Privacy Policy

You provide: your email; intake answers (demographics such as stated age, sex, ancestry, location and climate; lifestyle answers; goals; screening answers; style preferences); an account (via our authentication provider); and any support correspondence.

Derived on your device: facial landmark coordinates (measured geometry) and aggregate skin statistics, computed in your browser from your photos. By default the photos themselves never leave your device — only these derived measurements are submitted to generate your report.

Only with explicit opt-in: (a) your six capture photos, if you tick the save-my-photos box on the capture review screen (stored so future analyses can be compared to your baseline); (b) one frontal photo, sent to our AI image provider solely to generate your before/after projection when that feature runs for your report.

Automatically: limited product analytics (funnel events such as "checkout started" — never photos, measurements, or free text), and standard server logs. Payments are handled by Stripe; we never receive your full card number.

Facial geometry is biometric information, and we treat it with the strictest standard we know how to apply:

Consent first. We do not collect or process facial geometry without your prior, written, standalone consent — its own unticked checkbox at checkout, never bundled into another agreement. You may withdraw consent at any time, which triggers deletion.

Retention schedule. Raw photos (where you opted to save them) and facial landmark data are permanently deleted 30 days after your report is delivered — unless you separately opt into the progress-tracking tier, in which case landmark vectors (not raw photos) are retained only while your membership is active and are deleted within 30 days of cancellation or your request, whichever comes first. In all cases biometric data is destroyed when the purpose for collection is satisfied.

No sale, lease, or trade — ever. We do not sell, lease, trade, or otherwise profit from your biometric information, and we do not disclose it to anyone except the processors listed below acting on our instructions, or where the law compels us.

No model training. Your photos and measurements are not used to train AI models.

Storage and security. Biometric data is stored with our infrastructure processors using industry-standard encryption in transit and at rest, and protected at least as carefully as we protect any other confidential information we hold.

Where we don't operate. The Service is currently not offered in Illinois, Texas, or Washington.

To generate your analysis and protocol; to deliver purchases and manage your membership; to run the optional projection and capture-set features you trigger; to send transactional email (receipts, report delivery, billing issues); to measure and improve the funnel in aggregate; to prevent fraud and abuse; and to comply with law. We do not use your data for third-party advertising, and we do not build advertising profiles.

We share data only with the service providers that run Kanon, each bound to process it solely for us:

Stripe (payments) · Clerk (authentication) · Supabase (database) · Netlify (hosting & functions) · Resend (transactional email) · PostHog (product analytics, funnel events only) · OpenAI (AI image generation — receives one frontal photo only when your projection is generated, for that purpose only).

We may also disclose information if required by law or to protect rights and safety, and in a merger or acquisition your data may transfer under this policy's protections. We have no "data partners," we run no ads, and we do not sell or share personal information as those terms are defined in the California Consumer Privacy Act.

Deletion, one click. The portal's delete-account control erases your reports, intakes, and any opt-in capture sets. You can also email us to exercise any right.

Depending on where you live (for example under the CCPA or GDPR), you may have rights to access, correct, delete, or port your personal information, and to not be discriminated against for exercising them. We honor these requests for everyone, not just where compelled. Contact privacy@kanonaesthetics.com; we will verify the request via your account email and respond within 30 days. EU/UK users may also lodge a complaint with their supervisory authority.

Photos: never received by default; opt-in capture sets deleted 30 days post-delivery or on request. · Landmark data: deleted 30 days post-delivery; tracking tier: life of membership + 30 days. · Reports & intake answers: kept while your account exists so your reports stay accessible; deleted on request. · Payment records: retained as required for tax/accounting law (held by Stripe). · Analytics: aggregate, retained per PostHog defaults.

Encryption in transit (TLS) and at rest with our processors; server-side secrets are never shipped to the browser; access is limited to what operating the Service requires. No system is perfectly secure — if a breach affects your data, we will notify you as the law requires and as fast as we honestly can.

Kanon is for adults 18+. We do not knowingly collect information from anyone under 18; under-18 intakes are declined and their answers deleted on the normal schedule. If you believe a minor's data reached us, email us and we will delete it.

Material changes will be posted here with a new effective date and, where they meaningfully affect your rights, emailed to account holders. Questions or requests: privacy@kanonaesthetics.com · Renado Labs LLC. See also our Terms of Service and How we make money.