Darmé Privacy Policy
Last updated: October 1, 2026
1. Who is responsible for your information
Darmé is operated by BIIOUI DIGITAL - FZCO, Dubai Silicon Oasis (IFZA), Dubai, United Arab Emirates. We are responsible for deciding how personal information is used to provide Darmé.
Registered address: DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates.
For privacy, support, or a complaint, email contact@darme.app. Use “Darmé privacy request” in the subject line for access, correction, deletion, consent, or other privacy requests. You do not have to contact our suppliers first.
This policy explains information handled through the Darmé app and website, including account creation, cosmetic photo analysis, the Coach, routines, subscriptions, and optional weather information. Darmé is intended for people 18 or older.
2. Information we collect
We collect information you provide, information created when you use a feature, and limited technical information needed to operate and protect the service.
| Category | What this can include | Where it comes from |
|---|---|---|
| Account | Email address, account identifier, display name, and sign-in information: your sign-in methods, and for each active session when it started and was last refreshed, the app or browser description your device sends (user agent) and its IP address | You and the authentication service |
| Questionnaire | Your age, how you describe yourself (woman, man, or prefer not to say; optional), skin concerns, reactions or allergies you mention, whether you use a prescribed skin treatment, preferences, routine habits, and other answers you choose to provide | You |
| Photos | Photos you choose to capture or upload, associated dates, and records of your permission | You and your device |
| Cosmetic analysis | Skin appearance readings and scores (including readings for face areas such as the forehead), skin-type estimates and an estimated skin age when available, analysis dates, and processing status. These are inferences drawn from your face photo | Analysis of the photo you authorize |
| Coach | Your message, earlier messages from the same conversation, the authorized questionnaire and analysis context, selected products, and the generated response | You, your Darmé records, and the AI service |
| Routine and progress | Chosen or owned products (including products you add yourself by scanning a barcode, taking a photo of the pack or typing their name, with the barcode, size and ingredient list found for them, where that list came from and whether its names were translated, and the name and list as printed when they were), the Coach’s reason for a product you chose, the product check for a product you add (its verdict and short reasons), the date you note opening a product, routine steps, check-ins (including optional tags such as calm, breakout, redness or stinging), a 28-day skin test you choose to start (its start date and up to three target concerns taken from your analysis), and reminder preferences | You and your use of the app |
| Subscription | Store and transaction references, entitlement status, expiration dates, and purchase-related events | You, the app store, and the subscription service |
| Consent and security | Photo-analysis consent dates; Coach consent choices, notice versions and server timestamps; account-protection counters and technical events | Your choices and operation of the service |
| Support | Your contact details, message, and any attachments you send | You |
| Diagnostics | Crash reports (error type, message and code location, with email addresses and long numbers removed), app version, platform, and product-usage steps such as reaching a screen, starting an analysis or running a dermatologist search (without the ZIP code or results). Diagnostics never include photos, message text, skin scores, questionnaire answers, or whether the Coach suggested seeing a professional | Your use of the app while signed in |
| Onboarding steps | Which onboarding step you reached (for example the welcome screen, question 3, the photo step or the sign-up screen), with a random installation ID the app creates on your device, the platform (iOS, Android or web) and the app version. The app sends these while you go through onboarding, including before you create an account. They are not linked to you or your account and never include your answers, photos, name or email. Our server uses your IP address only to limit automated misuse, turned into a keyed one-way code that changes every day and is deleted within 4 days. Darmé does not store the address itself; our hosting provider's request logs record it briefly, as described under Website and network information | Your use of the app, including before you create an account |
| Optional location | Device location used to obtain local weather and a location label, and, when you search for a dermatologist, to find your ZIP code on your device | Your device, with permission |
| Dermatologist search | The 5-digit US ZIP code you type or that your device finds from your location. It is used for that search only and is not saved in your account. The app keeps your last searched ZIP code on your device to fill in the next search, and removes it when you sign out or delete your account. Your account keeps a daily count of searches (to limit automated use) and a usage step that a search took place, both without the ZIP code or the doctors shown | You |
| Launch list | The email address you give on darme.app to be told when Darmé launches, and when you gave it | You |
| Website and network information | IP address and request information received by hosting and other services when your device connects | Your browser, device, and network |
If you choose Sign in with Apple or Sign in with Google (when offered), Darmé receives your name, your email address and an account identifier from that provider (Google may also include a link to your profile picture). Apple may give Darmé a private relay address that forwards to your email instead of your real address, and Darmé never receives your Apple or Google password.
