Privacy Policy

Scalp Images

When you use the scanning feature, you upload four hair/scalp photos so we can create your report. These photos may reveal sensitive visual information about your appearance and scalp condition. They are stored in private Supabase scan storage and sent through our AI report processing flow only to generate your ScalpAnalysis AI report. Guest scan images are designed to be temporary and deleted within 48 hours. Registered users can save scans privately for progress tracking until they delete them or request account deletion.

Account Information

If you create an account with Google sign-in or with your email and a password, we collect your email address and basic authentication metadata needed to keep your account working. Passwords are stored in hashed (encrypted) form by our authentication provider, never in plain text, and you can reset yours by email at any time. If you pay for a scan as a guest, we create an account for you using the email you enter at checkout so your report stays linked to you. We do not require mailing addresses or government IDs.

Device & Usage Data

We collect limited technical data such as browser type, device type, IP-derived region, page performance, security events, and error logs to keep the service reliable. We also use Google Analytics 4 across the site for page-path and funnel events (paths are sanitized; scan IDs, signed URLs, and emails are not sent). Scan, result, dashboard, auth, and payment pages do not load session replay.

Payment Information

If you make a purchase (a single scan credit, a Premium subscription, or a hairstyle try-on credit pack), payment is processed securely by Creem, our merchant of record. Creem receives the billing details needed to complete the charge, such as your email and payment method. We never store your credit card details on our servers.

• To provide AI-powered hairline, density, hair attribute, and scalp appearance signals
• To save your scan history and track progress over time (registered users)
• To send you important service updates and notifications
• To improve our service quality, fix bugs, and develop new features

We use service providers to operate ScalpAnalysis AI. We share with each provider only the information it needs to perform its function, and nothing more. We do not sell your data, and we do not use your photos to train shared AI models. Scalp photos are shared only with private scan storage and AI report processing systems, not with advertising networks, payment processors, email tools, error monitoring, or public-page analytics tools.

AI Report Processing

We send scalp photos and scan context through our secure third-party analysis provider, only to generate your report.

AI Hairstyle Style-Preview

If you use our optional hairstyle try-on feature, we process the front-facing photo from your scan to generate a simulated styling preview. To create it, we send that photo to a third-party AI service that generates the image on our behalf; we do not publicly identify this provider. The preview is a simulation — it is not a real photo of you and does not reflect your real hair. Generated previews are stored privately to your account, are not shared with other users or made public, and are kept until you delete them or close your account; the source scan photo follows the retention described elsewhere in this policy. We do not use your scan photo or the generated preview to train AI models without your consent. You can use the rest of the app without using this feature.

Supabase

Provides authentication, database records, and private scan image storage for saved baselines and account access controls.

Creem

Our merchant of record. Processes payments for single scan credits, Premium subscriptions, and try-on credit packs, and handles billing, applicable taxes, and refunds. It does not receive your scalp photos.

Vercel

Hosts the website, serves pages globally, and provides operational logs needed for reliability and security.

Resend / Email Support

Sends transactional and support email, such as account confirmations, progress reports, reminders, and replies when you contact us. Email tools do not receive scalp photos.

Sentry

Error monitoring. Receives technical error reports (error messages, stack traces, browser and device type) so we can find and fix failures. It does not receive scalp photos, and we configure it not to collect personal details by default.

Google Analytics 4

Measures how people use ScalpAnalysis AI (page paths and funnel events such as start scan or begin checkout). We configure it to receive sanitized paths only — not scalp photos, scan IDs, signed image URLs, or email addresses. GA4 may run on sensitive product pages with those sanitization rules; session replay does not.

Microsoft Clarity (session replay) and optional Plausible

Clarity may load on public marketing and legal pages to understand clicks and navigation via session replay. It is not loaded on scan, result, dashboard, auth, or payment pages. Plausible is optional and currently not enabled in production.

Provider note: providers may process data in the United States or other countries where they or their subprocessors operate. We do not sell your personal data, and we do not use scalp photos for third-party advertising.

ScalpAnalysis AI is operated primarily for users in the United States. If you access the Service from another country, your information may be processed in the United States and in other countries where our service providers operate. Privacy laws in those countries may differ from the laws where you live.

We use cross-border processing to provide hosting, authentication, private storage, AI report generation, payment processing, support email, security, and reliability. Where required by applicable law, we rely on appropriate contractual and organizational safeguards with our service providers.

If you are located outside the United States and do not want your scalp photos or account data processed through these providers, please do not use the scan feature.

Depending on where you live, including California and other US states, the EU, UK, or similar jurisdictions, you may have privacy rights such as:

To exercise these rights, email us at support@scalpanalysis.app. We will respond within 45 days where US privacy laws apply, or within the timeframe required by applicable law.

We do not sell scalp photos. We also do not use scalp photos for cross-context behavioral advertising. Session replay is not loaded on scan, result, dashboard, auth, or payment pages. GA4 on those pages only reports sanitized paths and funnel events — not scan IDs, signed URLs, or emails.

We use minimal, privacy-respecting analytics to understand how users interact with our service:

• Essential Cookies: Required for authentication and basic functionality
• Analytics: Google Analytics 4 runs site-wide for sanitized page paths and funnel events (no photos, scan IDs, signed URLs, or emails). Session replay (Microsoft Clarity) may run on public marketing and legal pages only.
• Sensitive Pages: Scan, result, dashboard, auth, and payment pages do not load session replay. GA4 on those pages only reports sanitized paths and events.
• No Third-Party Ads: We do not serve ads or share scan data with advertising networks

We use practical security controls to protect your data:

No internet service can guarantee perfect security. If we learn of a security incident involving your personal information, we will evaluate our notification obligations under applicable law and contact affected users when required.

ScalpAnalysis AI is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at support@scalpanalysis.app.

We may update this Privacy Policy periodically. Significant changes will be communicated via email (for registered users) or a prominent notice on our website. We encourage you to review this page regularly.

If you have questions about this Privacy Policy or want to exercise your rights, please contact us: