Legal

Privacy Policy

Last Updated: October 21, 2026

1. Introduction

HairSimulate.com ("HairSimulate," "we," "us," or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains what information we collect, why we process it, how we share and safeguard it, and how you can exercise your data protection rights when using hairsimulate.com, app.hairsimulate.com, and related services (the "Service").

Data Controller: HairSimulate, located in Istanbul, Turkey (Contact: info@hairsimulate.com).

Regulatory Compliance: For users in the European Economic Area (EEA), the United Kingdom, and Switzerland, we process personal data in accordance with the EU/UK General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (nFADP). For users in the Republic of Turkey, we comply with the Law on the Protection of Personal Data No. 6698 (KVKK) and its secondary regulations.

Please read this Privacy Policy carefully. Where processing relies on your consent (such as optional analytics, processing special-category health or facial data for simulations, Community sharing, or Clinic Marketplace opt-in), you may withdraw your consent at any time.

2. Information We Collect

2.1 Information You Provide

Account & Verification Information:

  • Email address (required for account creation and magic-link or password authentication)
  • Display name and community biography (optional)
  • Password (managed and cryptographically hashed via our authentication provider; never stored in plaintext)
  • Mobile phone number and country code (optional, used to send SMS OTP codes for phone verification and bonus credits)
  • Profile picture / avatar (uploaded by you or provided via social login; EXIF metadata stripped)

Simulation, Health-Related,Community, and Marketplace Content:

  • Photos you upload for hair or eyebrow simulation, hairline design preferences, and simulation parameters (density, style, hair color, simulation type)
  • Derived facial analysis features (hairline landmarks, quality scores, estimated graft counts, coverage area) used to generate and evaluate your simulation
  • Community posts, stories, comments, replies, likes, bookmarks, collections, user follows, blocks/mutes, and abuse reports
  • Progress photos and linked simulation results you choose to publish in Community (including optional face-blurred derivatives)
  • Special-category health and procedure metadata you voluntarily add to your profile or Community tags (such as procedure type, technique, months post-operation, graft count, hair loss classification, or clinic name)
  • Clinic Marketplace opt-in preferences (goals note, budget range, and whether to share your simulations and/or progress photos with partner clinics)

Payment & Billing Information:

  • Payment transactions are processed by PCI-DSS compliant third-party payment processors (we do not store full credit card numbers)
  • Transaction records, credit ledger entries, package selections, and billing address (where required for tax invoicing)

2.2 Information Collected Automatically

Technical & Security Information:

  • IP address (stored in encrypted form and hashed with SHA-256 for rate limiting and abuse prevention)
  • Guest ownership and session cookies (HTTP-only session and ownership cookies used to protect guest simulation ownership)
  • Browser type and version, device type, operating system, screen resolution, language, and timezone
  • Pseudonymous device signature (for free guest simulations, collected with your agreement via the Guest Device Check to enforce the 1-simulation/month guest quota)
  • Application error logs, crash traces, and performance spans (with text, form inputs, and media masked in error replays)

Usage & Telemetry Information:

  • Pages visited, route navigation, and session duration
  • Feature interactions and conversion funnel events (such as upload, simulation start, result viewed, signup CTA clicks, and Community engagement)
  • Referrer URL, landing page, and UTM marketing campaign parameters

Approximate Location Information:

  • Country, city, and timezone derived from your IP address (GPS location metadata is automatically stripped from uploaded photos)

2.3 Information from Third Parties

If you choose to sign in using a third-party authentication provider (such as Google OAuth, Google One Tap, Facebook, or Instagram), we receive basic profile details permitted by your privacy settings on that service (such as your email address, name, and profile image). We also receive verification statuses from our SMS OTP verification providers and payment confirmation webhooks from our payment processors.