An ordinary photo can identify you even if we do not send your name with it. Questionnaire answers and skin readings can also be sensitive. We treat these as private information and do not assume that a cosmetic purpose makes them anonymous or excludes them from health-data protections.
Do not send passwords, payment-card numbers, identity documents, or unrelated medical records to the Coach or support. We do not need your full date of birth for the age-selection step.
3. Why we use information and our legal basis
Where a law requires a legal basis, the following table explains our basis in plain language. “Contract” means information needed to deliver the service you request, not permission for unrelated uses.
| Purpose | Information used | Basis |
|---|---|---|
| Create and secure your account; provide the service you request | Account details and necessary service records | Contract: to provide and administer your account |
| Analyze your selected photo and provide cosmetic readings | Photo, processing information, and results | Your separate, optional consent, given right before the photo is sent for analysis |
| Provide personalized Coach responses | Your message and the questionnaire, analysis, and product context you authorize | Your explicit consent |
| Save and display your routine and progress, including the 28-day skin test summaries and possible patterns between a product and your check-in tags, calculated in the app from your own records | Product selections, routine records, check-ins, and skin test records | Contract: to provide the features you request |
| Check paid access and administer purchases | Subscription status, expiration, and transaction references | Contract: to provide purchased access |
| Prevent fraudulent receipt reuse and protect the service against abuse | Limited transaction fingerprints and security information | Our legitimate interest in preventing fraud and protecting users; you may object |
| Respond to a service or support request | Contact details, your message, and relevant account information | Contract: to resolve your request about the service |
| Show local weather | Location and the weather request | Your consent through the optional location permission |
| Email you once when Darmé launches | Your launch-list email address | Your consent, given when you join the list; you can withdraw it at any time |
| Fix crashes and understand which steps of the app people reach, to make it more reliable and easier to use | Diagnostics described in section 2 | Our legitimate interest in a reliable, working service; you may object |
| See where people stop during onboarding, including before they create an account, to make it shorter and clearer | Onboarding steps described in section 2 | Our legitimate interest in an app that is easy to start using; you may object |
| Handle a privacy request or a binding legal requirement | Information necessary for that particular request or requirement | The applicable legal obligation, when one applies |
For photo and Coach information treated as specially protected health or biometric information under applicable law, we rely on your consent: for photo analysis, the separate agreement you give right before a photo is sent; for the Coach, the separate optional consent you give at sign-up or later in the app, which you can withdraw at any time by turning the Coach off. This does not authorize identification, advertising, or other unrelated processing.
You can refuse optional processing. Declining photo analysis prevents that analysis; turning the Coach off stops any use of the Coach. Neither choice authorizes us to substitute another purpose for the refused processing. Withdrawal does not undo processing already lawfully completed.
4. Photos and facial information
What the analysis does
Your selected photo is analyzed for cosmetic skin appearance only. Darmé does not use it to identify or authenticate a person. Darmé does not sell, rent, or trade facial photos or facial information. It does not use your face as a password or match it against an identity database.
The analysis produces appearance indicators, not a medical diagnosis. It cannot establish the cause of a skin change or replace professional care. A score is not proof of disease, treatment need, or improvement.
Your permission and the photo's route
Before analysis, Darmé asks for an affirmative electronic agreement using a written consent checkbox. Camera or photo-library permission alone does not authorize transmission for analysis. Darmé stores a consent date associated with the selected photo. Saving a photo and authorizing its analysis are separate choices.
