Privacy Notice

The data controller for SkinMatch AI is Nagatama Software House. This means we decide how and why your personal data is processed, and we are responsible for protecting it.

• Account data — email address and login credentials, to create and secure your account (legal basis: contract performance).
• Scan results — cosmetic appearance metrics (skin tone, undertone, shade matches) and history you choose to save, to provide the cosmetic matching service (legal basis: contract performance). These are cosmetic colour measurements, not health data. Photos are analyzed on your own device and are never uploaded to our servers.
• Support messages — to respond to your requests (legal basis: legitimate interests).
• Usage and device data — IP address, device identifiers, and telemetry, for security, fraud prevention, and product improvement (legal basis: legitimate interests).

• Service providers who host and operate the service (cloud hosting, analytics);
• Midtrans (PT Midtrans Payment Indonesia), our payment processor, to handle payments — payment details are collected and processed by Midtrans, not by us;
• Professional advisers (legal, accounting) where needed;
• Authorities where required by law.

We keep personal data only as long as needed for the purposes above, after which it is deleted or anonymised. You may request earlier deletion at any time.

We apply appropriate technical and organisational measures, including encryption in transit, access controls, and row-level isolation of your data.

Depending on your country, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing, and to withdraw consent. To exercise any right, contact us via the support channel in the app; we respond within one month. If you are in the UK or EEA, you may also complain to your supervisory authority. Where data is transferred outside the UK/EEA, we use appropriate safeguards such as standard contractual clauses or adequacy decisions.

We use essential cookies and local storage required for sign-in and security. We do not use marketing cookies. You can clear them in your browser settings, though sign-in will stop working.