Privacy Policy

Last updated: 1 September 2026 · Back to home · Contact

Who we are

Veramane ("we") operates this hair-consultation service, from Nova Scotia, Canada. We are responsible for personal information under our control, including personal information processed by service providers on our behalf.

For privacy questions, access or correction requests, deletion requests, withdrawal of consent, or complaints, contact our Privacy Officer at support@veramane.com. We read every message.

What we collect

• Access codes — when you purchase a consultation we create an access code and record when it was first used, how many consultation turns it has run, your confirmation that you're at least the age of majority in your jurisdiction of residence, and a reference to your Stripe payment (so that if you're refunded in full we can deactivate the code). Payment itself is processed by Stripe; we never see or store your card details.
• Consultation messages — the text you send during a consultation is processed to generate responses. Your conversation history is kept in your own browser, not in an account database on our servers; messages may still be transmitted to our AI processing provider so the service can respond. We may also derive de-identified, aggregated insights about the topics people ask about, as described in "Aggregated insights and research" below.
• Technical and device data — when you use the service we may automatically collect limited technical information, such as your IP address, general location derived from it, browser and device type, and similar diagnostic data. We use local browser storage (localStorage) to operate the service, keep your consultation history on your device, and maintain security; we do not use cookies. We use this information only to run, secure, and troubleshoot the service. We do not use third-party analytics, tracking scripts, or performance tools.
• Photos — see the next section, because this matters most.

Your photos and sensitive data

To give styling advice, the service analyzes characteristics visible in your photo, which includes your face shape, hair texture and condition, colour, and skin undertone. Because this involves imagery of your face, and AI-based appearance analysis, we treat photos and related analysis as sensitive personal information:

• Express, meaningful consent first. Before you upload a photo for analysis, the app gives a clear just-in-time notice explaining what will be analyzed, why, who will process it, and your choices. You must actively consent before photo upload or analysis, and you can decline and consult by text description instead.
• Only temporary processing and storage. Temporary processing, not a photo repository. Photos are processed in your browser and transmitted for analysis only to provide the consultation. We do not create a permanent image repository, photo library, gallery, or account archive. Temporary copies may exist only as technically necessary to transmit, secure, troubleshoot, or complete the analysis, and are not kept for a separate purpose. You can choose to use a face-masking tool to obscure your facial image before it is transmitted for processing.
• AI processing partner. Analysis is performed on behalf of Veramane through Anthropic's Claude API. Anthropic processes photos and consultation content as our AI service provider under its API data handling terms; pursuant to Anthropic’s Commercial Terms of Service, we do not permit any use of your content for model training.
• No biometric identification. We do not use the service for facial recognition, identity verification, or to create face templates, faceprints, or any biometric identifiers used to recognize you. We do not sell your personal information.

Adults only

Use of the services is intended for individuals who are at least the age of majority, and users must only submit photos of themselves. Do not submit photos of children or photos of anyone else. Parents may discuss children's hair by text description only.

What we never do

• Sell or rent your personal information — to anyone, ever.
• Use your photos for advertising, marketing, or AI training. Any analytics or trend research we conduct uses only de-identified, aggregated information as described in “Aggregated insights and research.”
• Disclose your personal information except with service providers named here:
  • Stripe for payments;
  • Anthropic for AI analysis;
  • Fly.io for application hosting;
  • Google Workspace for mailbox use;
  • Cloudflare for domain name system only;
  • Google Drive for off-site backups of server data files;
  • UptimeRobot for external uptime monitoring;
  • QuickBooks Online for bookkeeping; and
  • The above noted parties’ authorized subprocessors where needed to provide such services, or where the law requires it.

Use of Personal Information

We use information that we collect about you or that you provide to us, including any personal information:

• To present our tool and its contents to you.
• To provide you with information, products, or services that you request from us.
• To fulfill the purposes for which you provided the information or that were described when it was collected, or any other purpose for which you provide it.
• To carry out our obligations and enforce our rights arising from any contracts with you, including for billing and collection or to comply with legal requirements.
• To notify you about changes to our website or any products or services we offer or provide though it.
• To improve our website, products or services, marketing, or customer relationships and experiences.
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

Disclosure of Personal Information

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may disclose personal information that we collect or you provide as described in this privacy policy:

• To our subsidiaries and affiliates.
• In accordance with applicable law, to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Veramane's assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Veramane about our customers and users is among the assets transferred.
• To contractors, service providers, and other third parties we use to support our business (such as analytics and search engine providers that assist us with website improvement and optimization) and who are contractually obligated to keep personal information confidential, use it only for the purposes for which we disclose it to them, and to process the personal information with the same standards set out in this policy.
• To fulfill the purpose for which you provide it.
• For any other purpose disclosed by us when you provide the information.
• With your consent.

