Merchant Privacy Supplement (template)

Businesses using Face Age add this text to their own privacy notice and show the consent text in the widget. Replace everything in [brackets]. This is the only place where the shopper is addressed directly, and it is published in the brand's name, because the brand is the controller.

Part A: Text for the Brand's Privacy Notice

AI Skin Analysis

[Brand] offers an AI skin analysis on [website / store name], provided by our technology partner Face Age. This section explains how it works and what happens to your data.

What we collect. If you choose to take the analysis, we collect the photo you take or upload, and the face measurements used to analyze it. We also collect the skin results produced from it, such as an apparent age estimate and scores for wrinkles, dark circles, pores, pigmentation, acne, redness, oiliness, dryness, and firmness. If you answer the quiz or ask for your report by email, we also collect your answers and contact details.

Why. To give you your skin analysis and report, and [to recommend products that suit your results].

Legal basis. Your photo and face measurements can be biometric data, and your skin results can be health-related data. We process them only with your explicit consent, which you give before the camera or upload starts. You can withdraw it at any time.

What happens to your photo. Your photo is sent securely to Face Age, which analyzes it on our behalf and returns your results. [Choose one:]

  • [History off] Your photo is deleted as soon as the analysis is complete. We do not keep it.
  • [History on] We keep your last 5 analyses, including your photos and results, so you can compare them over time. They are stored in your browser for up to 365 days and [, for our Shopify store,] in your customer account with us until you delete them, ask us to delete them, or close your account. Our provider, Face Age, does not keep them on its servers. You can clear them at any time from the history controls in the widget.

Automated recommendations. [If enabled:] Product recommendations are generated automatically from your results. You can ask for a person to review a recommendation, or object to it, by contacting us. This does not affect your access to the analysis itself.

Who processes it. Face Age processes your data only on our instructions. Your data is hosted in the European Union (Germany and Sweden). Face Age uses a small number of sub-processors; some text-based features use OpenAI in the United States, which receives your results and questions but never your photo. Face Age does not sell your data, does not use it to train its models, and does not use it for its own purposes.

[If enabled:] We also share [your email and results] with [Klaviyo / other tool] to [send you your report and product suggestions].

Your rights. You can ask us to access, correct, or delete your data, or withdraw consent, by contacting [brand privacy email]. Face Age helps us respond.

Age. The skin analysis is not intended for anyone under [18].

Part B: Consent Text Shown Before the Camera or Upload

Before you start your skin analysis

[Brand] uses Face Age to analyze your photo and estimate skin and face characteristics. Your photo and these measurements may be considered biometric and health-related data. [Your photo is deleted once the analysis is complete. / Your last 5 analyses are saved so you can track changes.]

☐ I consent to [Brand] and its provider Face Age processing my photo and skin data for this analysis, as described in the Privacy Notice. I confirm I am at least [18].

[Start analysis] (stays disabled until the box is checked)

Part C: Additional Release for US Shoppers

Illinois, Texas, Washington, and some other US states have specific biometric privacy laws. Brands selling to shoppers in those states should add this release to the consent step, after reviewing it with counsel:

I understand that [Brand] and its provider Face Age will collect and use my facial geometry to perform this analysis. [It is deleted once the analysis is complete. / It is kept until I delete it, and in no case more than 3 years after my last use.] I give my written consent to this collection and use.