A photo captured during onboarding can remain temporarily on your device before account creation and upload. A saved photo is held in your account's private Supabase storage. When you request analysis and consent, Darmé sends the selected photo to Perfect Corp's YouCam analysis API. The upload does not deliberately add your name or email to the photo payload. The image itself is not anonymous.
While you take or choose a photo, the app also makes temporary copies of it on your device. It removes them after the photo is uploaded, retaken or discarded. It also clears any left over each time the app starts and when you delete your account. A photo still waiting to be uploaded is kept until it is uploaded or deleted.
Face check on your phone
Before a photo is saved or sent anywhere, the phone app checks it on your device with Google ML Kit, a face-detection library that runs on the phone. It only looks at whether the photo shows one face, how large the face is, which way the head is turned and whether the eyes look open, so the app can suggest a better photo before you use an analysis. The photo is not sent to Google for this check. The check does not identify you, and its result is not saved or sent to Darmé: it is discarded when you leave the screen. You can always continue with a photo the check questions.
Like Google's other developer libraries, ML Kit sends Google technical information for diagnostics and usage statistics: the device model and operating-system version, the app's name and version, a per-installation identifier, how long the check took, the image size and format, and error codes. This never includes the photo or anything about your face. Google's ML Kit data disclosures: Android, iPhone.
Darmé does not send the other photos in your library merely because you authorize one analysis. Depending on your operating system, you can use the system's limited photo-selection permission or the camera permission.
Retention and deletion
Darmé keeps saved photos until you delete them, delete your account, or stop using Darmé for 3 years, whichever comes first: a daily process automatically deletes the saved photos (and their analyses) of any account with no sign-in or app use for 3 years. You can delete any saved photo yourself in the app (Profile > My skin photos); deleting a photo also deletes its readings. Account deletion removes photos from active Darmé account storage. Keeping a copy in your phone's gallery or an export is your choice; deleting a Darmé copy does not erase your separate copies.
Perfect Corp publishes a 30-day retention period for API-uploaded and generated files, followed by automatic removal. This is the supplier's file-retention schedule, not a promise that deleting your Darmé account immediately deletes the supplier's copy or restarts a 30-day clock. It is not a universal statement about every supplier security record or backup. Perfect Corp API file retention.
If you used photo analysis, when you delete your account Darmé notifies Perfect Corp of your deletion request within 45 days. The notice gives the references of your analyses from the last 31 days, so Perfect Corp can find its copies. Perfect Corp handles the request under its own terms, and its published file retention still applies. For an additional supplier-side request, contact Darmé using Section 11.
Biometric information retention and destruction schedule
Some laws (for example in Illinois, Texas, Colorado and Washington) may treat measurements of facial features created during a skin analysis as biometric information. Darmé uses such information only to produce your cosmetic readings and track your progress, never to identify or authenticate you, and never sells, leases, trades or profits from it. Darmé permanently destroys it at the earliest of: (1) when you delete the photo or your account; (2) when the purpose is satisfied; and (3) 3 years after your last use of Darmé, through the daily process described above. Perfect Corp removes API-uploaded and generated files within the 30-day period it publishes. Darmé discloses this information only to Perfect Corp, to perform the analysis you requested, and where required by law.
5. The Coach and OpenAI
The Coach sends your information to OpenAI only with your separate, optional consent: a box you can tick when you create your account, or the "Turn on Coach" button later. It is not selected by default and your account works without it. Darmé records your consent or its withdrawal, a server timestamp, and the notice version, and the server checks consent before sending any Coach request. You can turn the Coach off at any time.
With your consent, the Coach sends your current message, up to eight earlier messages from the same conversation so it can follow what you already discussed, and relevant context: questionnaire answers, including your declared age where available, skin-analysis results, and selected or owned products. Coach chat does not send your face photos to OpenAI. Product photos you choose to send are a separate feature, described in Section 6, which you confirm each time. When the Coach is on, it can check a product you add; the product’s details and ingredient list are sent with relevant parts of this context. Darmé sets OpenAI's request option not to store these requests for later retrieval. Do not include information in a message that you do not want processed by the Coach provider.