We may also disclose your personal information:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request, in accordance with applicable law.
• To enforce or apply our Terms of Service and other agreements, including for billing and collection purposes.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Veramane, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

Cross-Border Transfers

We rely on a small number of service providers to operate the service: Stripe (payment processing) and Anthropic (AI analysis of consultation content and photos). These providers, and their authorized subprocessors, may store or process your personal information, including sensitive information such as photos, on servers located in the United States or other countries outside Canada. As a result, your personal information may be subject to the laws of those jurisdictions and may be accessible to courts, law enforcement, or government authorities there.

Retention

The personal information that you provide will be retained by us in accordance with applicable laws. However, we will take reasonable steps to destroy or permanently de-identify personal information we hold if it is no longer needed for the purposes for which it was collected.

Access-code records are kept for as long as needed to provide the consultation, manage refunds, prevent abuse, and meet legal, accounting, tax, and security needs. Stripe payment references are kept as needed for payment, refund, accounting, and fraud-prevention records. Consultation messages and local browser history are kept in your own browser unless you delete them, clear your browser storage, or use a different device. Photos are not kept in a permanent photo repository. Security logs, error logs, and similar technical records may be kept for a limited period for security, debugging, audit, and legal purposes.

Aggregated insights and research

We may create de-identified, aggregated insights about the topics people ask about. We do not use this information for advertising, marketing, profiling, or any decision about you. This takes one of two forms: (1) counts of questions against a fixed list of categories, or (2) short de-identified summaries of a question theme (for example, “asked whether bleach is safe some months after a medical treatment”). You may withdraw consent to this use at any time by contacting the Privacy Officer, and doing so will not affect your ability to use the consultation service.

What we use for this: only the general subject matter of questions. We do not use your photos (which are never stored in a permanent repository), verbatim conversation text, or any information linked to your access code, payment, session, device, IP address, or any other identifier. De-identified summaries are written so they contain no names, dates, locations, or other details capable of identifying a person, and we apply generally accepted practices so the resulting insights cannot reasonably be re-associated with you.

Because these insights are de-identified and aggregated, they are not used to make decisions about you and cannot be traced back to you. We may share or publish aggregate statistics and de-identified trend research, but we never publish anything that identifies, or could reasonably be used to identify, an individual.

Access and Correction

We will take reasonable steps to ensure the personal information we hold is accurate, complete and up-to-date. Upon your written request, and subject to certain exceptions provided by law, we will inform you of the existence, use, and disclosure of your personal information and give you access to that information. We may charge a minimal fee for providing such access to you. If you believe that the personal information that we hold about you is not accurate or complete, you may write to us at support@veramane.com . If you are able to establish that the information is not accurate or complete, we will take reasonable steps to delete and/or correct the information so that it is accurate, complete, and up-to-date. In order to facilitate a request to correct or update information, we may ask you to provide additional information to confirm your identity. Any such information will only be used for the purpose of confirming your identity and will not be retained by us.

Transfers out of Canada

Note that Personal information may be stored, accessed, used and otherwise processed inside and outside of Canada. When Personal Information is located outside Canada, it may be subject to laws that have different standards of protection and may allow for foreign law enforcement and governmental access.

If you are not satisfied with how we have handled your personal information or a privacy request, you may contact the Office of the Privacy Commissioner of Canada or the privacy regulator in your province or territory.

Safeguards and incidents

We use administrative, technical, and contractual safeguards appropriate to the sensitivity of the information, including limiting what we collect, limiting access, using service providers with security commitments, and avoiding a permanent photo repository. No online service is risk-free. If we become aware of a confidentiality incident or breach that creates a real risk of significant harm, we will take reasonable steps to reduce the risk, notify affected users and regulators where required, and keep required records.

Changes

If this policy changes materially, we'll post the update here with a new date. For material changes affecting photo uploads, AI analysis, sensitive information, cross-border processing, or consent choices, we will give appropriate notice and ask for consent again where required.