Privacy Policy
Privacy Policy
Last updated: May 8, 2026
This Privacy Policy describes how ColorFitapp (the "Service", operated by "we", "us", or "our") collects, uses, retains, shares, and protects information about you. We handle personal information in accordance with Japan's Act on the Protection of Personal Information (APPI), the EU/UK General Data Protection Regulation (GDPR/UK GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and other applicable laws.
1. Information we collect
We collect: (a) Face photos you upload, which may be considered "sensitive personal information", "special category data", or "biometric information" under various laws; (b) Email address, which we use to deliver your result and, subject to your separate, explicit consent, (b-1) to send marketing emails from ColorFitapp and (b-2) to share with our marketing partners in fashion, beauty, and cosmetics for their own marketing; (c) Consent flags (whether you accepted the Terms, Privacy Policy, AI processing notice, data handling notice, marketing emails, and partner sharing, and when); (d) Optional feedback you submit through forms; (e) Technical logs (timestamps, coarse IP address, browser type, OS, referrer). We use the minimum cookies and local storage needed to operate the Service and do not use third-party advertising or cross-site tracking cookies.
2. How we use your information
We use your information to: (a) perform the personal color analysis and generate the output; (b) deliver the result by email; (c) detect and prevent abuse and fraud; (d) comply with legal obligations; (e) perform aggregated, statistical analysis to improve quality; (f) only with your separate, explicit consent, send marketing, product updates, and promotional offers from ColorFitapp; (g) only with your separate, explicit consent (in addition to (f)), share your email address with our marketing partners in the fashion, beauty, and cosmetics industries, who may then use it for their own marketing purposes. We do not use your photos or results to train or fine-tune AI models, ours or any third party's.
3. Legal bases (GDPR / UK GDPR users)
If you are in the EEA or the UK, we rely on the following legal bases: (a) explicit consent (Art. 9(2)(a)) for processing facial images; (b) performance of a contract (Art. 6(1)(b)) for delivering your analysis result; (c) legitimate interests (Art. 6(1)(f)) for security, fraud prevention, and aggregated quality analysis; (d) explicit consent (Art. 6(1)(a) and the ePrivacy Directive 2002/58/EC) for marketing emails from us; (e) explicit consent (Art. 6(1)(a)) for sharing your email address with our marketing partners. Consents (d) and (e) are not a condition of using the Service and may be withdrawn independently at any time, without affecting the lawfulness of processing carried out before withdrawal.
4. Retention schedule
We keep data only as long as needed for the purposes described above. (a) Uploaded photos: auto-deleted within 24 hours after analysis completes. (b) Generated images: auto-deleted 7 days after generation (images attached to emails remain in your inbox under your control). (c) Email address: deleted promptly upon unsubscribe, or after 24 months of inactivity, whichever is earlier. For email addresses already shared with marketing partners, we will instruct partners to delete the address upon your request, but the partner's retention and deletion practices are governed by their own privacy policy. (d) Technical logs: up to 90 days. Longer retention may apply where required by law.
5. Service providers, sub-processors, and marketing partners
[Sub-processors] We share the minimum data necessary with the following processors, each contractually bound to use your data only to provide services to us: (a) Microsoft Azure (US East 2 region) — hosting, storage, serverless compute; (b) Azure OpenAI Service / Azure AI Foundry — image analysis and image generation. Prompts and images are not used to train OpenAI's production models; (c) Azure Communication Services Email — transactional email delivery; (d) Cloudflare — DNS, edge delivery, and email routing (incoming email forwarding for [email protected]). [Marketing partners] In addition, only with your separate, explicit consent, we may share your email address with the following categories of partners: fashion and apparel brands, beauty and skincare brands, and cosmetics brands. These partners may act as independent data controllers (GDPR Art. 4(7)) and process your email address under their own privacy policies. You may withdraw this consent at any time via the unsubscribe link in any marketing email or by emailing [email protected].
6. International data transfers
The Service processes data in the United States (Azure US East 2). For users in the EEA, the UK, or Japan, transfers to the United States are protected by Standard Contractual Clauses (SCCs) or equivalent safeguards as required by applicable law. For sharing with marketing partners, we contractually require partners to maintain appropriate safeguards (SCCs or transfer to an adequacy-recognized jurisdiction) where applicable.
7. "Sale" and "sharing" of personal information (CCPA/CPRA)
We do not sell your personal information for monetary or other valuable consideration. However, if you provide your separate, explicit consent in line with this Policy, we may share your email address with marketing partners (see Section 5) in a manner that may constitute "Sharing" for cross-context behavioral advertising under the CCPA/CPRA. California residents have the right to opt out of such sharing at any time. To opt out, email [email protected] or use the unsubscribe link in any marketing email. We do not sell or share sensitive personal information (including face images) for marketing purposes.
8. Your rights
Depending on where you live, you have the following rights: (a) Japan (APPI): access, correction, suspension of use, and disclosure of third-party transfer records; (b) EEA / UK (GDPR): access, rectification, erasure, restriction, portability, objection, withdrawal of consent (which may be exercised independently for marketing emails and partner sharing), and the right to lodge a complaint with your local supervisory authority; (c) California (CCPA/CPRA): right to know, delete, correct, limit use of sensitive personal information, opt out of "sale" and "sharing", and non-discrimination for exercising rights; (d) Other US states (VA, CO, CT, UT, etc.): equivalent rights under your state's privacy law. To exercise any of these rights, contact us at [email protected]. We will verify your identity and respond within the time periods required by applicable law.
9. Notice regarding facial / biometric-derived information
The Service analyzes your face photo to estimate your personal color type. We do so for personal color analysis only — not to identify you, not to build a face-recognition database, and not for any unrelated purpose. We obtain your explicit consent at upload, auto-delete the source image within 24 hours, do not reconstruct the original image from analysis results, and do not sell or transfer face images to third parties (other than the sub-processors listed above). If you reside in a jurisdiction with stricter biometric privacy laws (such as Illinois BIPA in the United States), please review this notice carefully before using the Service.
10. Security
We implement industry-standard technical and organizational measures to protect your information against unauthorized access, disclosure, alteration, and destruction. These include TLS in transit, AES-256 at rest, least-privilege access via Azure managed identities, and regular log review. No method of transmission or storage is 100% secure, but we work to maintain commercially reasonable safeguards.
11. Children's privacy
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that we have collected information from a child under 13, we will delete it promptly. Parents and guardians who believe their child has provided personal information should contact us immediately.
12. Cookies and local storage
We use only the minimum local storage required to remember your language preference and similar functional settings. We do not use third-party advertising or analytics cookies that track you across other websites.
13. Changes to this Policy
We may update this Policy from time to time as the Service or applicable law changes. Material changes will be announced on the Service and, where reasonable, via the email address you provided. The latest version will always be posted on this page.
14. Contact
For privacy questions, to exercise your rights, or to withdraw marketing or partner-sharing consent, contact us at [email protected] (operator: ColorFitapp Team, Tokyo, Japan).