You can withdraw Coach consent in the app. Once the server records withdrawal, it blocks new Coach requests. The app also stops new requests while withdrawal is pending. Withdrawal cannot recall a request that has already reached OpenAI; a failed connection may require retrying to save your choice. If you used the Coach and then delete your account, Darmé notifies OpenAI of your deletion request within 45 days.
OpenAI states that API inputs and outputs are not used for model training by default. Its standard abuse-monitoring logs may contain request or response content and are generally retained for up to 30 days, with exceptions such as legal or safety needs. Darmé does not claim zero-data-retention treatment. OpenAI API data controls.
An AI response can be incorrect. Do not use the Coach for emergencies, diagnosis, or changes to prescribed treatment.
6. Location, reminders, purchases, and local storage
Adding a product. You can add a product you own by scanning its barcode, taking a photo of its pack, or typing its name. To look up a barcode, whether you scanned it or it was read from your photo, the app checks Darmé’s own catalogue and, when needed, Open Beauty Facts, an open database of cosmetic products. To Open Beauty Facts, the app sends only the barcode number, directly from your device, to find the product name, brand, category and ingredient list. Open Beauty Facts receives your device’s IP address with that request. Before any photo of a pack is sent, the app tells you that it will go to OpenAI and asks you to confirm; one confirmation sends the photos you just took of that pack (up to two, such as the front and the back). OpenAI is used only to read what is printed on the pack (the brand, product name, type, size, barcode and ingredient list), to give the standard (INCI) names of ingredients printed in another language and an English name for a product name, or a Latin spelling for a brand, printed only in another language, and to check that no person is in the photo. Translated names are marked in the app. Darmé does not save the photo, and each read counts toward your Coach allowance. Photograph only the pack, not people or faces. Nothing is saved unless you add the product. Then its name, brand, type, size, barcode and ingredient list, where that list came from, and any product check made for it (its verdict and short reasons) are saved with your account. When names were translated, the name and ingredient list as printed on the pack are saved too. If you confirm that the product is one in Darmé’s verified catalogue, Darmé can use the catalogue’s official ingredient list. Darmé does not verify products you add yourself the way it reviews its catalogue. If the Coach is on (Section 5), the Coach can check the product for you: the product’s brand, name, type, size and ingredient list are sent to OpenAI with context described in Section 5. Photos are never part of a Coach check.
Finding a dermatologist. When you search, only the ZIP code is sent to Darmé; your exact location stays on your device. Darmé’s server looks up providers listed with a dermatology specialty near that ZIP code in the public NPPES NPI Registry run by the U.S. Centers for Medicare & Medicaid Services (CMS). Our server makes that request, so CMS receives the ZIP code but not your identity. The ZIP code and the doctors shown are not stored with your account; your account only keeps a daily search count and a usage step that a search took place (Section 2). Results come from the public registry, sorted by distance only: Darmé does not rank or endorse doctors and is not paid by them. Tapping Reviews & directions opens Google Maps, and Google then handles that request under its own terms. Registry listings are self-reported by providers; verify a provider's licence with your state medical board. The Coach may also indicate that something you describe is worth showing a dermatologist, or that you should seek urgent help; this indication is part of its answer and is not stored in your account or in diagnostics.
Weather. Location is optional. The app requests foreground location permission and sends coordinates rounded to two decimal places to Open-Meteo to obtain weather. The connection also exposes your IP address to that service. On native devices, the operating system's location service may receive the original coordinates to obtain a place name. The Darmé weather feature does not maintain a location-history database. Open-Meteo describes request logs, which can include location and network information, with a retention period of up to 90 days. Open-Meteo privacy terms. Disable location permission in device settings to stop future location access.