3. How We Use Your Information and Legal Bases

3.1 AI Simulation, Community, and Marketplace Delivery

  • Generate Simulations: Process your uploaded photos to produce hair and eyebrow restoration simulations, Front-Fill enhancements, and clinical recovery timelines
  • Store & Manage Results: Save your original photos and generated results so you can view, compare, download, or claim them across devices
  • Community Features: Publish and display your posts, comments, likes, bookmarks, follows, tags, and linked simulations according to your chosen visibility (Public, Community, or Anonymous) and face-blur settings
  • Clinic Marketplace (Opt-In Only): Share your marketplace case details, goals, budget range, and elected simulations/progress photos with verified clinics when you turn on "Open to clinic offers"
  • Moderation & Safety: Run automated content safety checks (NSFW/nudity detection, toxicity and profanity filtering, duplicate image hashing, and medical-guarantee keyword checks) and review user reports

3.2 Service Improvement and Quality Assurance

  • Automated Quality Gate: Evaluate generated simulations for anatomical realism and image quality to automatically retry or flag low-quality outputs
  • Product Analytics: Understand which features help users and optimize the user experience (using cookieless aggregate counters and, only with your consent, product analytics)
  • Error Debugging: Diagnose and fix application crashes, slow endpoints, and failed simulation jobs

3.3 Transactional Communications

  • Send authentication emails (magic sign-in links, email confirmations, and password resets)
  • Send SMS one-time passcodes (OTPs) when you request phone number verification
  • Deliver in-app notifications (such as simulation completion/failure alerts and Community replies, likes, or follows)
  • Respond to your support inquiries and privacy rights requests

3.4 Marketing and Promotional Use (With Explicit Consent Only)

Important:

We do NOT use your identifiable photos or simulation results for marketing without your separate, explicit opt-in consent.

If you grant marketing consent:

  • Images are anonymized (faces blurred or obscured) before promotional use
  • Consent is completely optional and never required to use the Service
  • You may revoke your marketing consent at any time by contacting info@hairsimulate.com

3.5 Research and Development

  • Analyze aggregated, de-identified usage statistics and simulation metrics to improve prompt engineering and platform performance
  • Develop new simulation styles, recovery timeline stages, and user interface improvements

3.6 AI Model Training Policy

Important:

We do NOT use your identifiable photos or facial images to train AI models, and we do not permit our third-party AI inference providers to train their models on your uploaded photos.

If we ever wish to use user images to train or fine-tune custom AI models in the future, we will request your separate, explicit opt-in consent beforehand.

3.7 Security, Quota Enforcement, and Fraud Prevention

  • Verify account ownership and prevent unauthorized claiming of guest simulation sessions
  • Enforce free guest simulation limits (via pseudonymous device signatures and hashed IP addresses) and prevent credit abuse
  • Detect and block spam, coordinated reporting abuse, prohibited content, and malicious traffic
  • Maintain audit logs of administrative and moderation actions

3.8 Legal Bases for Processing (GDPR Arts. 6 & 9 / KVKK Arts. 5 & 6)

We process your personal data only when we have a valid legal basis:

  • Performance of a Contract (GDPR Art. 6(1)(b) / KVKK Art. 5(2)(c)): To create and manage your account, generate simulations you request, manage credits, and operate Community and Marketplace features you choose to use
  • Explicit Consent (GDPR Arts. 6(1)(a) & 9(2)(a) / KVKK Arts. 5(1) & 6(2)): For processing facial images and voluntary health/procedure data (e.g., hair loss stage, graft count, months post-op), sharing your case in the Clinic Marketplace, optional product analytics cookies, and optional marketing image use
  • Made Manifestly Public by You (GDPR Art. 9(2)(e) / KVKK Art. 6): When you voluntarily publish health or procedure information in a Public or Community post
  • Legitimate Interests (GDPR Art. 6(1)(f) / KVKK Art. 5(2)(f)): For application security, rate limiting, fraud and quota-abuse prevention, automated content moderation, error and performance monitoring, and cookieless aggregate traffic statistics
  • Legal Obligation (GDPR Art. 6(1)(c) / KVKK Art. 5(2)(a)-(ç)): To comply with tax/accounting retention laws, respond to lawful requests by authorities, and maintain statutory data protection records

Withdrawing Consent:

  • Where processing is based on consent, you may withdraw your consent at any time (for example, by deleting your post or simulation, turning off Marketplace opt-in, clearing analytics consent, or emailing info@hairsimulate.com), without affecting the lawfulness of processing prior to withdrawal

4. How We Share Your Information

We do NOT sell or rent your personal information to third parties.

