Privacy Policy for Hairify: AI Hair Changer

1. Who We Are

This Privacy Policy explains how EXO Studio ("we," "us," or "our"), based in Hanoi, Vietnam, collects, uses, and shares information when you use Hairify: AI Hair Changer (the "App") on iOS, bundle identifier com.exo.hairify. For the EU/UK GDPR, EXO Studio is the data controller for the personal data described here. By using the App you agree to this Policy; it is incorporated into our Terms of Service.

2. Information We Collect

2.1 Information you provide

• Photos. The photo you select or capture is uploaded to our AI processor to generate your result (see Section 3).
• Communications. If you email us or use in-app "Send feedback" / "Report", we receive your message and email address (the message is sent only when you tap Send).
• Purchases. If you buy generation credits, Apple processes the payment and returns a transaction confirmation. We do not receive your card number.
• Onboarding choices. Interests selected on first launch are stored only on your device.

2.2 Collected automatically by third-party SDKs

To show and measure ads, understand usage, and attribute installs, the App and the SDKs in Section 5 collect:

• Device & usage data: device model, OS version, language/region, App version, coarse (country-level) location derived from IP, in-app events, and session data.
• Identifiers: the iOS vendor identifier (IDFV) and, only with your App Tracking Transparency permission, the advertising identifier (IDFA); a pseudonymous Firebase app-instance ID.
• Advertising data: ad impressions, clicks, and ad revenue.

The App does not include a crash-reporting SDK or push-notification service; it links only Firebase Analytics and Firebase Remote Config.

3. Your Photos & AI Processing

• On-device check first. The App runs on-device face detection (Apple Vision) before upload; that detection sends nothing off your device.
• Processing. Your photo is sent over HTTPS/TLS to our cloud AI processor (Modal Labs, Inc.) to generate the new hairstyle or color, which is returned to the App.
• Limited to your request. Your photo is used to fulfil your generation request. We do not sell your photos and do not share them with our advertising or analytics partners.
• Deletion. You can ask us to delete photos you uploaded and their results at any time by emailing exostudio.feedback@gmail.com.
• Biometric note. Our AI processes facial imagery to apply hairstyles. We do not build a face-recognition profile, create face templates, or identify you by name.

Please do not upload photos of other people without their consent, or photos of children.

4. How We Use Information & Legal Bases

5. Third-Party Services & SDKs

Each provider handles data under its own privacy policy. Where a provider acts on our behalf it is our processor; where it uses data for its own purposes (such as advertising) it acts as an independent controller.

• Modal Labs, Inc. — cloud AI compute/hosting processor for generation. Privacy.
• Apple, Inc. — App Store distribution and in-app-purchase payment processing. Privacy.
• Google AdMob (with AppLovin and Mintegral mediation) — advertising. Google · AppLovin · Mintegral.
• Google Firebase — Analytics for Firebase and Remote Config only. Firebase · Google.
• Adjust GmbH — attribution and measurement. Privacy.
• Meta (Facebook) SDK — install/app-event attribution and measurement. Privacy.
• TikTok Business SDK — install/app-event attribution and measurement. Privacy.
• Google User Messaging Platform (UMP) — consent collection in the EEA/UK.

6. Sharing & Sale of Data

We do not sell or rent your photos. We share data as follows:

• Advertising, analytics & attribution partners (Section 5): app-usage and device data, and — only with your ATT consent — your advertising identifier. Under some U.S. state laws this may be a "sale" or "sharing" for targeted advertising (see Section 12). We do not share uploaded photos with these partners.
• Processors acting on our behalf (Modal).
• Legal & safety when required by law or to protect rights and safety.
• Business transfers in a merger, acquisition, or asset sale, subject to this Policy.
• With your direction, when you share a generated image yourself.

7. Data Retention

• Uploaded photos & generated images: retained only as long as needed to provide the service and meet legal obligations, and deleted on a valid request (Section 3). Generated images also stay on your device (App gallery / iOS Photos); deleting the App removes the App's gallery.
• Advertising & analytics data: retained by the Section 5 partners under their own policies (Firebase Analytics event data is typically retained up to 14 months). You can reset your advertising identifier in iOS Settings.
• Service logs: typically up to 90 days for security and abuse prevention.
• On-device data (gallery, language, onboarding choices): stays on your device until you delete the App.

8. Security

We use encryption in transit (HTTPS/TLS), access controls, an API-key gate on the generation endpoint, and reputable infrastructure providers. No method of transmission or storage is fully secure, but we use commercially reasonable safeguards.

9. Permissions on Your Device

The App does not request location, contacts, microphone, motion, calendars, HealthKit, Bluetooth, or local-network permissions, and does not register for push notifications.

10. Tracking & Advertising

The App shows third-party ads (Google AdMob with mediation) and works with attribution/analytics partners (Firebase, Adjust, Meta, TikTok). Before any cross-app tracking on iOS, the App presents Apple's App Tracking Transparency (ATT) prompt:

• If you allow tracking, partners may use your advertising identifier (IDFA) to measure and personalize ads.
• If you decline, you still see ads, but they are non-personalized and cross-app tracking is limited.

In the EEA/UK we present a Google-certified consent (UMP) form before ads and non-essential data use. Change your choice any time in iOS Settings → Privacy & Security → Tracking. In App Store Connect we declare the relevant data as collected and, where you consent, "Used to Track You."

11. Children's Privacy

The App is not directed to children under 13 and we do not knowingly collect their personal information. If you believe a child provided us a photo, contact us and we will delete it. We do not knowingly serve personalized ads to children. Because the App applies AI to facial imagery, please do not upload photos of children.

12. Your Privacy Rights

12.1 EU/EEA/UK (GDPR)

You may access, rectify, erase, restrict, or object to processing, request portability, and withdraw consent (including for ads/tracking). You may complain to your local data protection authority.

12.2 California & other U.S. states (CCPA/CPRA and similar)

You may know, delete, and correct personal information, opt out of "sale"/"sharing" for cross-context behavioral advertising, and limit use of sensitive information. To opt out, decline the ATT prompt (or turn off iOS Settings → Privacy & Security → Tracking) and, in the EEA/UK, withdraw consent in the in-app options; we honor Global Privacy Control where applicable. We respond within 45 days.

12.3 How to exercise

Email exostudio.feedback@gmail.com and tell us your request. We may verify your identity.

13. International Transfers

We are based in Vietnam and our providers may process data in the United States and other countries. Where required, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

14. Changes

We may update this Policy. For material changes we update the "Last Updated" date and, where appropriate, provide in-app notice. Continued use after changes take effect means you accept them.

15. Contact

• EXO Studio, Hanoi, Vietnam
• Email: exostudio.feedback@gmail.com
• App: Hairify: AI Hair Changer (iOS, bundle com.exo.hairify)