Reminders. Reminder choices and notification permissions are separate from photo and Coach consent. You can disable notifications in device settings. A notification displayed on a lock screen can be visible to someone near your device. If you start a store free trial with the reminder option ticked, the app schedules one notification on your phone for the day before the trial ends. It is created and kept only on your phone. It stays scheduled after you sign out or delete your Darmé account, because the store trial continues until you cancel it with Apple or Google. Turning off Darmé notifications stops it, and removing the app deletes it.
Purchases. Apple or Google processes payments made through its store. Darmé receives information needed to recognize the purchase and determine access; it does not collect your full payment-card number. RevenueCat supports subscription verification when purchases are connected to that service. Subscription identifiers are not permission to send your photos or skin readings to the billing provider.
Storage on your device. The app uses local storage for features such as onboarding drafts, preferences, pending actions, the random installation ID sent with onboarding steps, and your current Coach conversation. Your sign-in session is kept in your phone's secure storage (Keychain on iOS, Keystore-protected storage on Android). If the secure storage is unavailable, the app may keep the session in its private app storage instead. The onboarding draft (your name, age, answers and email) is kept on your device until you create your account, or for 7 days. The Coach conversation (your last 30 messages) stays on your device only: it is not saved in your Darmé account and is not part of "Download my data". It is erased when you start a new chat, withdraw Coach consent, sign out or delete your account, and when the app finds that you were signed out without choosing it (for example, because your session expired). It is lost if you remove the app or change phones. The website does not set advertising or analytics cookies and does not use third-party trackers, so it does not show a cookie banner. Because the website does not track you across sites, it does not change behavior in response to Do Not Track signals; we honor Global Privacy Control signals as an opt-out request where applicable law requires it. The website and its hosting service also require technical information to serve pages. Browser or device controls can remove local data, but doing so does not necessarily delete your account or cancel a subscription.
7. Who receives information
We limit disclosures to the purpose for which a recipient needs the information.
| Recipient | Role and information involved |
|---|---|
| Supabase | Authentication, private photo storage, account database, and server functions; processes the account and service data stored there |
| Perfect Corp | Receives your authorized photo for cosmetic analysis and returns readings |
| OpenAI | Receives authorized Coach messages and selected context described in Section 5, including product checks, and product photos you confirm, to read what is printed on the pack and to check that no person is in the photo (Section 6) |
| RevenueCat and the relevant app store | Purchase and subscription processing; account or transaction identifiers and entitlement information |
| Google Workspace | Receives and processes support correspondence for the darme.app domain, including your email address and the content you send |
| Sentry (Functional Software, Inc.) | Receives technical crash and error reports only (error type, app step, device and app version); never photos, messages, answers or your email. |
| Google (ML Kit, in the phone app) | Receives technical diagnostics from the on-device face check (device model and system version, app version, a per-installation identifier, timing, image size and error codes); never the photo or information about your face |
| Resend | Delivers account emails initiated through Supabase Auth, including signup confirmations, password recovery, and account-verification codes, and the single launch email to people on the launch list. Processes recipient email addresses, message content, and delivery information |
| Open-Meteo and device location services | Provide the optional weather and location-label functions described above |
| Open Beauty Facts | Receives a barcode number to look up (one you scan or one read from your photo), directly from your device (with your IP address), and returns public product information |
| U.S. Centers for Medicare & Medicaid Services (NPI Registry) | Receives the ZIP code of a dermatologist search from Darmé’s server, without your identity, and returns public provider listings |
| Vercel | Hosts the public website and receives technical connection information needed to serve it |
| Authorized Darmé personnel | Access information when needed for a support request, service operation, security, or a privacy request |
The contact details of each recipient of consumer health data are listed in our Consumer Health Data Privacy Policy and in third-parties.json in your data download (Section 10).
We may disclose information when a binding legal requirement requires it or when necessary to establish, exercise, or defend a legal claim. Such a disclosure is limited to its purpose and applicable law. We do not treat a support request as permission to publish your photo, testimonial, or skin results.
