Privacy Policy
Zero-Account, In-Memory Demo & Privacy-by-Design Architecture for US and European Markets
01. Privacy-by-Design & Current Website Scope
SaveFace (accessible at saveface.tech) operates this web showcase and interactive Live Demo under a strict Privacy-by-Design standard compliant with the EU General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and United States federal and state privacy frameworks, including the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA).
At the current stage of our web platform, we do not offer user registration, personal accounts, checkout forms, or newsletter subscriptions. We do not collect, store, or process your name, residential address, phone number, payment details, or personal medical records on our web servers.
02. In-Memory Live Demo Processing (Zero DB Writes for User Sessions)
When you interact with the SaveFace Live Demo (/b2b/demo) by pasting a supported retail product URL, entering an INCI ingredient list, or attaching 1 to 3 photos/screenshots of a cosmetic container, the calculation is executed on-the-fly in volatile server memory (Zero DB Writes for personal user sessions). Demo skin sensitivity profiles displayed in the interface are pre-configured simulation presets and do not record your personal health status.
If you upload photos of a cosmetic bottle or ingredient label in the Live Demo, the images are transmitted securely to our optical character recognition (Vision OCR) pipeline solely to extract product metadata and INCI text in real time. Visitors are strictly prohibited from uploading photographs of human faces, biometric identifiers, identity documents, or third-party personal data. Non-personal, anonymized chemical ingredient strings not yet present in our reference catalog may be logged to expand our chemical nomenclature dictionary (Pioneer Rule).
03. Ephemeral Security & Rate-Limiting (60-Second RAM Window)
To protect the SaveFace SSOT Scoring Engine and computational infrastructure against automated scraping, denial-of-service (DDoS) attacks, and API abuse, our security gateway inspects the incoming technical IP address and standard HTTP request headers in volatile memory within a strict 60-second sliding window (pursuant to GDPR Art. 6(1)(f) — Legitimate Interest in network and intellectual property security). Rate-limit buckets are automatically purged from memory every 120 seconds.
04. On-Device Health Enclave Architecture
Across the broader SaveFace B2C ↔ B2B ecosystem, personal skin questionnaires, allergy triggers, and family profiles are architected to reside exclusively inside a local enclave on the user's own smartphone. Neither saveface.tech nor partner e-commerce retailers receive or store identifiable medical or dermatological records on external servers.
05. Direct Email Communications (hello@saveface.tech)
If you voluntarily contact us via email at hello@saveface.tech (for example, for investor relations, B2B pilot inquiries, or legal notices), we process your email address and the contents of your message solely to respond to your inquiry. We never sell, rent, or share contact emails with data brokers or marketing networks.
06. Your Rights under EU GDPR & US State Laws (CCPA/CPRA)
European Economic Area (EEA), UK, and Swiss Visitors: Under the GDPR, you have the right to request access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest, as well as the right to lodge a complaint with your national Data Protection Authority.
United States (California, Virginia, Colorado, Connecticut & other states): SaveFace does NOT 'sell' or 'share' personal information or sensitive personal information for cross-context behavioral advertising as defined under the CCPA/CPRA. To exercise any privacy inquiries, contact us directly at hello@saveface.tech.