Privacy Policy

Contact: Customer support at hello@zelieapp.com

1.1 Scope

This Privacy Policy explains how Zelie collects, uses, discloses, stores, and protects personal data when you use Zelie’s mobile application, websites, and related services (the “Services”), including purchases made through Zelie’s in-app shop.

1.2 Zelie is not medical care

Zelie provides skincare habit tracking and informational cosmetic insights. Zelie does not provide medical advice, diagnosis, or treatment.

1.3 Facial scans and biometric like data

Certain features allow you to upload or capture selfies for skin analysis. These images may contain facial information. Zelie does not use your selfies to uniquely identify you as a person, and we do not provide identity verification or facial recognition services. We process selfies to generate cosmetic insights and to help you track changes over time.

Because facial images can be sensitive, we apply heightened safeguards. You should not upload images of other people without their consent.

1.4 Personal data we collect

• Account and profile data: Username, email, phone number (optional), password hash or authentication token, language, country, time zone, and preferences.
• Selfies and image data: Photos or selfies you upload or capture in-app, and related technical metadata such as timestamp and device data.
• Skin tracking inputs: Routine logs, skin concern selections, questionnaires, product usage logs, and progress notes.
• Device and usage data: Device model, OS version, app version, IP address, device identifiers, crash logs, performance diagnostics, and in-app activity events.
• Shop and fulfillment data: Shipping name, delivery address, contact number, order details, purchase history, returns, refunds, disputes, and customer support interactions.
• Payment data: Payments are processed by third-party payment processors. We do not store full card numbers. We may receive payment status, limited billing metadata, and tokenized identifiers for reconciliation and fraud prevention.
• Marketing and communications data: Your marketing preferences, opt-in status, and engagement with emails, push notifications, SMS, and in-app messages.

1.5 How we collect personal data

We collect personal data when you register or log in, use selfie scanning or tracking features, log routines or products, make purchases, request returns or refunds, contact support, participate in promotions or surveys, or use community features. Certain data is collected automatically through cookies, SDKs, and similar technologies.

1.6 How we use personal data

• Provide and operate the Services, including accounts, streaks, reminders, and progress tracking.
• Process selfies and logs to generate cosmetic insights and trend views you request.
• Personalize your experience, such as reminders, recommended routines, and content ordering.
• Process and fulfill shop orders, including payments, delivery, returns, and customer support.
• Prevent fraud, abuse, and unauthorized access, including account and transaction security.
• Improve and develop features, analytics, and performance, including troubleshooting and testing.
• Send service communications, such as security notices and important updates, and marketing communications where permitted and in line with your preferences.
• Comply with legal obligations and enforce our agreements and policies.

1.7 Consent for selfies and sensitive processing

We will request your consent before you use selfie based features. You may choose not to provide selfies, but some features will not work without them. You can withdraw consent at any time through Settings or by contacting our team. Withdrawal applies to future processing and does not affect processing already carried out.

1.8 How we process selfies

Selfies may be processed on your device, on secure servers, or both, depending on the feature and technical constraints. Where server processing is used, we apply access controls and encryption in transit. We do not share your raw selfies with advertisers.

We may generate derived data from selfies, such as skin metrics or feature representations, to show trend charts and comparisons over time. Derived data is treated as personal data where it can be linked to your account.

1.9 AI training and model improvement

We may improve our models and features using data derived from how users interact with the Services. If we use selfies or image data for model improvement, we will do so only with appropriate safeguards and, where required, with explicit opt-in consent. You can choose whether your selfies may be used for model improvement in Settings, if this option is offered.

1.10 Marketing, consent, and opt-out

You can opt out of marketing messages at any time using in-app settings, unsubscribe links, or by contacting support. Service communications about security, billing, order status, or important changes may still be sent when necessary to operate the Services.

1.11 Disclosure of personal data

• Service providers, such as cloud hosting, analytics, crash reporting, email, and customer support tools.
• Payment processors and fraud prevention partners.
• Fulfillment partners, such as suppliers, warehouses, and couriers, to ship orders and handle returns.
• Professional advisors, such as lawyers and auditors, under confidentiality.
• Authorities where required by law, or to protect rights, safety, and security.
• Parties involved in a corporate transaction, such as a merger, acquisition, or reorganization, subject to appropriate safeguards.

1.12 Cross-border transfers

Your data may be transferred to, stored in, or processed outside Singapore. Where required, we take steps intended to ensure a comparable standard of protection, including contractual safeguards with vendors and appropriate security controls.

1.13 Retention and deletion

We retain personal data only as long as necessary for the purposes described, including legal, accounting, dispute resolution, and fraud prevention needs. You can delete specific selfies or logs in-app where the feature is provided. When you delete content, we will delete or de-identify it within a reasonable timeframe, subject to backups and legal or operational retention requirements.

We may retain certain transaction and security records after account deletion where necessary for legal compliance and chargeback, dispute, or fraud handling.

1.14 Notifiable data breaches

If we assess that a data breach is notifiable under Singapore law, we will notify the Personal Data Commission and affected individuals as required.

1.15 Your choices and rights

Depending on your jurisdiction and applicable law, you may request access to, or correction of, your personal data, and you may withdraw consent with reasonable notice. We may need to verify your identity before fulfilling a request. A reasonable fee may apply for access requests where permitted by law.

1.16 Security

We implement reasonable safeguards such as access controls, encryption in transit, and vendor security reviews. Because facial images can be sensitive, we apply heightened controls for access and handling. No method of transmission or storage is completely secure.

1.17 Cookies, SDKs, and similar technologies

We use cookies and similar technologies on our websites, and SDKs in our app, to operate the Services, remember preferences, measure performance, and understand usage. Some third-party partners may collect device identifiers and usage events for analytics, crash reporting, security, and marketing measurement, subject to your settings and applicable law.

1.18 Children

The Services are not intended for children under [13/16]. We do not knowingly collect personal data from children under the applicable age.

1.19 Changes and contact

We may update this Policy from time to time. If changes are material, we will notify you in-app or by other reasonable means. For questions or requests, contact our team at hello@zelieapp.com.

9. Aggregated Insights Notice (B2B)

If you opt in, Zelie may use de-identified and aggregated data derived from your use of Zelie to generate market-level insights, for example routine consistency trends by age band. We aim to remove direct identifiers and apply measures to reduce re-identification risk. You can change your choice in Settings.

Aggregated insights are intended to describe groups and trends, not individual users. Zelie does not sell personally identifying information as a data broker.