We share your information only in the limited circumstances described below:

4.1 Categories of Service Providers (Data Processors)

We work with vetted third-party service providers who process data on our behalf under strict contractual confidentiality and data protection obligations:

  • Cloud Hosting, Database & Object Storage Providers (European Union): Primary cloud database, authentication, and encrypted object storage infrastructure located in the European Union storing your account data, photos, simulations, and Community media
  • AI Inference & Vision Processing Providers (United States / Global): Specialized third-party AI model inference providers that process your uploaded photo solely to generate simulations and quality evaluations, alongside our dedicated vision service for face de-identification (blurring) and content safety scanning
  • Transactional Email & SMS Verification Providers (United States / EU): Transactional email delivery services for authentication links and notifications, and SMS OTP verification providers for mobile phone verification and carrier anti-fraud checks
  • Analytics, Telemetry & Error Monitoring Providers (EU / US): Self-hosted cookieless web traffic statistics, consent-gated product analytics services, and application error/performance monitoring tools
  • Payment Processing Providers: PCI-DSS compliant payment processors that handle credit purchases and billing
  • Social Authentication Providers: Third-party OAuth identity providers (such as Google, Facebook, and Instagram) when you choose to sign in with those accounts

All service providers are authorized to process your personal data only as necessary to perform services for HairSimulate and are required to maintain appropriate technical and organizational security safeguards.

4.2 Community Visibility and Social Sharing

When you publish content in Community, it is shared according to the visibility option you select:

  • Public: Visible to everyone, including logged-out visitors, search engines, and social media link preview crawlers (Open Graph), and may be indexed, cached, or shared by others outside HairSimulate
  • Community: Visible only to logged-in HairSimulate users
  • Anonymous: Hides your author display name and avatar from other users in the interface, but HairSimulate still keeps the account association internally for ownership, deletion, support, safety, moderation, and legal compliance
  • Shared Assets: Post text, comments, tags, clinic or procedure details you add, uploaded progress photos, image URLs, and attached simulation results (or their face-blurred copies if you enabled "Blur my face") are displayed according to your selected visibility
  • Community Image Watermark: Uploaded Community photos are processed with a hairsimulate.com text watermark in the bottom-right corner and stripped of EXIF/GPS metadata

Please do not post personal, medical, or third-party information that you do not want others to see. Deleting a Community post or your account immediately removes the content from normal public display and schedules stored media for permanent deletion within 30 days, subject to limited safety/moderation logs or active legal holds.

4.3 Clinic Marketplace Sharing (Opt-In Only)

We share your case information with partner clinics ONLY if you explicitly enable "Open to clinic offers" in your Marketplace Settings:

  • When opted in, verified clinics may view the goals note, budget range, procedure tags, and (only if you toggle them on) the saved simulations and progress photos you chose to share, so they can send you consultation offers or quotes
  • Your raw account password and private non-shared simulations are never disclosed to clinics
  • You can stop sharing at any time by toggling off "Open to clinic offers" in your dashboard settings

4.4 Legal Requirements and Safety

We may disclose your information if required to do so by law, court order, or governmental authority, or when we believe in good faith that disclosure is necessary to comply with legal obligations, protect the safety or rights of users or the public, or investigate fraud or security incidents.

4.5 Business Transfers

If HairSimulate is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Service before your personal data becomes subject to a different privacy policy.

5. International Data Transfers

HairSimulate operates from Turkey and uses primary cloud database and storage infrastructure located in the European Union (Germany), alongside select service providers (such as AI inference, SMS delivery, and error monitoring providers) located in the United States or other jurisdictions.

