Privacy Policy

1.1 Account & Profile Data

• Name, email address, and profile photo (via Clerk)
• Date of birth (optional, for personalised content)
• Astrology / wellness preferences (optional, onboarding)
• Account role and subscription tier

1.2 Usage & Progress Data

• Lesson completion, watch duration, and video progress
• XP points, level, streaks, and achievements
• Exercise zone progress and practice history
• Onboarding steps completed

1.3 Face Scan Data

• Numerical facial landmark coordinates (derived client-side; no images are stored)
• Wellness analysis output (zone scores, TCM face-reading notes)
• Scan timestamps and comparison history

1.4 Payment Data

Payment card details are collected and stored solely by Stripe, Inc. We receive only a payment confirmation, subscription status, and a Stripe customer ID. We do not store card numbers or CVVs.

1.5 Community Content

• Posts, replies, and reactions you submit in the Circle community
• Recordings and videos you choose to upload to the Platform

1.6 Technical & Analytics Data

• IP address, browser type, device type
• Page views and interaction events (via Vercel Speed Insights & Analytics)
• Error logs and performance metrics
• Notification read status

We share your data with the following categories of third parties as necessary to operate the Platform:

We do not sell your personal data to third parties. We do not share your data with advertisers.

We use the following types of cookies and local storage:

• Strictly necessary: Authentication session tokens (Clerk), security cookies. These cannot be disabled.
• Functional: User preferences (theme, language, filter settings stored in localStorage).
• Analytics: Anonymised page-view and performance data (Vercel Analytics). No cross-site tracking.

We do not use advertising cookies or third-party behavioural tracking cookies.

Face scanning is an opt-in feature. Here is exactly what happens when you use it:

1. Your browser accesses your camera (with your explicit permission).
2. The MediaPipe library (running entirely in your browser) detects facial landmarks in real time.
3. Only the numerical landmark coordinates and the derived analysis scores are sent to our servers and stored in our database. Your camera feed or any image is never transmitted.
4. We use this data to generate a personalised wellness analysis and face yoga routine, and to track your progress over time.

Retention & deletion: Scan data is retained for as long as your account is active. You can delete individual scans or your entire scan history from your account settings at any time. If you delete your account, all scan data is permanently erased within 30 days.

Legal basis: We process this data based on your explicit consent, given when you choose to initiate a scan. You may withdraw consent at any time by deleting your scan history and not using the feature again.

Special category data: Facial landmark data may constitute biometric data under GDPR Article 9 and similar laws. We treat it with the highest level of care, restrict access to it within our systems, and never use it for any purpose other than providing the face yoga wellness features described above.

• Account data: Retained while your account is active and for up to 3 years after closure for legal and fraud prevention purposes, then deleted.
• Scan / biometric data: Deleted within 30 days of account deletion or earlier on request.
• Payment records: Retained for 7 years for legal and tax compliance (financial records obligation).
• Analytics data: Anonymised after 90 days.
• Community content: Retained until you delete it or your account is closed.

Depending on your location, you may have the following rights regarding your personal data:

To exercise any of these rights, email us at hello@thefaceyogalab.com. We will respond within 30 days. We may need to verify your identity before processing your request.

If you are in the UK or EU, you also have the right to lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner’s Office (ICO).

Our Platform and third-party providers may process your data in countries outside the UK/EU, including the United States. Where required, we ensure such transfers are covered by appropriate safeguards (e.g. Standard Contractual Clauses, adequacy decisions, or equivalent mechanisms) in compliance with UK GDPR and GDPR.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

• TLS encryption in transit
• Encrypted database connections (Neon Postgres with SSL)
• Role-based access controls within the Platform
• Regular security reviews

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we take all reasonable steps to protect your data.

The Platform is intended for users aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us at hello@thefaceyogalab.com and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the Platform at least 14 days before the change takes effect. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.

For any privacy-related queries, data subject requests, or complaints: