Privacy Policy — Haircut Simulator

Last updated: 29 May 2026

This Privacy Policy explains how Hbrothers L.L.C., trading as Hbro Studio ("we," "us," "our"), collects, uses, shares, and protects personal data when you use the Haircut Simulator mobile application on iOS and Android (the "Service").

This policy is specific to Haircut Simulator. It does not cover any other application we publish.

1. Quick summary

2. Who we are

Controller

Hbrothers L.L.C., trading as Hbro Studio 412 W 7th St, Clovis, NM 88101, United States Email: info.hbrothers.llc@gmail.com Website: https://rivia.studio

Hbrothers L.L.C. is the data controller for personal data processed in connection with Haircut Simulator.

EU Representative (Article 27 GDPR)

We have appointed the following representative in the European Union under Article 27 of the EU GDPR. EU-based users may contact this representative directly on all questions concerning the processing of their personal data:

Thibault Mundele Rua Pinto Ferreira 56, 1D 1300 Lisbon, Portugal Email: info.hbrothers.llc@gmail.com

UK Representative (Article 27 UK GDPR)

We are in the process of appointing a UK representative under Article 27 of the UK GDPR. In the interim, UK-based users may contact us at info.hbrothers.llc@gmail.com for all questions concerning the processing of their personal data. This section will be updated once the UK representative is in place.

Privacy contact

For any privacy-related question or to exercise the rights described in Section 11, contact us at: info.hbrothers.llc@gmail.com

We do not have a formal Data Protection Officer. The address above is our designated privacy point of contact.

3. What this policy covers

This policy applies only to the Haircut Simulator iOS and Android applications and the services provided through them. It does not cover other apps we publish, or third-party websites or services that Haircut Simulator may link to.

4. Account model

Haircut Simulator can be used in two modes:

• Anonymous mode. You can use the app without creating an account. In this case, we identify your device with an anonymous Firebase identifier so that we can deliver the Service and track your free-tier usage. We do not know who you are.
• Signed-in mode. You may choose to sign in. In that case we collect your email address so that we can recognise you across devices and link your subscription to your account.

You can move between modes by signing in or signing out at any time. Data deletion is available in both modes (see Section 13).

5. What data we collect

5.1 Data you provide to us

• Email address — only if you sign in. Used to identify your account.
• Photos — the images you upload (or capture) so the app can analyse your face shape and generate hairstyle, hair-colour, and makeup previews.
• Subscription and payment status — whether you have an active subscription, the plan, trial status, and renewal dates. Note: Apple and Google process the actual payment. We never see your card number or full payment details.
• Support correspondence — if you email us, we keep your message and our reply to handle your request.

5.2 Data collected automatically when you use the Service

• Anonymous user identifier — a Firebase-generated ID associated with your device.
• Device and technical data — device model, operating system version, app version, language, country, IP address, time zone, network type.
• Usage data — features used, generations created, free-tier counters, screens viewed, errors, crash diagnostics.

We do not collect advertising identifiers and we do not create profiles for advertising.

5.3 Biometric data — face-shape analysis

This section is important because Haircut Simulator analyses your face.

To recommend hairstyles and styles that suit you, the app analyses the photo you provide to determine your face shape. This analysis derives facial-geometry measurements (for example, the proportions and contours of your face). Under several laws — including the EU/UK GDPR (Article 9), the Illinois Biometric Information Privacy Act (BIPA), and similar US state laws — these measurements are biometric data.

We want to be clear about exactly what we do and do not do:

• We process your facial-geometry measurements only to analyse your face shape and generate your style recommendation and previews.
• We process this data only with your explicit, opt-in consent, which we request before any face analysis takes place. You can decline; you simply won't be able to use the face-shape recommendation feature.
• We use it solely to produce your result and recommendations. We do not use it to identify you, to recognise you across sessions, for advertising, profiling, or analytics, we do not use it to train AI models, and we never sell, lease, or trade it.
• We process your facial-geometry measurements transiently: they are used to generate your face-shape result and recommendations, and are deleted once your result has been delivered to you. We do not build or keep a facial template, faceprint, or embedding.
• The face-shape analysis is performed on our own secured infrastructure; only anonymous numeric measurements (not your photo) are sent to OpenAI to generate the style suggestions (see Section 7).

You may withdraw your consent to face analysis at any time in the app's settings. Withdrawal stops future face analysis; it does not affect processing already carried out.