  • European Union / EEA: Primary application hosting, database, and object storage infrastructure
  • Turkey: Primary operational headquarters and data controller location
  • United States & Global: Third-party AI inference, SMS OTP verification, email delivery, and error/analytics processors

Safeguards for Cross-Border Transfers (GDPR Chapter V & KVKK Art. 9):

  • Standard Contractual Clauses (SCCs) & Standard Contracts: We rely on European Commission Standard Contractual Clauses (under GDPR Art. 46) and standard transfer contracts / undertakings compliant with KVKK Article 9 (as amended in 2024)
  • Adequacy Decisions: Where applicable, transfers rely on recognized adequacy decisions
  • Explicit Consent: Where required for specific features or transfers, we obtain your explicit consent
  • Technical Measures: All cross-border transmissions use TLS 1.2/1.3 encryption in transit, data minimization, and strict access controls

6. Cookies, Analytics, and Device Checks

Essential Cookies & Storage (Always Active):

  • Authentication tokens and session cookies (required to keep you signed in and secure your account)
  • Guest session & ownership cookies (HTTP-only session cookies that let you run a free simulation without an account and prevent others from claiming your result)
  • Consent preference storage (first-party cookies and local storage entries used to remember your privacy choices across hairsimulate.com and app.hairsimulate.com)

Optional Product Analytics Cookies (Only With Your Consent):

  • EU-hosted product usage analytics showing which features and flows are used (autocapture of sensitive inputs and session replay are disabled; no photos or medical details are sent)
  • Web and application usage analytics measuring aggregate traffic and conversion performance
  • First-party behavioral interaction tracking: Records page views, clicks, and scroll depth only when analytics consent is accepted
  • These optional tools load only after you click "Accept all" or enable "Product analytics" under "Customize" in our consent banner

Cookieless Visit Statistics & Error Monitoring (Legitimate Interest):

  • Self-Hosted Cookieless Traffic Statistics: Counts aggregate page views, referring sites, approximate country, and device type on our own servers without setting tracking cookies or building persistent cross-site profiles
  • Application Error & Performance Monitoring: Captures application crashes and performance metrics to keep the Service reliable; error diagnostics mask all text, form inputs, and user media

Guest Simulation Device Check (With Your Agreement):

  • To prevent abuse of the free guest quota without requiring an account, when you request a free guest simulation we ask for your agreement to compute a pseudonymous device signature (from browser/hardware characteristics and a hashed IP address)
  • This signature is used solely to enforce the free monthly guest simulation limit and prevent abuse — never for advertising or cross-site tracking. If you prefer not to use the device check, you can create a free account instead

You can accept or reject optional analytics with equal prominence in our consent banner, and rejecting does not limit your access to HairSimulate. To change or withdraw your cookie choice at any time, clear site cookies/storage in your browser settings and the banner will reappear.

7. Data Retention and Deletion Schedule

7.1 Photos, Simulations, and Community Media Retention

  • Authenticated Account Simulations & Photos: Retained while your account remains active so you can access your history, or until you delete a specific simulation or your account
  • Unclaimed Guest Simulations & Photos: Retained for up to 90 days after last session activity so you can view or claim your result, after which unclaimed guest sessions and images are automatically purged (you may also request earlier deletion at any time)
  • Community Posts, Comments & Uploaded Images: Retained while your post and account remain active
  • Deletion & 30-Day Hard Purge Window: When you delete a simulation, Community post, comment, or your account, the content is hidden from public/normal display immediately and permanently purged from active databases and storage buckets within 30 days (including any cached face-blurred derivatives)
  • Marketing Materials (Opt-In Only): If you explicitly approved an anonymized image for marketing, it is retained until you revoke consent (and deleted within 30 days of revocation)
  • Encrypted Backups: Rolling disaster-recovery database backups expire automatically on a fixed rotation cycle (up to 30 days)

