Privacy Policy

• We do not store your medical records. If you type in lab values or health notes, or share a photo or video to sharpen your recommendations, that input is processed in the moment and then discarded — we do not retain it after your session generates your results.
• We do not perform facial recognition or identity recognition, and we do not create biometric identifiers. Any image you choose to share is analyzed transiently to inform product suggestions and is not used to identify you, matched against any database, or retained.
• We are not in the business of selling your personal information. We do not sell or “share” (as defined by California law) your personal information for cross-context behavioral advertising.
• We collect the minimum needed to run the Services.

You provide directly:

• Account: email address; authentication data.
• Intake profile: the goals, preferences, and attributes you enter (e.g., age range, gender, skin/hair type, ethnicity/heritage if you choose to share it, dietary rules such as vegan/halal/kosher, budget, product preferences). You choose what to share.
• Optional in-session inputs: typed-in lab values, health notes, or a photo/video you upload for analysis — processed transiently and not stored (see 2.1).
• Payments: processed by Stripe. We do not collect or store your full card number; we receive limited billing metadata (e.g., subscription status, last-4, billing country) from Stripe.
• Communications: anything you send us (support requests, emails).

Collected automatically (minimal): basic device/log data (IP address, browser type, timestamps) and essential/functional cookies needed to run the site and keep you logged in. We keep third-party analytics and trackers to a minimum and do not use advertising trackers that sell your data.

Sensitive personal information. Some inputs (health notes, lab values, ethnicity, images) are “sensitive personal information” under CCPA/CPRA. We use them only to generate your recommendations, with your consent, and we do not retain the transient inputs described in 2.1.

To create your account and provide recommendations; to process your subscription through Stripe; to respond to support; to secure and improve the Services (using de-identified/aggregated data only); and to comply with law. We do not use your sensitive inputs for advertising, and we do not sell them.

• Service providers who help us operate (hosting, Stripe for payments, email, error monitoring), under contracts limiting their use to our instructions.
• AI processing: to generate suggestions, inputs may be sent to our AI/search providers to produce results; we instruct providers not to train on or retain your data where that option is available.
• Legal/safety: if required by law, subpoena, or to protect rights and safety.
• Business transfer: in a merger, acquisition, or asset sale, subject to this Policy.
• Retailers/providers: when you click a “buy” or “provider” link you leave our Services and the third party’s own privacy policy governs. We are not responsible for third-party sites.

We do not sell your personal information, and we do not disclose the transient inputs in 2.1 to anyone.

Account data is kept while your account is active and for a limited period afterward as required for legal, tax, and dispute purposes, then deleted or de-identified. Transient inputs (2.1) are not retained. You may request deletion of your account and associated data at any time at support@aurabyessence.app.

You may request to know/access, correct, delete, and limit use of sensitive personal information, and to opt out of sale/share (note: we do not sell/share). California residents also have non-discrimination rights and may use an authorized agent. To exercise any right, contact support@aurabyessence.app; we verify requests to protect you. We honor Global Privacy Control signals where required.

We use administrative, technical, and physical safeguards appropriate to the data (encryption in transit, access controls, reputable processors like Stripe). No system is 100% secure, and we cannot guarantee absolute security. To the fullest extent permitted by law, we are not liable for unauthorized access beyond our reasonable control.

The Services are not for anyone under 18. We do not knowingly collect data from minors; if we learn we have, we delete it.

We may update this Policy; material changes will be posted with a new “Last Updated” date. Continued use means acceptance. Questions or requests: Essence AI LLC, Los Angeles, CA, support@aurabyessence.app.