5.4 Other sensitive data

Apart from the face-shape analysis described in Section 5.3, we do not collect special-category data such as health, political, religious, or sexual-orientation data.

6. Why we process your data and on what legal basis

You have the right to withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before withdrawal. You can withdraw consent to face analysis and turn off notifications in the app settings.

7. Sub-processors and third parties

To run Haircut Simulator we use the following sub-processors. Each one processes personal data on our instructions under a written agreement.

We do not sell your personal data. We do not share your photos or face data with third parties for advertising or AI-model-training purposes.

8. SDKs and consent

Haircut Simulator does not use website cookies. It uses third-party software development kits (SDKs) that we classify as strictly necessary to operate the Service:

• Firebase Auth, Firestore, Storage — operating the Service
• Firebase App Check — anti-abuse protection
• Firebase Crashlytics and Firebase Logging — used solely for diagnosing technical errors and operating the Service. We do not use these for behavioural analytics, profiling, or advertising
• RevenueCat — running your subscription
• Apple StoreKit / APNs and Google Play Billing / FCM — payments and notification delivery

We do not use any advertising or cross-app tracking SDKs (no Meta SDK, no ad networks). Because we do not run non-essential tracking, we do not display an ePrivacy/cookie-style tracking consent banner.

This is separate from the biometric consent described in Section 5.3, which we always request before analysing your face — regardless of where you live.

Haircut Simulator does not currently send marketing or promotional push notifications.

9. International data transfers

We are based in the United States, and most of our sub-processors are also based in the United States. When personal data of EU or UK users is transferred outside the European Economic Area or the United Kingdom, we rely on appropriate safeguards under Chapter V of the EU GDPR / UK GDPR, including:

• The EU-US Data Privacy Framework adequacy decision for transfers to sub-processors certified under the framework (including Google LLC).
• Standard Contractual Clauses for transfers to sub-processors that are not covered by an adequacy decision.
• The UK International Data Transfer Agreement / UK Addendum for transfers from the United Kingdom.
• For the video feature, your photo may be processed by a sub-processor in China (Kuaishou / "Kling", reached via Replicate). This transfer relies on Standard Contractual Clauses with supplementary safeguards. If you do not use the video feature, your photo is not sent to this sub-processor.

You may request more information about the safeguards in place for a specific transfer by contacting us at info.hbrothers.llc@gmail.com.

10. How long we keep your data

When the retention period ends, we either delete the data or anonymise it so it can no longer be linked to you.

11. Your rights (EU/UK/EEA users)

Under the EU GDPR and the UK GDPR you have the following rights:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure / "right to be forgotten" (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent (Art. 7(3)) — at any time, including consent to face analysis, with no effect on the lawfulness of prior processing
• Right not to be subject to automated decisions with legal effect (Art. 22). Haircut Simulator does not make decisions producing legal or similarly significant effects about you.
• Right to lodge a complaint with a supervisory authority — find your national authority at https://edpb.europa.eu/about-edpb/about-edpb/members_en. UK users can complain to the ICO at https://ico.org.uk.

To exercise any of these rights, write to info.hbrothers.llc@gmail.com. We will respond within one month, as required by Article 12(3) GDPR. We may ask you to confirm your identity before we act on a request.

12. Biometric data rights (US — Illinois and similar states)

If you are in Illinois, Texas, Washington, or another US state with a biometric privacy law, the following applies in addition to Section 19:

• We obtain your written/affirmative consent before collecting or processing your facial-geometry measurements.
• We use that data only to provide the face-shape analysis and style recommendations you request.
• We do not sell, lease, trade, or otherwise profit from your biometric data.
• Retention-and-destruction schedule: we do not retain your facial-geometry measurements. They are permanently destroyed as soon as your face-shape result has been generated and delivered. This is our publicly available written retention schedule as required by BIPA.
• We do not disclose your biometric data except to the processors strictly necessary to deliver your result (Section 7), under written agreements.

13. Account and data deletion

You can permanently delete your data from inside the app, under Settings → Delete my account. This option is available whether you are signed in or using the app anonymously — you do not need to be signed in to use it.

Deletion is irreversible and removes:

• Your account record (if signed in)
• Your uploaded photos and generated images (including any annotated analysis image)
• Your subscription association
• Any analytics identifiers we hold for you

(Your facial-geometry measurements are not retained — they are deleted as soon as your result is generated — so there is nothing further to remove there; see Section 10.)

Deletion completes within 30 days.

