Biometric Data Consent
1. What data we process
When you use the Analyzer, you upload selfies — photos of your face. These are biometric personal data. An AI model analyzes the image to generate your result. We do not create or store a permanent biometric template of your face (a face embedding — a set of numbers describing your face geometry): the raw selfie is sent to the AI, and no long-term embedding is kept in our database.
2. Why we process it
For one purpose only: to generate your AI analysis result — scores and recommendations you see in the app.
We do not use biometrics to:
- Identify or recognize you across external databases.
- Power marketing or ad targeting.
- Share with any third parties other than those listed below.
- Train any publicly available AI models.
3. Who processes the data
We use the following sub-processors for AI analysis:
| Sub-processor | Data received | Jurisdiction |
|---|---|---|
| Google (Gemini) | Selfies — for analysis generation | USA / EU |
| OpenAI | Selfies — as a fallback when Gemini is unavailable | USA |
Both providers are bound by data protection agreements and do not use your selfies to train their public models (zero-retention mode is used where supported).
4. Where data is stored
- Selfies are uploaded to S3-compatible storage (Yandex Object Storage, Kazakhstan region) via short-lived presigned URLs and kept for no more than 24 hours. After that they are physically deleted.
- A permanent biometric template (face embedding) is not stored — it is never saved in our database.
- The analysis result (scores, text recommendations) is no longer biometric data and is kept until you delete your account.
- For users in the USA: any biometric data is retained for no longer than 3 years from your last interaction with the Analyzer, or until you withdraw consent — whichever occurs first (Illinois BIPA, 740 ILCS 14/15(a)).
5. Cross-border transfer
Biometric data may be transferred to the USA (Google's and OpenAI's servers). Transfers are based on Standard Contractual Clauses (SCCs) for EU users and Art. 16 of the KZ PD Law for KZ users.
Data of users in the USA is stored on servers in Kazakhstan (Yandex Cloud) and processed by sub-processors in the USA (Gemini / OpenAI). By using Sheen, you acknowledge this cross-border storage and transfer.
6. Validity
Consent is valid from the moment you confirm it in the app until you withdraw it.
7. How to withdraw consent
You can withdraw this consent at any time:
- In the app: Settings → Privacy → Withdraw biometric consent.
- Via API:
DELETE /api/users/me/consents/<id>. - By email at support@sheen.style.
Upon withdrawal:
- The Sheen Analyzer will stop working.
- All selfies in cloud storage will be physically deleted within 24 hours.
- Any biometric data associated with you is destroyed.
- Already generated text results will be anonymized (detached from your profile).
Withdrawing this consent does not affect your ability to use the rest of the app (profile, quests, daily tips).
8. Consequences of not giving consent
If you do not give this consent, the Analyzer is unavailable. All other features still work.
9. Additional terms for US users
This section is a written release under the Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14/15(b)). By giving this consent, you acknowledge that the following has been disclosed to you:
- What is collected: your selfies and the derived facial biometric features extracted from them during analysis.
- The specific purpose: to generate your AI analysis result (scores and recommendations) shown in the app.
- The term: data is processed for the duration of the analysis; selfies are kept for no more than 24 hours; any biometric data is retained for no longer than 3 years from your last interaction with the Analyzer or until you withdraw consent — whichever occurs first.
We never sell, lease, trade, or otherwise profit from your biometric data (BIPA §15(c)).
We disclose your biometric data only to the sub-processors listed above (Gemini / OpenAI), solely to generate your result, and only with your consent (BIPA §15(d)).
Equivalent rights apply to residents of Texas (Capture or Use of Biometric Identifier Act, CUBI), Washington (including the My Health My Data Act), and Colorado: biometrics are collected only after notice and with consent, never sold, and destroyed within the prescribed period.
10. Contact
Questions about biometrics — support@sheen.style.
11. Versioning
The current document version is 1.0. If our biometric processing changes materially, we will release a new version and ask you to consent again. Previous versions are available on request.