8. International processing and safeguards
Darmé operates from the United Arab Emirates, and providers may process information in other countries. The laws of those countries can differ from the laws where you live. Storage location alone does not describe every location from which a provider may operate or support its service.
Supabase, OpenAI, RevenueCat, Google, and Resend publish data-processing agreements containing provisions for standard contractual clauses. These clauses are a recognized contractual mechanism for certain restricted international transfers. Supabase DPA, OpenAI DPA, RevenueCat DPA, Google Cloud and Workspace DPA, Resend DPA.
Perfect Corp describes its handling of information in its business privacy policy and API terms. These public notices are not, by themselves, evidence that standard contractual clauses cover a particular transfer.
If applicable law requires a transfer safeguard, that safeguard must be in place for the transfer. The existence of a public supplier agreement alone does not establish its application to your information. Contact us for the recipients, processing locations, and safeguards applicable to your request, or for an available copy of the relevant safeguards with confidential information removed.
9. How long information remains
We use retention criteria tied to the purpose of each record. Account deletion is available without purchasing or renewing a subscription.
| Information | Retention or removal criterion |
|---|---|
| Saved photos | Until you remove them or delete your account, and automatically after 3 years without using Darmé; subject to the separate supplier and technical-copy explanations in this policy |
| Questionnaire, cosmetic results, routine and progress records | While maintained in your account; removed from active Darmé account records when account deletion completes |
| Account identity and authentication records | While needed for your account; removed through the account-deletion process |
| Photo consent dates and Coach consent records | Kept with your service records to record your choices. Linked records are included in account deletion; a photo's consent date is removed with its associated photo record |
| Temporary provider-response JSON held by Darmé | Assigned a 24-hour expiry after capture, with scheduled removal every minute. This is separate from saved normalized analysis results and the supplier’s files. Processing delays or service outages can delay physical removal |
| Subscription history held in your Darmé account | While needed to administer access, purchases, or a dispute; linked Darmé account records are removed on account deletion. Stores and other providers can retain their own records under their policies and applicable obligations |
| Diagnostics (crash reports and product-usage steps) | Automatically deleted after 90 days; also included in account export and removed on account deletion |
| Onboarding steps | Automatically deleted after 90 days. They are not linked to an account, so they are not part of account export or account deletion. The daily IP code used to limit misuse is deleted within 4 days |
| Launch-list email address | Deleted automatically 12 months after you join. To be removed sooner, email contact@darme.app with “Remove me from the launch list”. It is used only for the launch email and is not added to any Darmé account |
| Support correspondence | For as long as needed to resolve the request and any related follow-up or dispute, then deletion. There is no fixed automatic support-email expiry in the app |
| Security and abuse records | For as long as needed to protect the service or investigate a specific incident, then deletion. Account-linked counters are covered by account deletion; hosting or provider logs have their own retention controls |
| Deletion records | When an account or a saved photo is deleted, Darmé keeps a one-way code made from its random identifier, with the deletion date. It holds no name, email, photo or reading. Deleted after 35 days. It lets us delete the account or photo again if we ever restore a backup |
| Processor deletion notice | When you delete your account, Darmé keeps the deletion date, whether you used photo analysis and the Coach, and the references of your Perfect Corp analyses from the last 31 days, with no photo, reading, name or email. Deleted 7 days after the notices in Sections 4 and 5 are sent, and in any case after 90 days |
| A record required for a specific legal duty or claim | Only for as long as needed for that duty or claim; this policy does not assign a universal statutory retention period to all transactions or messages |
Antifraud exception after account deletion. Darmé keeps a one-way fingerprint of a store transaction reference to prevent reuse of the same receipt. It removes the fingerprint's account link during deletion. The fingerprint contains neither your name nor your email and is not used to track your browsing or for advertising. Removing the account link does not guarantee anonymization: the same transaction reference can reproduce the fingerprint.
There is currently no automatic time-based expiry for that retained fingerprint. You can ask us to review continued retention or object to its use for fraud prevention. We do not promise erasure after 30 days, 90 days, or one year when no such deletion schedule is in place.
