Privacy Policy

Last updated: February 2026

This Privacy Policy explains how Glow & Grow ("we", "us") collects, uses, and protects your personal information when you use glowgrow.app or our mobile app. We take your privacy seriously and this policy is written to comply with the EU General Data Protection Regulation (GDPR), the South African Protection of Personal Information Act (POPIA), and equivalent global consumer-privacy laws.

1. Data controller

Glow & Grow is the "data controller" / "responsible party" for the personal information described here. You can reach us at charyl@glowgrow.app.

2. What we collect

• Account data: name, email address, hashed password.
• Beauty profile: skin type, skin tone, hair type, hair texture, beauty concerns, goals, allergies — you choose what to share during onboarding.
• Usage data: routines completed, challenges joined, articles read, saved recipes, dupe searches, streaks — used to personalize your experience.
• Progress content: optional photos and notes you upload to your Glow journal. Stored privately in an access-controlled bucket.
• Device / technical data: browser type, IP address (short-term), device model, crash logs.
• Payment data: processed by our PCI-compliant payment provider — we never see or store your full card number.

3. Legal basis (GDPR Art. 6)

• Consent — for optional profile fields and marketing emails (you can withdraw anytime).
• Contract — to provide the Service you subscribed to.
• Legitimate interest — to prevent abuse, secure the platform, and improve features.
• Legal obligation — for tax, billing records, and lawful requests.

4. How we use your data

• Generate personalized skincare & haircare routines and DIY recipes.
• Match beauty products and dupes to your unique profile.
• Send transactional emails (receipts, password resets) and, with consent, ritual reminders.
• Improve accuracy of our recommendations (aggregated, non-identifying).
• Detect abuse, enforce rate limits, and secure the platform.

5. AI processing

Some features (Dupe Finder, Glow Report, Adaptive Routines) send de-identified prompts to third-party language models. We do not send your name, email, photos, or payment data to these models. You can opt out of AI features by not subscribing to Premium.

6. Who we share data with

We share only what is strictly necessary with vetted processors under data-processing agreements:

• Hosting & database: secure cloud infrastructure providers.
• AI & language processing: language-model providers to power personalized recommendations.
• Payment processing: PCI-compliant payment providers for subscription billing.
• Email delivery: transactional email providers.
• Push notifications: mobile push-notification providers.

We never sell your personal data. We do not share it with advertisers.

7. International transfers

Your data may be processed in the United States, the European Union, or South Africa. Transfers are protected by Standard Contractual Clauses or equivalent safeguards.

8. Retention

We retain account data as long as your account is active. On deletion, your beauty profile and progress content are removed within 30 days, except for records we must keep for legal or tax purposes.

9. Your rights

Under GDPR, POPIA, and similar laws, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate data.
• Delete ("right to be forgotten") your account and data.
• Restrict or object to processing.
• Portability — receive your data in a common format.
• Withdraw consent for marketing at any time.
• Complain to your local data-protection authority.

Exercise any of these rights by writing to charyl@glowgrow.app. We respond within 30 days.

10. Children

The Service is not directed at children under 16. We do not knowingly collect data from anyone under that age. If we learn we have, we will delete it.

11. Security

We use encryption in transit (HTTPS), encrypted-at-rest storage, row-level security on our database, strict access controls, private storage buckets with signed URLs, and Content-Security-Policy headers to protect your data.

12. Cookies

We use only essential cookies required to keep you logged in and remember your consent choices. We do not run behavioural-advertising cookies.

13. Changes to this policy

We may update this policy. Material changes will be notified in-app or via email at least 14 days before they take effect.

14. Contact

Privacy questions or requests: charyl@glowgrow.app.