Privacy Policy

1. Introduction

Welcome to Chitti ("App," "Platform," or "Service"). This Privacy Policy explains in detail how Chitti ("we," "us," or "our") collects, uses, shares, stores, protects, and manages your personal data, including facial information. By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Data Collection

2.1 Face Data

Chitti collects photos you submit via the app's camera or photo library. These photos may contain facial imagery including skin tone, skin texture, and facial structure for beauty and skincare analysis.

We do not extract, compute, or store facial geometry, faceprints, biometric templates, or any form of biometric identifier. No facial recognition technology is used at any point.

2.2 Other Personal Information

We also collect the following personal information:

• • Name
• • Age
• • Gender
• • Phone number
• • Coarse location (city or region)
• • Product collection (skincare and beauty products you use)
• • Conversation history (text-based chat interactions with AI specialists, including AI-generated analysis results but not the photos themselves)
• • Preferences (tone preference, persona selection, and context choices)

3. Usage of Face Data

The collected facial data is exclusively used for the following purposes:

• • Analysing skin condition, skin tone, hair characteristics, and makeup application
• • Generating personalised beauty and skincare recommendations
• • Providing visual feedback on your style and appearance (Vibe Check)

Face data is never used for facial recognition, identification of individuals, surveillance, profiling, advertising, or training any AI model.

4. Third-Party Sharing & Storage

4.1 Third-Party Providers and Why We Share Data

When you use an analysis feature (Vibe Check, Skin Analysis, or Makeup Analysis), your photo (which may contain facial imagery) and any accompanying text context you provide are sent to OpenAI for the sole purpose of generating your personalised analysis and recommendations.

4.2 Third-Party Storage Practices

• • Cloud infrastructure providers: Used for secure, encrypted storage of account data, conversation history, and photos (where applicable). They do not independently access or analyse your data.
• • OpenAI: Processes your photo and text in real-time to generate analysis. OpenAI does not retain, store, or log your photos or personal information after the analysis response is generated. Your data is never used by OpenAI to train, fine-tune, or improve any AI model or service. OpenAI is contractually prohibited from sharing your data with any other party. All data submitted through our Service falls under OpenAI's zero-data-retention API policy.
• • Google Analytics: Used for understanding aggregated usage patterns. No photos, face data, or personally identifiable information is shared for analytics purposes.

We do not sell, rent, or trade your personal information to any third party for marketing or advertising purposes.

4.3 Data Storage Locations

All collected data, including photos and related metadata, is securely stored in cloud infrastructure compliant with industry-standard data protection practices and security standards.

5. Data Retention

• • Vibe Check photos: Not stored. Processed in real-time and discarded after the analysis response.
• • Skin Analysis photos: Not stored. Processed in real-time and discarded after the analysis response.
• • Makeup Analysis photos: Stored securely for up to 7 days to support the analysis workflow, then automatically and permanently deleted.
• • Account data and preferences: Retained for as long as your account is active.
• • Conversation history: Retained for the duration of your account so you can access past recommendations.

We do not retain face data indefinitely without a specific, stated purpose. When you delete your account, all personally identifiable data is permanently deleted within 30 days.

6. User Consent & Transparency

Before your first analysis, the app displays a consent screen that clearly explains your photo will be sent to OpenAI for analysis. You must tap "I Agree" to proceed. If you decline, analysis features will not be available, but you can still use all other features of the app.

Consent may be withdrawn at any time by ceasing to use the analysis features or by requesting account deletion through the app's settings.

7. User Rights (DPDP/GDPR Compliance)

Under applicable laws and standards (DPDP Act, GDPR, and global privacy regulations), you hold the following rights regarding your data:

• • Right to Access: You can access your personal information within the app at any time.
• • Right to Correction: You can update your profile information within the app.
• • Right to Data Portability: You may request a copy of your personal data by contacting us.
• • Right to Erasure: You can permanently delete your account from within the app by navigating to Settings and selecting "Delete Account." All personal data — account information, conversation history, product data, preferences, and any stored photos — is permanently deleted within 30 days. This action is irreversible.

To exercise any of these rights, contact us at chitti.connect@gmail.com.

8. Data Security

We maintain stringent security protocols to protect your data:

• • All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• • Database access is enforced through row-level security policies, ensuring your data is accessible only to your authenticated account.
• • Photos are accessed via short-lived, signed URLs that expire within minutes.
• • Photos, face data, and personally identifiable content are never written to application logs or analytics systems.

9. Children's Privacy

Chitti is designed for users aged 13 and above. We do not knowingly collect personal information from children under 13. If we become aware that a user younger than 13 has provided us with personal information, we will take immediate steps to permanently delete that information.

10. Cookies and Third-Party Analytics

We utilise cookies and employ third-party analytics tools for app functionality optimisation and aggregated user engagement analytics. Our analytics provider is Google. No photos, face data, or personally identifiable information is shared for analytics purposes.

11. Contact

For privacy concerns, queries, or grievances, please contact us at chitti.connect@gmail.com.

12. Changes to Privacy Policy

This Privacy Policy may be periodically updated to comply with evolving legal requirements or changes in our data handling practices. Users will be notified via app notifications of significant policy changes. Continued use of the Service following these updates constitutes acceptance of the revised Privacy Policy.

Specific Disclosures Regarding Face Data (Addressing App Store Guideline 5.1.1)