Privacy Policy: HairSnap Mobile Application
Last updated: October 21st, 2026
Shine Shine Apps, S.L. is the data controller for the HairSnap app. This policy explains what personal data we collect, why, who we share it with, and your rights.
1. Who we are
- Company: Shine Shine Apps, S.L.
- Address: Avenida Alcalde Díaz Saavedra Navarro, 31, 2ª planta, 35001 Las Palmas de Gran Canaria, Spain
- Contact and Data Protection Officer: admin@2shineapps.com
2. What data we collect and how
We collect only what the app needs to work, to be paid for, and to be improved and funded through advertising.
| Data | What it includes | How we collect it |
|---|---|---|
| Hair and scalp photos | Photos you take or choose for a scan and, if you use hairstyle suggestions, a face photo | You take or upload them in the app, only after you allow AI analysis |
| Questionnaire answers | Hair type, scalp concerns, goals and habits you select | You enter them during onboarding |
| Scan results | Your ratings, analysis and recommended routine | Generated by the app from your photos and answers |
| Account data | Email or Apple/Google sign-in identifier, user ID | You create an account |
| Purchases | Subscriptions and purchases, handled by Apple | Apple tells us what you bought; we never see your payment card |
| Device and usage data | Device and advertising identifiers, app interactions, crash and performance data | Automatically, through the SDKs listed in section 5 |
We do not use facial recognition or create biometric templates. We do not collect your precise location, contacts, call logs or messages.
3. How we use your data and why we are allowed to
Each use of your data has a legal basis under the GDPR.
| Use | Data | Legal basis |
|---|---|---|
| AI hair analysis and recommendations | Photos, questionnaire answers | Your explicit consent (Art. 6(1)(a) and 9(2)(a) GDPR), because results such as hair-loss stage may reveal health information |
| Provide your account, scan history and routine | Account data, scan results | Performing our contract with you (Art. 6(1)(b)) |
| Process subscriptions and purchases | Purchases | Performing our contract (Art. 6(1)(b)) and legal obligations such as tax records (Art. 6(1)(c)) |
| Personalized advertising and tracking across other companies' apps | Device and advertising identifiers, usage data | Your consent through Apple's tracking prompt and our consent request (Art. 6(1)(a)) |
| Security, crash fixing and app performance | Device, usage and diagnostic data | Our legitimate interest in a secure, working app (Art. 6(1)(f)) |
You can withdraw consent at any time. This does not affect processing done before you withdrew. If you withdraw consent for AI analysis, you can keep using the rest of the app, but new scans will not work.
4. AI-powered hair analysis with OpenAI
Your hair analysis is produced by an AI model from OpenAI, a third-party AI service. We send your data to OpenAI only after you tap "Allow" on the in-app AI permission screen.
- What we send: your hair and scalp photos, a face photo if you use hairstyle suggestions, and your questionnaire answers. We never send your name, email, password or sign-in details.
- How it travels: from your device to our servers on Google Firebase, then to OpenAI, which returns the analysis.
- What OpenAI may do with it: only generate your analysis for us. Under our data processing agreement, OpenAI may not use your data to train or improve its models.
- Equal protection: OpenAI is bound by a data processing agreement under Art. 28 GDPR and provides the same or equal protection of your data as described in this policy.
- Not medical advice: results are automated, AI-generated estimates for general hair care. They are not a medical or dermatological diagnosis. For any health concern, see a doctor.
You can withdraw permission at any time in the app's Settings. After that, we send nothing further to OpenAI.
5. Who we share your data with
We do not sell your photos, questionnaire answers or scan results. We share data only with the providers below, each bound by contract to protect it.
| Recipient | Role | Data shared | Purpose |
|---|---|---|---|
| OpenAI Ireland Ltd (with OpenAI affiliates, including in the USA) | Processor | Photos, questionnaire answers | AI hair analysis (section 4) |
| Google (Firebase) | Processor | Photos in transit, account data, scan results, diagnostics | Hosting, sign-in, crash reporting |
| Apple | Independent controller | Purchases | Payments and subscriptions |
| Advertising partners (ad networks and ad mediation platforms) | Independent controllers | Advertising identifier (only if you allow tracking), device identifiers, usage data | Showing ads; personalized ads only with your consent |
| Analytics and attribution providers | Processors or independent controllers, depending on the provider | Device identifiers, usage and diagnostic data | Measuring installs, app use, ad performance and crashes |
You can ask us for the current list of advertising and analytics partners at admin@2shineapps.com. We may also disclose data when the law requires it, for example to a court or authority.
6. International transfers
Some providers process data in the United States. When data leaves the European Economic Area, we protect it with an EU adequacy decision, such as the EU-U.S. Data Privacy Framework where the recipient is certified, or with the European Commission's Standard Contractual Clauses. You can request a copy of these safeguards at admin@2shineapps.com.
7. How long we keep your data
We keep data only as long as we need it, then delete or anonymize it.
| Data | How long |
|---|---|
| Photos and answers sent for analysis | Deleted from our servers once your analysis is delivered, unless you save it to your history |
| Saved scan history | Until you delete it from your history or delete your account |
| Copies held by OpenAI | Up to 30 days for abuse monitoring, then deleted by OpenAI |
| Account data | Until you delete your account |
| Purchase records | As long as tax and accounting law requires |
| Device, usage and diagnostic data | As long as needed to fix issues and measure performance, within each provider's retention limits |
When you delete your account, we delete or irreversibly anonymize your personal data, except records the law requires us to keep.
8. Children
HairSnap is not directed at children under 14. If you are under 14, you need a parent's or guardian's consent before using the AI analysis. If we learn that we have processed a child's data without valid consent, we delete it. Parents can contact us at admin@2shineapps.com.
9. Your rights and choices
Under Art. 15–22 GDPR you can access, correct, delete, restrict or object to the use of your data, and receive it in a portable format. You can withdraw any consent at any time.
- AI analysis: turn it off in the app's Settings.
- Tracking: change your choice in iPhone Settings > Privacy & Security > Tracking.
- Delete your account: in the app's Settings, or by email.
- Any other request: email admin@2shineapps.com. We reply within one month.
You can also complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es.
10. Changes to this policy
We will update this policy when our practices change and show the new date at the top. If a change affects how we use data you consented to, we will ask again in the app.