Provider and technical copies. Removing active Darmé records does not certify that every infrastructure backup, supplier log, store record, or already-downloaded copy has been erased at the same moment. The supplier periods in Sections 4–6 describe the relevant supplier data, not a single deadline covering all copies. Darmé does not promise immediate physical erasure of every provider backup. Deleted records can remain in our database host's encrypted rolling backups until those backups expire on the host's schedule. If we ever restore a backup while our live database can still be read, we use our deletion records (a one-way code for each deleted account and photo, kept for 35 days) to delete again the accounts and photos deleted before the restore. If the live database itself is lost, we cannot do this, and we will tell affected users.
10. Exporting and deleting your information
Download your account data
In Profile, choose the option to download your data. After authentication, the server prepares a direct ZIP download containing:
- Photos currently present in your private Darmé photo folder.
- Account information (
account.json), including the sign-up choices still kept with your account, such as your age declaration, and your sign-in records (your sign-in methods and, for each active session, its dates, user agent and IP address). - Questionnaire answers (
questionnaire.json). - Stored analysis results (
analysis-results.json), including stored readings not shown in a free preview. - Routine, product selections, check-ins, 28-day skin tests and related progress records (
routine.json). - Consent records (
consents.json): photo-analysis consents, Coach consent choices and your age declaration. - App activity and diagnostics linked to your account (
activity.json): usage steps, crash reports, and daily counts of Coach messages and dermatologist searches. - Records of your saved photos (
photo-records.json): when each was taken and saved, and when you agreed to save it. Your agreement to each analysis is inconsents.json. - Subscription history and associated account records (
subscription-history.json). - The recipients of consumer health data named in our Consumer Health Data Privacy Policy, with their contact details and whether each received yours (
third-parties.json). Other suppliers are listed in Section 7. - All your account's database records together in one file (
all-records.json), plus a manifest and completion marker to help identify a complete export.
Delivery starts during the request rather than being sent later by email. Large exports take longer and require a working connection and sufficient device space. If the export fails or the completion marker is missing, retry or contact us.
This download covers the account data collected by the export service. It does not include:
- Your Coach conversation, which is kept only on your phone (Section 6).
- The launch-list email address, which is not linked to an account. Email us to ask about it.
- Catalog review and audit records made by Darmé staff in the course of their work.
- Supplier systems, infrastructure backups, your support mailbox correspondence, or every internal technical field.
You can request additional personal information through the contact address in Section 1.
Delete a photo or your account
Delete an individual saved photo in the app (Profile > My skin photos), or contact us. To delete the account, use Profile or the public account-deletion page. The public page can be opened without signing in; completing deletion requires verification of the account, such as a code sent to its email address, and your confirmation.
The account-deletion process removes files from your private photo folder and deletes account records and authentication access. It checks for remaining files before confirming completion. If a failure occurs, the account can remain pending deletion and you may need to retry. A failed request is not a confirmation of complete erasure.
The limited exceptions in Section 9 remain, particularly the detached transaction fingerprint, the deletion records and processor deletion notice, and records outside Darmé's active account system. Deletion is irreversible for the removed account information. Deleting the app or your Darmé account does not itself cancel an Apple or Google subscription. Cancel renewal through the store separately.
11. Your choices, requests, and complaints
Depending on the laws that apply, you may request access, correction, deletion, a portable copy, restriction of processing, or information about recipients. You may withdraw consent and object to processing based on legitimate interests. Rights can have exceptions; if a request cannot be fulfilled in full, you may ask for the reason and reconsideration.
To make a request, contact contact@darme.app. Identify the account email and explain the action you want. Do not send your password or an unrequested identity document. We may request proportionate verification to avoid giving your information to someone else. Where applicable, an authorized agent can act for you with evidence of authority.
We handle requests within the deadline required by applicable law. Where the GDPR or UK GDPR applies, the normal deadline is one calendar month, with a permitted extension and notice where the legal conditions for it apply. You can also complain to the competent data-protection authority. Exercising a privacy right is not a reason to penalize you; a feature may nevertheless be unavailable when it needs processing you have refused.
