1. Who we are
Barette AI LLC (3320 Treble Ct, Charlotte, NC 28262-2058, United States) builds Barette: an app that reads your hair with AI and connects the result to products, specialists and a community feed, plus an optional camera device that does the close-up capture. This policy covers the Barette Android and iOS apps (com.barette.app), the progressive web app, this website and the Barette device.
Barette is the data controller for everything described here. Questions go to privacy@barette-ai-app.com.
The short version: we collect what the app needs to work, we do not sell anything to anyone, there are no advertising or analytics SDKs in the app, and you can delete everything from one screen.
2. What we collect
Each row is a data type, why it exists and whether you can skip it. The same table backs our Google Play Data safety declaration.
| Data | What exactly | Why | Optional? |
|---|---|---|---|
| Personal info | Name, email address, phone number, profile photo | Account creation and sign-in, order and booking contact details, and the public profile other people see on Reels. | Required to hold an account. |
| Photos and videos | Hair and scalp images, Reels videos and their audio | Producing an analysis result, keeping your scan history, and publishing the Reels you choose to post. | Optional — the app works without scanning or posting. |
| Location | Approximate or precise device location | The Near You feed, finding specialists and on-site stores close to you, and delivery estimates. | Optional — deny the permission and those views fall back to a manual search. |
| Purchases | Orders, order status, delivery address, wishlist and cart | Fulfilling marketplace orders and showing you your history. | Only collected if you buy something. |
| App activity | Views, likes, comments, follows, bookings and notifications | Ranking the For You and Near You feeds, keeping both sides of a booking in sync, and sending in-app notifications. | Generated as you use the app. |
| Device and diagnostics | App version, device model, OS version, crash and error logs | Diagnosing crashes and keeping the API compatible with the versions people are running. | Collected automatically when something fails. |
| Barette device | Pairing state, battery level, firmware version, captured images | Pairing the capture board with your account and moving the images it takes into your scan history. | Only if you own and pair a device. |
We collect this directly from you (what you type, capture or upload) and automatically as you use the app (what you view, like, order or book). We do not buy data about you from anyone.
3. What we never collect
- Payment card numbers or bank details — marketplace orders are settled cash on delivery or arranged directly with the store.
- Contacts, calendar, SMS or call logs.
- Audio recordings taken outside a Reel you record yourself.
- Advertising identifiers — the app carries no advertising SDK.
- Third-party analytics or tracking SDKs of any kind.
- Health records, or any data used to infer a medical condition. A hair analysis is cosmetic guidance, not a diagnosis.
4. Why we use it
We use your data for these purposes and no others:
- Running your account — signing you in, keeping you signed in, and showing you your own history.
- Analysing hair — turning a photo into a structured read on hair type and condition, and tracking how it changes over time.
- Recommending — matching that result to products in the marketplace and to specialists who work with your hair type.
- Ranking Reels — the For You and Near You feeds rank on engagement, recency, affinity and distance. It is a ranking, not a profile sold to anyone.
- Fulfilling orders and bookings — passing what a store or specialist needs to complete what you asked for.
- Keeping people safe — moderating content, investigating reports, and preventing fraud and abuse.
- Keeping it working — fixing crashes, and knowing which app versions are in use.
- Telling you things — order, booking and safety notices. Marketing email only if you asked for it, and every message can be unsubscribed.
Where the law requires a legal basis, ours is: performing our contract with you (the account, orders, bookings), your consent (camera, location, notifications, marketing), our legitimate interest in a safe and working service (moderation, fraud prevention, diagnostics), and legal obligation (tax and accounting records).
5. Device permissions
Android and iOS ask before granting any of these, and every one of them can be revoked later in your system settings.
| Permission | Used for | Your control |
|---|---|---|
| Camera | Capturing a hair or scalp photo and recording a Reel. | Asked for the first time you scan or record; deny it and you can still pick an existing photo from your gallery. |
| Photos and media | Choosing an existing photo to analyse, or a video and audio track for a Reel. | Asked at the moment you pick a file. Barette reads only the file you select. |
| Location | The Near You feed, nearby specialists and on-site stores, and delivery estimates. | Optional, foreground only. Barette never asks for background location and does not track you between sessions. |
| Notifications | Booking confirmations, order status and replies to your Reels. | Optional, and switchable per category in the app settings. |
| Network and Wi-Fi state | Talking to the Barette API and pairing with the capture device over your local network. | Required for the app to function at all. |
Barette never requests background location, and the app does not run location collection while it is closed.