7.2 Account, Telemetry, Moderation, and Billing Retention

  • User Account & Profile Data: Retained while your account is active and permanently deleted within 30 days of account closure or deletion request
  • Phone Verification Records: OTP codes expire after 5 minutes; verification attempt logs are deleted upon account deletion
  • Guest Quota & Visitor Analytics Records: Pseudonymous guest device signatures, quota counters, and visitor interaction logs are retained for up to 90 days for anti-abuse and conversion analysis, after which identifiable records are purged or aggregated
  • Community Moderation & Safety Logs: Reports, automated moderation verdicts, and abuse-prevention records are retained for 6 to 12 months (or for the duration of an active dispute or legal hold), while minimal pseudonymized audit tombstones (containing no photos or personal content) may be kept for up to 24 months for security compliance
  • Customer Support Communications: Retained for up to 3 years to resolve inquiries and maintain support history
  • Billing, Tax & Accounting Records: Financial transaction and invoice records are retained for 5 to 10 years as required by Turkish commercial/tax law (VUK/TTK) and applicable international tax regulations

7.3 Periodic Destruction and Your Deletion Controls

In accordance with GDPR storage limitation principles (Art. 5(1)(e)) and the KVKK Regulation on Erasure, Destruction or Anonymization of Personal Data, we conduct automated and periodic data destruction (at least every 6 months) to purge expired records. You can delete individual simulations, Community posts, or your entire account directly in the product, or request deletion at any time by emailing info@hairsimulate.com.

8. Data Security

Technical and Organizational Safeguards:

  • Encryption in Transit & at Rest: All traffic is protected via TLS 1.2/1.3 (HTTPS), and stored database records and cloud storage buckets are encrypted at rest (AES-256)
  • Storage Isolation & Row-Level Security (RLS): Database tables enforce Row-Level Security, and storage buckets disable public directory listing so user photos cannot be enumerated
  • IP & Credential Protection: IP addresses are encrypted and hashed (SHA-256) before storage; authentication is handled via secure identity tokens and cryptographically hashed credentials
  • EXIF & Metadata Stripping: Uploaded Community and avatar images are re-encoded to strip embedded camera EXIF and GPS location coordinates
  • Access Controls & Audit Logging: Administrative access is restricted by role-based access controls and tracked in an immutable admin audit log

While we implement industry-standard safeguards designed to protect your personal, facial, and health-related data, no method of internet transmission or electronic storage is 100% secure. In the event of a personal data breach affecting your rights, we will notify the relevant supervisory authorities (within 72 hours under GDPR / KVKK) and affected users as required by law.

9. Your Data Protection Rights (GDPR, KVKK & Global)

Depending on your jurisdiction (including under GDPR Arts. 15–22 and KVKK Art. 11), you have the following rights regarding your personal data:

  • Right of Access & Information: Learn whether your personal data is processed and request a copy of the data we hold about you
  • Right to Rectification: Request correction of inaccurate or incomplete personal data (or update your profile directly in your account settings)
  • Right to Erasure ("Right to be Forgotten"): Request deletion or destruction of your personal data under GDPR Art. 17 or KVKK Art. 7
  • Right to Restrict Processing: Request that we limit the processing of your personal data in specific circumstances
  • Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format
  • Right to Object: Object to processing based on our legitimate interests or to automated analysis resulting in an outcome against you (KVKK Art. 11(1)(g))
  • Right to Withdraw Consent: Withdraw any previously given consent at any time
  • Right to Compensation (KVKK Art. 11(1)(ğ) / GDPR Art. 82): Claim compensation if you suffer damages due to unlawful processing of your personal data
  • Right to Lodge a Complaint: Lodge a complaint with a data protection supervisory authority — the Turkish Personal Data Protection Authority (KVKK Kurumu, kvkk.gov.tr) in Turkey, or your local EU/EEA, UK, or Swiss data protection authority

9.1 How to Exercise Your Rights

To exercise any of your privacy rights, please contact us using the details below:

Email: info@hairsimulate.com

Subject Line: "Privacy Rights Request" (please specify the right you wish to exercise and the email address associated with your account)

Response Time: We will acknowledge your request within 5 business days and provide a full response within 30 days (in accordance with GDPR Art. 12(3) and KVKK Art. 13).

No Fees: Exercising your privacy rights is free of charge (unless requests are manifestly unfounded or excessive).

