conditions, hair characteristics, and scalp observations.
- We do NOT perform facial recognition.
- We do NOT perform identity verification.
- We do NOT attempt to identify or authenticate individuals from uploaded images.
- We do NOT create, store, or process biometric identifiers or biometric templates as defined under applicable privacy regulations, including GDPR, CCPA, or BIPA.
- Images are never used for any purpose beyond generating the analysis you requested.
6. Payment Processing
For purchases and subscriptions made through the iOS application, payment transactions are processed by Apple through the App Store In-App Purchase system.
We do not collect, store, or have access to users' full payment card details, banking information, or payment credentials.
Payment information is handled by Apple in accordance with Apple's privacy and security practices.
For purchases made through other platforms, payments may be processed by the applicable platform provider or authorised payment processor.
Infrastructure & Hosting Providers
We may use trusted hosting and infrastructure providers to securely operate the App and store authorised user data.
Apart from these service providers required for operation of the App, we do not disclose uploaded images or Face Data to third parties.
7. Account Deletion
When you request account deletion through the application, your account is placed into a recoverable soft-deleted state.
During this recovery period:
- Your account is deactivated and is no longer accessible through the application.
- Your account data is retained securely to allow account recovery.
- You may restore your account at any time by contacting our support team at vellayaAI@gmail.com.
Facial Image Deletion Requests
If your account is in the recoverable soft-deleted state and you would like any remaining facial photographs removed, you may submit a request by contacting vellayaAI@gmail.com. Following verification of your request, we will process eligible facial image deletion requests within 7 business days, unless a longer period is required by applicable law.
Permanent Account Deletion
Permanent deletion: If you wish to permanently delete your account and all remaining associated data, you must submit a verified deletion request by contacting vellayaAI@gmail.com.
Once your request has been verified, we will permanently delete your account and any remaining associated data within 30 days, unless a longer retention period is required by applicable law or is necessary to comply with legal, regulatory, fraud prevention, or security obligations.
Once permanent deletion is completed:
- Your account can no longer be recovered.
- Any remaining facial photographs are permanently removed from our active systems.
- Any remaining skin analysis reports are permanently deleted.
- Any remaining hair analysis reports are permanently deleted.
- Any remaining scan history is permanently deleted.
8. Data Security
We implement appropriate technical and organisational safeguards to protect personal information.
Security measures include:
- HTTPS/TLS encryption during transmission
- Authentication and access control systems
- Restricted administrative access
- Segregation of user data
- Continuous monitoring and security reviews
Access to user images and analysis data is limited to systems and personnel who require such access to operate, maintain, secure, or support the service.
9. Children's Privacy
The App is not directed at, and is not intended for use by, individuals under the age of 13, or under the age of 16 where required by applicable law (including in EU member states).
We do not knowingly collect personal data from children.
If you believe that a child has provided us with personal data without appropriate parental consent, please contact us immediately at vellayaAI@gmail.com, and we will take prompt steps to delete the relevant information.
10. Medical & Clinical Disclaimer
This Is Not a Medical Service
Vellaya AI is an informational wellness application. It is not a medical device, diagnostic tool, or clinical service and is not regulated as such.
Nothing within the App, including AI-generated analysis results, skin assessments, or product recommendations, constitutes medical advice, a clinical diagnosis, or a prescribed course of treatment.
AI-generated results are estimations based on visual data and are subject to variability depending on image quality, lighting, and individual factors.
You should always seek the advice of a qualified physician, dermatologist, or other licensed healthcare professional before making any decisions regarding your health, skin condition, or treatment regimen.
11. Amendments to This Policy
We reserve the right to update or modify this Privacy Policy at any time.
When material changes are made, we will notify you by email or via a prominent in-app notification prior to the changes taking effect.
Your continued use of the App following such notification constitutes your acceptance of the revised Policy.
The current version of this Policy will always be accessible at mindhatch.ca/contact.
12. Contact
If you have any questions, concerns, or requests regarding this Privacy Policy or the manner in which we handle your personal data, please contact our team at:
Vellaya AI — Privacy
Email: vellayaAI@gmail.com
Website: mindhatch.ca