Privacy Policy

Who this policy covers

AI Hairstyle is intended for adults aged 18 and older. It is not directed to children, and we do not knowingly collect children’s photos or account data.

Data we process

• Account data such as name, email, verification state, sessions, and Google OAuth identifiers when that sign-in method is used.
• Private hairstyle inputs, optional reference images, generated results, selected style and color IDs, and job status.
• PayPal order, subscription, refund, reversal, and dispute identifiers. We do not store full card credentials.
• Security and operational data needed to prevent abuse, verify webhooks, diagnose failures, and enforce limits.
• Optional aggregate page analytics only after consent.

How photos are used

Photos are used to prepare and perform the hairstyle request, return the result, support download or sharing, and troubleshoot a specific failure. AI Hairstyle does not use uploaded photos to train this site’s models, does not perform face recognition, and does not create a public user gallery.

Storage and retention

You may delete a hairstyle job sooner. Deletion revokes its share links and requests removal of its source and result objects. Backups and provider caches may take a limited additional period to age out where technically unavoidable.

• Original and reference uploads: up to 24 hours.
• Results created with free credits: up to 7 days.
• Results created with paid credits: up to 30 days.
• Share links: up to 7 days, or sooner when revoked or deleted.
• Billing, ledger, fraud-prevention, and legal records: as needed for accounting, disputes, security, and applicable law.

Service providers

The launch architecture uses Cloudflare Workers for application hosting, Supabase PostgreSQL through Cloudflare Hyperdrive for the database, Cloudflare for DNS, security, Turnstile, and private R2 storage, Replicate for configured image generation, Resend for transactional email, PayPal for payments, and—only after consent—Google Analytics and Microsoft Clarity. Each provider processes data under its own terms and configured region.

Analytics boundaries

Analytics events must not include image bytes, filenames, model prompts, source or result URLs, payment payloads, credentials, upload or share tokens, or other direct secrets. Upload and result areas are marked for Clarity masking. Optional analytics do not load until a visitor consents.

Security

Photos are stored as private objects and delivered through short-lived signed URLs. The server verifies file signatures, decodes and re-encodes images to strip metadata, limits dimensions and size, authenticates ownership, and verifies provider and payment webhooks. No internet service can promise absolute security.

Your choices and rights

Depending on your location, you may ask to access, correct, delete, or export personal data, object to or restrict processing, withdraw analytics consent, or complain to a regulator. Legal exceptions may require us to retain limited billing or security records.

Contact

Send privacy requests from the account email to lisheng3698@gmail.com. We may verify account ownership before completing a request.