Privacy Policy

Rovaette (“Rovaette”, “we”, “us”) provides a mobile beauty intelligence app and this website. You can reach us at support@rovaette.com for any privacy question or request.

[Placeholder for legal review: registered company name, address, and the identity of the data controller / any EU-UK representative.]

When you create an account or sign in with Apple or Google, we may collect:

• Your email address (including Apple’s private relay address if you choose to hide your email).
• Your display name, if you provide one.
• An authentication-provider identifier that lets us recognise you on your next sign-in.
• Basic account metadata such as account creation date and sign-in timestamps.

Rovaette only works well if it knows something about your skin. The profile information you choose to provide may include:

• Skin type and skin concerns (for example dryness, acne, pigmentation, redness).
• Beauty goals and ingredient preferences or things you would rather avoid.
• Sensitivities and allergies you tell us about.
• Hair and scalp preferences.
• Age range.
• Hormone-related preferences, and pregnancy or breastfeeding-related information.
• Optional lifestyle information such as sleep, climate, or sun-exposure notes.

Depending on where you live, some of this may be treated as sensitive personal information or health data. See section 4.

Pregnancy or breastfeeding status, skin conditions, allergies, and hormone-related profile data can constitute sensitive personal information under laws such as the CCPA/CPRA, and special category data under Article 9 of the GDPR and UK GDPR.

• We ask for your explicit, in-app consent before you complete or save these parts of your profile, and we only use them to generate your personalised compatibility analysis.
• You can revoke that consent at any time in the app’s profile or privacy settings, or by emailing support@rovaette.com.
• Revoking consent stops future processing of that data and removes it from your profile; personalised scores that relied on it will no longer be generated.
• You can delete individual sensitive fields, clear your whole profile, or delete your account entirely.

We do not use sensitive profile data for advertising, profiling for marketing, or any purpose beyond delivering the analysis you asked for.

When you scan a product, the photo of the product or its packaging is processed to recognise the product and read the label or ingredient list (INCI).

• Images are processed in real time, in memory, to extract text and ingredient information.
• Images are not used to build a profile of your face or body, and we do not ask you to photograph yourself for analysis.
• Any temporary copy of an image created during processing is deleted within 24 hours.
• The extracted text — product name and ingredient list — may be kept as part of your scan history so your Beauty Cabinet stays useful.
• You can delete a scan, and its associated extracted data, from your history at any time in the app.

[Placeholder to finalise before launch: confirm with our processing providers the exact retention window for transient image copies, any logging of images on their side, and the final in-app deletion flow.]

To provide the Beauty Cabinet and keep your experience continuous across sessions and devices, we may store product scans, recognised product names, ingredient lists, compatibility results, saved favourites, routine history, and habit or streak data.

Rovaette uses AI models for product recognition, ingredient research, and personalised analysis. This processing only happens after you give in-app consent.

• What is sent: the scanned product information (such as extracted product name and ingredient list) and the profile fields relevant to the analysis you requested.
• What is not sent: your email address, account identifiers, or payment information.
• You can decline AI consent and continue using the parts of the app that do not require it, or revoke consent later in settings.
• AI output is an educational estimate. It can be incomplete or wrong, and it is not medical advice.

We rely on third parties to run the service. They process data on our behalf under contract and only for the purposes we specify. Categories include:

• Authentication providers (Apple, Google) for sign-in.
• Cloud infrastructure, database, and AI processing providers.
• Analytics, error-monitoring, and website hosting providers.
• Subscription and payment providers, including Apple App Store, Google Play, and RevenueCat.

Because of this, we do not claim that your data is never shared. What we do say is that we do not sell personal information, we do not “share” it for cross-context behavioural advertising, and we never use sensitive profile data for targeted advertising.

[Placeholder for legal review: publish the current subprocessor list with names, purposes, and locations.]

Purchases are processed by Apple or Google, not by us. We receive subscription status and transaction identifiers (via RevenueCat) so we can unlock features. We do not receive or store your full card details.

We use reasonable technical and organisational safeguards, including encryption in transit where applicable, access controls, least-privilege access for staff, and logging. No system can be guaranteed absolutely secure, so we do not promise that. If a breach affects you, we will notify you and any regulator as required by law.

We keep data only as long as we need it:

• Account data and Beauty Cabinet records: kept while your account remains active.
• Account deletion requests: your account data and Beauty Cabinet records are deleted within 30 days of a verified request.
• Transient product images: deleted within 24 hours of processing.
• Some records may be kept longer where necessary for legal obligations, tax and accounting, dispute resolution, fraud prevention, or enforcing our Terms.
• Backups are cycled out on a rolling schedule, so deleted data may persist briefly in backup media before being overwritten.

[Placeholder to finalise before launch: exact retention periods per data category, including analytics and log retention.]

Rovaette is operated from Taiwan and uses secure cloud infrastructure located in the United States and the European Union. Your data may therefore be transferred to and processed in countries other than your own. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision.

Rovaette is intended for users aged 16 and older, or 13 and older with verifiable parental consent where that is permitted by local law. The service is not designed for children, and we do not knowingly collect data from anyone below the applicable minimum age. If you believe a child has given us data, email support@rovaette.com and we will delete it.

• Decline or revoke AI-analysis consent at any time.
• Add, edit, or delete any part of your beauty profile, including sensitive fields.
• Delete individual scans or clear your scan history and Beauty Cabinet.
• Sign out on any device, or delete your account entirely.
• Manage or cancel subscriptions through your Apple or Google account.
• Turn off device-level camera, notification, and tracking permissions.
• Request access, correction, portability, or deletion of your data where applicable law gives you that right.

If you are in the EEA, UK, or Switzerland, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Have inaccurate data corrected and incomplete data completed.
• Have your data erased (“right to be forgotten”).
• Restrict or object to processing, including processing based on legitimate interests.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time, without affecting processing that already took place.
• Lodge a complaint with your local supervisory authority.

Our legal bases are: contract (providing the app and your account), consent (AI analysis, special category profile data, non-essential analytics), legitimate interests (security, abuse prevention, product improvement), and legal obligation where applicable.

If you are a California resident, you have the right to:

• Know the categories and specific pieces of personal information we collect, the sources, and the purposes.
• Delete personal information we hold about you, subject to legal exceptions.
• Correct inaccurate personal information.
• Limit our use and disclosure of sensitive personal information.
• Opt out of sale or sharing for cross-context behavioural advertising — we do not sell or share personal information in this way.
• Be free from discrimination for exercising these rights.

Email support@rovaette.com with the subject line “Privacy Request” and tell us which right you want to exercise. To protect your data, we will verify your identity — usually by confirming control of the email address on your account, and occasionally by asking for additional information matching our records. We do not use verification information for any other purpose. You may use an authorised agent where the law allows; we may ask for proof of authorisation.

This website uses only what is needed to load pages and remember your language choice, which is stored locally in your browser. If and when we add analytics, cookies, pixels, or marketing tools, we will list them here and, where required, ask for your consent before setting non-essential cookies.

[Placeholder to finalise before launch: name each analytics or marketing tool used on the website and in the app, its purpose, and its retention period.]

Sign-in and purchases involve Apple and Google, who handle that data under their own policies. See Apple’s Privacy Policy and Google’s Privacy Policy.

If we make material changes, we will update the “Last updated” date and notify you in the app or by email before the change takes effect. Continued use after the effective date means you accept the updated policy.

Privacy questions, requests, or complaints: support@rovaette.com.