For abuse-prevention purposes only, we retain a minimal device-level record after deletion: a hashed device identifier (a hashed form of Apple's Identifier For Vendor, the Android / Firebase Installations ID, or equivalent) together with a flag indicating whether that device has already used its free-tier quota. This record contains no identifying content, is not used to re-create any account, and exists solely to prevent users from indefinitely resetting the free tier through repeated deletions. This minimal retention is based on our legitimate interest under Article 6(1)(f) GDPR in preventing service abuse, and falls within the exceptions to the right of erasure under Article 17(3) GDPR. The record is reset if you fully uninstall the app.

Please note that deleting your data does not cancel your App Store or Google Play subscription. To cancel, go to iOS Settings → Apple ID → Subscriptions or Google Play → Payments & subscriptions → Subscriptions.

If you cannot access the in-app option, you can also email us at info.hbrothers.llc@gmail.com and we will process the deletion on your behalf.

14. Children

Haircut Simulator is not directed at children. We do not knowingly process personal data — or any biometric data — of children under 16 (or the equivalent minimum age for digital consent in your country). If you are a parent or guardian and believe your child has used the app, contact us at info.hbrothers.llc@gmail.com and we will delete the data.

15. AI-generated content

Haircut Simulator uses generative AI models to produce hairstyle, hair-colour, and makeup previews from the photo you provide. The output is generated automatically based on your input and the model's parameters. We do not use your photos, your face data, or your generated images to train AI models.

Images generated by the app are identifiable as AI-generated: each generated image carries a marker indicating it was produced by AI, and exported or shared images include a visible "Generated with AI" indication.

16. Subscriptions and refunds

Haircut Simulator offers a free tier (a limited number of generations) and paid subscriptions. Subscriptions are sold through the Apple App Store and Google Play. Payments, billing, renewal, and refund requests are handled by Apple or Google under your account terms. Apple refund requests go to https://reportaproblem.apple.com; Google Play refund requests go through the Play Store. We have no ability to issue store refunds directly.

EU and UK consumers should note that, under Article 16(m) of the EU Consumer Rights Directive (Directive 2011/83/EU) and equivalent UK law, the right of withdrawal from a digital content contract is lost once supply of the digital content has begun with your express prior consent. By starting to use the app's paid features after subscribing, you provide that consent.

17. Push notifications

Haircut Simulator only sends transactional push notifications — for example, "your result is ready" or "your subscription will renew tomorrow." These are sent on the basis of our contract with you (Article 6(1)(b) GDPR) to users who have granted notification permission. We do not currently send marketing or promotional push notifications.

You can turn off notifications at any time in iOS or Android settings.

18. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS 1.2+) and at rest, access controls, App Check protection against unauthorised clients, and logging. No system is perfectly secure, and we cannot guarantee absolute protection. If we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, inform you directly, in accordance with Articles 33 and 34 GDPR.

19. California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what categories of personal information we collect and the purposes for collection;
• Access the personal information we hold about you;
• Request deletion of your personal information;
• Correct inaccurate personal information;
• Opt out of any sale or sharing of personal information for cross-context behavioural advertising;
• Limit the use of sensitive personal information (which includes biometric information);
• Not be discriminated against for exercising these rights.

We do not "sell" personal information, and we do not "share" personal information for cross-context behavioural advertising. We treat facial-geometry measurements as sensitive personal information and use them only to deliver the service you requested. To exercise your CCPA rights, email info.hbrothers.llc@gmail.com.

We retain personal information for the periods described in Section 10. We do not knowingly collect personal information of consumers under 16 without consent.

20. Other jurisdictions

If you are located outside the EU, the UK, or California, applicable local privacy laws may grant you similar rights (for example, Canada's PIPEDA, Brazil's LGPD, Australia's Privacy Act). You can exercise any such rights by writing to info.hbrothers.llc@gmail.com.

21. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent change. If we make material changes, we will inform you through the app or by email before they take effect, where required by law.

22. Contact

Hbrothers L.L.C., trading as Hbro Studio Email: info.hbrothers.llc@gmail.com Website: https://rivia.studio

EU Representative (Article 27 EU GDPR): Thibault Mundele, Rua Pinto Ferreira 56, 1D, 1300 Lisbon, Portugal — info.hbrothers.llc@gmail.com UK Representative (Article 27 UK GDPR): appointment pending — contact info.hbrothers.llc@gmail.com in the meantime.