10. Face Data, Biometric Characteristics, and Health Data

What Face and Health Data We Process: Because HairSimulate is a hair and eyebrow restoration platform, the photos you upload contain your face, hairline, and scalp/brow features. During upload and simulation, our software detects facial landmarks (such as hairline geometry, brow position, and facial proportions) to align your hairline design, generate realistic AI simulations, and—if you enable "Blur my face" in Community—obscure your eyes and lower face while keeping your hairline visible. You may also voluntarily provide health-related restoration details (such as hair loss stage, graft count, procedure type, or months post-op).

How We Use and Protect Face Data: We do NOT use facial recognition technology to uniquely identify you or verify your identity across services, and we never sell, rent, or trade face data or health data. Your photos are sent to our AI inference providers solely to generate the simulation you requested and are never used to train third-party AI models. Community photos and attached simulations are displayed only according to the visibility setting (Public, Community, or Anonymous) and face-blur option you select.

Face Data Storage and Retention: Original photos and simulation results are stored in encrypted cloud object storage in the European Union. For authenticated users, they are retained until you delete the simulation or your account; for unclaimed guest sessions, they are retained for up to 90 days after last activity. When you delete a photo, simulation, Community post, or account, all associated face images and cached blurred copies are permanently deleted from active storage within 30 days.

11. Children's Privacy

The Service is strictly intended for adults aged 18 and older. We do not knowingly collect, solicit, or process personal data or photos from anyone under 18 years of age. If you are a parent or guardian and believe that a minor under 18 has uploaded photos or provided personal data to us, please contact us immediately at info@hairsimulate.com and we will promptly delete the data.

12. Image Processing and Storage Lifecycle

When you upload photos or share simulations on HairSimulate, your images follow a strict security lifecycle:

  • Secure Upload & Validation: Images are uploaded over TLS-encrypted connections, validated for format and pixel bounds, and stripped of EXIF/GPS metadata
  • Encrypted Storage: Original photos and generated simulation results are stored in access-controlled cloud object storage with public bucket listing disabled
  • AI Simulation Generation: Images are transmitted over encrypted channels to AI inference providers solely to generate your simulation and automated quality score
  • Community De-Identification & Watermarking: When you upload to Community, images receive a hairsimulate.com watermark; if "Blur my face" is enabled, our vision service blurs the eyes and lower face before publication and fails closed if a face cannot be blurred
  • Ownership-Verified Linking: Simulation results and guest sessions can only be linked or shared after server-side ownership verification
  • User-Controlled Deletion: Deleting a simulation, post, or account hides the media immediately and purges the underlying storage objects within 30 days

All storage buckets and database instances are hosted in secure European Union data centers with automated redundancy, strict access controls, and regular security reviews.

13. US State Privacy Rights (CCPA / CPRA & Consumer Health Data)

If you are a resident of California or another US state with comprehensive privacy or consumer health data laws (such as Washington or Nevada), you have specific rights regarding your personal information and consumer health data:

  • Right to Know & Access: Request details about the categories and specific pieces of personal information and health-related data we collect, use, and disclose
  • Right to Delete: Request deletion of your personal information and uploaded photos, and withdrawal of consent for processing consumer health data
  • No Sale or Cross-Context Behavioral Advertising: We do NOT "sell" or "share" (as defined under CCPA/CPRA) your personal information, photos, or health data with third parties for cross-context behavioral advertising
  • Limit Use of Sensitive Personal Information: We use sensitive data (such as facial photos and voluntary hair restoration details) solely to provide the features you explicitly request
  • Right to Non-Discrimination: We will never discriminate against you or deny service quality for exercising your privacy rights

To exercise any of these rights, please email info@hairsimulate.com with the subject line "US Privacy Rights Request".

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect product changes, new features, or legal requirements. We will notify you of material changes by:

  • Posting the updated Privacy Policy at https: //hairsimulate.com/privacy-policy
  • Updating the "Last Updated" date at the top of this policy
  • Sending an email notification to your registered email address (for material changes)
  • Displaying a prominent notice within the Service

Where required by applicable law (such as GDPR or KVKK), we will obtain your renewed consent before applying material changes to how we process your personal data.

15. Contact Us

If you have any questions, concerns, complaints, or requests regarding this Privacy Policy or our data protection practices, please contact our Data Protection team at: