Privacy Notice

1. Who We Are

Son:mi is operated by SON:MI LTD ("Son:mi", "we", "our", or "us"), which acts as the data controller for the personal data described in this Privacy Notice.

If you have any questions about this Privacy Notice or how we process your personal data, please contact us at:

Email: info@sonmi.io

2. What We Collect

Depending on how you use Son:mi, we may collect the following information:

Account Information

• Name
• Email address
• User ID
• Account preferences

Uploaded Images

Photos you choose to upload so we can analyse cosmetic characteristics such as skin tone, undertone, skin type, and visible skin concerns to provide personalised recommendations.

Messages & User Content

Information you provide when using Son:mi, including:

• chat messages
• skin concerns
• product preferences
• saved products
• routines
• feedback
• any other content you voluntarily submit.

Subscription Information

If you subscribe to a paid Son:mi plan, we receive information about your subscription status and transaction details necessary to provide the service. Payments are processed by the relevant payment provider, such as the Apple App Store or another authorised payment processor, depending on how you subscribe. Son:mi does not receive or store your full payment card details.

Device & Usage Information

Information such as:

• browser type
• device type
• operating system
• IP address
• usage patterns
• diagnostics and performance information

This helps us improve reliability, security and performance.

3. Why We Collect Your Information

We process your information to:

• provide personalised beauty and skincare recommendations;
• analyse uploaded images to generate cosmetic insights;
• personalise your experience within Son:mi;
• improve, evaluate and develop our products, services, AI systems, algorithms and recommendations;
• where appropriate, improve, evaluate and train AI models and algorithms that support Son:mi's services;
• analyse usage patterns and user feedback to improve the quality, safety and performance of the platform;
• communicate with you regarding your account or service updates;
• provide customer support;
• comply with legal obligations;
• develop future products, features and commercial offerings.

4. Facial Images

Uploaded facial images are processed to provide cosmetic and beauty-related analysis, including skin and colour analysis, and personalised recommendations. With your permission, we may also retain and use uploaded images and related information to improve Son:mi's recommendations and develop its services, as described in Sections 3 and 8.

Son:mi does not use facial recognition technology, does not attempt to identify individuals from uploaded images, and does not use facial images for identity verification or authentication.

Son:mi does not provide medical diagnoses or medical advice.

Face Tracking During Guided Scans

On supported Apple devices, Son:mi uses Apple's ARKit face tracking (TrueDepth) during guided scans solely to help you position the camera correctly. This includes processing information such as head position, whether your eyes appear open, how your face is framed within the camera view, and lighting quality.

This information is processed temporarily on your device in real time to guide image capture. Son:mi does not store, transmit, or share this face-tracking information, does not create or retain a facial template or faceprint, and does not use this information to identify you.

5. Legal Basis for Processing

Under UK GDPR and, where applicable, the EU GDPR, we process personal data on the following legal bases:

• Contract – to create and manage your account, analyse uploaded images, and provide the personalised services you request.
• Legitimate Interests – to improve, evaluate, develop and secure our services.
• Consent – where required by law, including marketing communications and the use of uploaded images or other personal data for research, product improvement, and AI model development beyond what is necessary to provide the core service.

You may withdraw consent where applicable at any time, although this may affect our ability to provide certain services.

6. Data Sharing

We use trusted third-party service providers to operate Son:mi.

These may include:

• cloud infrastructure providers (such as AWS and Supabase);
• AI service providers (such as OpenAI and Anthropic);
• email, authentication and infrastructure providers.

These providers process personal data on our behalf in order to provide the services requested. We carefully select these providers and require them to protect your personal data in accordance with applicable privacy and security standards.

We do not sell your personal data.

We do not share your personal data with third parties for advertising purposes.

We may use aggregated or anonymised information derived from user data to improve our services, conduct research, identify trends, and develop commercial insights. This information cannot reasonably be used to identify you.

7. International Transfers

Some of our service providers process data outside the UK or European Economic Area.

Where this occurs, we rely on appropriate safeguards, such as Standard Contractual Clauses or other lawful transfer mechanisms, to protect your personal data.

8. Data Retention

We retain personal data only for as long as necessary to provide Son:mi, improve our services, comply with legal obligations, resolve disputes and enforce our agreements.

Uploaded images and the cosmetic analyses derived from them are retained while your account remains active to support ongoing personalised recommendations, scan history, and future improvements to Son:mi's analysis capabilities, consistent with the purposes described in this Privacy Notice.

You may request deletion of your account and associated personal data at any time from within the app (Menu → Account Settings → Delete Account) or by contacting us.

Following a valid deletion request, we will delete or anonymise your personal data within a reasonable period unless we are required by law to retain certain information.

9. Security

We use appropriate technical and organisational measures designed to protect your personal data, including secure cloud infrastructure, encryption where appropriate, and access controls.

While no system can guarantee absolute security, we continually work to protect the information entrusted to us.

10. Your Rights

Subject to applicable law, you have the right to:

• access your personal data;
• correct inaccurate information;
• request deletion of your personal data;
• restrict or object to certain processing;
• withdraw consent where processing is based on consent;
• receive a portable copy of your personal data where applicable;
• lodge a complaint with the UK Information Commissioner's Office (ICO) or your local supervisory authority.

To exercise your rights, please contact:

info@sonmi.io

11. Children's Privacy

Son:mi is intended for users aged 16 years or older.

We do not knowingly collect personal data from children under the age of 16.

12. Automated Decision-Making

Son:mi uses AI-assisted analysis to generate personalised cosmetic recommendations.

These recommendations are intended to support users in making beauty and skincare decisions and do not constitute medical advice or produce legal or similarly significant effects under applicable data protection laws.

13. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our services, technology, or legal obligations. The latest version will always be available through our website and app. Where required by applicable law, or where changes are material, we will take reasonable steps to notify users before they take effect.