For a complaint or appeal, email the same address with “Darmé privacy complaint” or “Darmé privacy appeal,” describe the decision or problem, and include an earlier case reference if available. This contact process does not prevent you from approaching a regulator or exercising a legal remedy.
Where the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies, you have the rights it grants, and you can complain to the UAE Data Office.
Requests concerning suppliers
When you delete your account, Darmé notifies Perfect Corp if you used photo analysis (Section 4), and OpenAI if you used the Coach (Section 5), of your deletion request within 45 days. You may also ask Darmé to coordinate an additional request concerning data sent through its service. A supplier may need Darmé's account or processing references to locate the information; an email address alone may not identify a photo upload or API request.
You may also contact Perfect Corp at privacyteam@perfectcorp.com, or OpenAI at dsar@openai.com or its privacy request portal. Explain that the processing occurred through Darmé, operated by BIIOUI DIGITAL - FZCO, and provide the approximate date and type of processing. Do not attach another facial photo or identity document unless necessary and requested through an appropriate channel.
Ask for written confirmation of the outcome, what was erased, any retained categories, the reason for retention, and the applicable remaining period. A provider may refer the request to Darmé. Its published storage period is not a guaranteed response deadline for a particular erasure request, and written confirmation is not independent proof that every technical copy has disappeared.
12. Sensitive information and United States privacy rights
Darmé's cosmetic purpose does not prevent skin-related information or inferences from qualifying as consumer health data or other sensitive personal information under some laws. The categories, sources, purposes, recipients, consent controls, and deletion routes described above also explain how Darmé handles that information.
We do not sell personal information and do not share it for cross-context behavioral advertising, and have not done so in the past 12 months. We do not knowingly sell or share personal information of consumers under 16. We use sensitive personal information (face photos, skin readings, health-related answers and account log-in) only to provide the features you request and for the other purposes permitted by 11 CCR §7027(m), so we do not offer a separate “Limit the use of my sensitive personal information” link. Where state law requires opt-in consent for sensitive data, Darmé asks for it before processing (the photo-analysis agreement and the optional Coach consent).
Washington and Nevada residents, and anyone interested, can read our Consumer Health Data Privacy Policy, which lists the consumer health data we collect, why, where it comes from, who receives it, and how to exercise your rights.
We do not sell facial information, rent it, trade it, or disclose it for targeted advertising. Photo and Coach data are used for the requested features with the relevant consent. You can ask for access, correction, deletion, information about disclosures, or withdrawal of consent, and appeal a refusal where applicable law provides those rights. Applicable state-law exceptions and verification requirements still apply. We respond within the period your state requires (generally 45 days, extendable once where the law allows). If we decline a request, you can appeal as described in Section 11; if you are not satisfied with the appeal, you can contact your state Attorney General. We will not discriminate against you for exercising a privacy right.
Darmé is not represented as a HIPAA-covered healthcare provider or as a substitute for a medical record system. Nothing in this policy waives mandatory federal, state, or other privacy rights.
13. Security and age restriction
Darmé uses authenticated account access and private photo storage, and the server checks access to protected features. Sensitive operations, including account deletion, require account verification. No internet service can promise absolute security. Protect your device, email account, and sign-in credentials; contact us if you suspect unauthorized access. If a security incident affects your personal information, we will notify you, and the authorities where required, without unreasonable delay and within the time the applicable law sets.
Darmé is for adults aged 18 and over. If you are under 18, do not create an account or submit a photo. Age information you provide is self-reported; Darmé does not provide identity-document or facial age verification. If you believe we hold information from someone under 18, contact us so the situation can be investigated and the appropriate action taken.
14. Changes to this policy
The date above identifies this version. If our practices change materially, we will provide an appropriate notice. Where new processing requires consent, publication of a revised policy alone does not supply that consent. The Terms of Use explain the service and subscription conditions separately.