6. Hair photos, scans and Reels
A hair or scalp photo is the most personal thing the app handles, so it gets its own rules:
- Scan images are private to your account. They are never published, never shown to other users, and never sold or licensed.
- They are used to produce your analysis result and to keep your history so you can compare over time.
- You can delete an individual scan, or your whole history, from the app.
- A Reel is different: it is a post. Once you publish one, its video, thumbnail and caption are public to other users. Delete it and it comes down.
- Reels audio is fingerprinted on upload to catch copyrighted music. The fingerprint is derived from the file you uploaded and is used for nothing else.
A Barette analysis is cosmetic guidance. It is not a medical diagnosis, we do not treat it as health data, and it should not be used in place of advice from a doctor or dermatologist.
7. Who else sees it
We share data in four situations, and no others:
- Stores and specialists you deal with. When you order or book, that store or specialist gets what they need to fulfil it — your name, contact details, the items or service, and a delivery address if there is one.
- Other users. Only what you publish: your display name, profile photo, and your Reels and comments.
- Service providers who run the platform for us. They may only process data on our instructions.
- Law enforcement, where we are legally required to, or where it is necessary to protect someone from serious harm. Child safety reports are escalated as described in our child safety standards.
| Provider | What they do | What they touch |
|---|---|---|
| Application hosting provider | Runs the Barette API, database and media storage. | Everything the service stores, at rest and in transit. |
| Google Maps Platform | Renders maps and geocodes addresses inside the app. | The map view you are looking at, and an address when you search for one. |
| Email delivery provider | Sends account, order and booking email. | Your email address and the contents of that message. |
| Google Play | Distributes the Android app and handles its install lifecycle. | Whatever Google collects as the store operator, under its own privacy policy. |
We do not sell your personal data, and we do not share it for advertising.
8. How long we keep it
While your account is open, we keep your data so the app can show it back to you. Close the account and deletion starts immediately and completes within 30 days, with these exceptions:
| Kept after deletion | Why, and for how long |
|---|---|
| Completed order and booking records | Accounting and tax law requires a record of a completed sale. Kept for 7 years, reduced to the transaction itself — the customer is recorded as a deleted account. |
| Moderation and safety records | Where an account was actioned for child safety, harassment or fraud, a minimal record is kept so the ban cannot be evaded. Kept for 5 years. |
| Backups | Encrypted backups roll over on a 30-day cycle. Deleted data stays in an untouched backup until that cycle completes. |
Everything else goes:
- Your profile: name, email, phone number and profile photo.
- Every hair scan, the images behind it and the analysis history.
- Your Reels, their videos, thumbnails, comments and likes.
- Your wishlist, cart, follows and notification history.
- Barette device pairings and anything the device captured.
9. Your rights and controls
- See it — most of it is already visible in the app; ask us and we will export the rest.
- Correct it — edit your profile in the app, or write to us.
- Delete it — from the app, or through the deletion page, no install required.
- Take it with you — ask for a machine-readable export of your profile, scans, orders and Reels.
- Withdraw consent — revoke camera, photo, location or notification permissions at any time in your system settings. The rest of the app keeps working.
- Object or complain — write to privacy@barette-ai-app.com. If we cannot resolve it, you can complain to the data protection authority in your country.
We answer requests within 30 days and never charge for them.
10. Security
- Traffic between the app and our API is encrypted in transit (HTTPS/TLS).
- Sessions use short-lived JWTs, held on the device in the platform's secure storage — the Android Keystore or the iOS Keychain.
- Passwords are stored as salted hashes. Nobody at Barette can read yours.
- Access to production data is limited to the people who need it to operate the service.
- Backups are encrypted and roll over on a 30-day cycle.
No system is perfect. If we discover a breach affecting your data, we will tell you and the relevant authority without undue delay.
11. Children
Barette is for adults: you must be 18 or older to hold an account. We do not knowingly collect data from children. If you believe a child has an account, write to safety@barette-ai-app.com and we will close it and delete the data. Our child safety standards set out how we handle abuse reports.
12. International transfers
Barette is operated from United States. Our hosting and email providers may store or process data in other countries. Where that happens we rely on contractual protections with those providers requiring them to protect your data to the standard described in this policy.
13. Changes to this policy
When this policy changes we update the date at the top of the page. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect, and where the law requires it we will ask for your consent again.
Contact us about this policy
Write to privacy@barette-ai-app.com for anything on this page, or use the contact form. Postal mail reaches us at Barette AI LLC, 3320 Treble Ct, Charlotte, NC 28262-2058, United States.
We answer every message from a person, not a template, and we aim to do it within two working days.