Privacy Policy

This Privacy Policy explains how [CAMBIA legal entity name] ("CAMBIA", "we", "us") collects, uses, shares and protects your personal information when you visit our website, use our tools, or purchase our products. We are the data controller for the purposes of the EU/UK General Data Protection Regulation (GDPR).

Information we collect

• Information you give us: name, email, shipping and billing address, phone number, and order details when you buy or contact us.
• Skin questionnaire answers: the non-identifying preferences you share in our Skin Analysis and Routine tools to generate recommendations.
• Payment information: processed securely by our payment provider. We do not store full card numbers on our servers.
• Usage & device data: pages viewed, approximate location, browser and device type, collected via cookies and similar technologies (see Cookies below).

Your photos stay on your device

Our Skin Analysis tool processes any photo you capture or upload entirely within your browser, on your own device. Face images are never uploaded to our servers, never stored, never logged and never sent to any third party. Only your non-identifying questionnaire answers and the resulting recommendations may be used to improve your experience.

How we use your information

• To process and deliver your orders and provide customer care.
• To personalise product and routine recommendations.
• To send you marketing communications where you have consented, and to measure and improve our website and advertising.
• To meet legal, tax and accounting obligations.

Legal bases (GDPR)

We rely on: performance of a contract (to fulfil your orders); your consent (for marketing and non-essential cookies); our legitimate interests (to run and improve our business); and legal obligation (to keep required records).

Sharing your information

We share personal data only with service providers who help us operate, under contract and only as needed, including: payment processors, shipping and fulfilment partners, email/SMS platforms, and analytics and advertising providers. We do not sell your personal information.

Cookies and advertising

We use essential cookies to run the site and, with your consent, analytics and advertising cookies (for example to measure campaigns and show relevant ads). You can accept or reject non-essential cookies at any time using the cookie banner or the "Cookie preferences" link in our footer.

International transfers

Where data is transferred outside the EEA/UK, we use appropriate safeguards such as Standard Contractual Clauses.

Retention

We keep personal data only as long as necessary for the purposes above, including legal and accounting requirements, then delete or anonymise it.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing, port your data, and withdraw consent. EU/UK residents may lodge a complaint with their supervisory authority; California residents have rights under the CCPA/CPRA, including the right to opt out of "sale" or "sharing" of personal information. To exercise any right, contact us below.

Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS).

Children

Our products and site are intended for adults. We do not knowingly collect data from children under 16.

Contact

For any privacy request, contact us at care@cambia.com or via our contact page. Controller: [CAMBIA legal entity name], [registered address].